Skip to main content

Weak CAPTCHA

Need​

Implementation of a strong and secure CAPTCHA mechanism

Context​

  • Usage of Go 1.16 for developing high-performance and efficient applications
  • Usage of gin-gonic/gin for building web applications in Go
  • Usage of base64Captcha for generating and validating base64 encoded CAPTCHA images

Description​

Non compliant code​

package main

import (
    "github.com/gin-gonic/gin"
    "github.com/mojocn/base64Captcha"
)

var store = base64Captcha.DefaultMemStore

func main() {
    router := gin.Default()
    router.GET("/captcha", generateCaptcha)
    router.Run(":8080")
}

func generateCaptcha(c *gin.Context) {
    driver := base64Captcha.NewDriverDigit(80, 240, 4, 0.7, 80)
    cp := base64Captcha.NewCaptcha(driver, store)
    id, b64s, err := cp.Generate()
    if err != nil {
        c.JSON(500, gin.H{"message": "failed to generate captcha"})
        return
    }
    c.JSON(200, gin.H{"captchaId": id, "captcha": b64s})
}

The code above is a simple Go backend application that uses the Gin framework to handle HTTP requests. It generates a CAPTCHA image using the base64Captcha library and sends it as a response to the client.

The vulnerability lies in the CAPTCHA generation method. The base64Captcha.NewDriverDigit function is used to create a driver for generating the CAPTCHA. This function takes several parameters that define the properties of the CAPTCHA, such as its width, height, the number of digits in it, and the noise level. In this case, it generates a CAPTCHA with 4 digits, which is not secure enough, and can be easily bypassed by optical recognition tools.

Moreover, the CAPTCHA is generated without any distortion or noise, making it even easier for optical recognition tools to recognize the digits. The noise level is set to 0.7, which is not high enough to prevent optical recognition.

This insecure CAPTCHA implementation could allow bots or automated scripts to bypass the CAPTCHA verification, leading to potential security issues such as automated spamming or brute force attacks.

Steps​

  • Replace the current CAPTCHA implementation with a more secure and robust one.
  • Choose a CAPTCHA implementation that is resistant to optical recognition tools.
  • Ensure that the CAPTCHA implementation includes features such as distortion, noise, and randomization to make it harder for automated tools to bypass.
  • Consider using a combination of different CAPTCHA types, such as image-based and text-based, to increase the complexity for automated tools.
  • Regularly update the CAPTCHA implementation to stay ahead of new techniques used by automated tools.
  • Test the CAPTCHA implementation thoroughly to ensure its effectiveness in preventing automated attacks.
  • Monitor the CAPTCHA usage and analyze any suspicious patterns or activities.
  • Implement rate limiting or other mechanisms to prevent brute-force attacks on the CAPTCHA.
  • Educate users about the importance of CAPTCHA and the risks of automated attacks.
  • Consider implementing additional security measures, such as IP blocking or user behavior analysis, to further enhance the protection against automated attacks.

Compliant code​

package main

import (
    "github.com/gin-gonic/gin"
    "github.com/mojocn/base64Captcha"
    "github.com/dchest/captcha"
)

var store = base64Captcha.DefaultMemStore

func main() {
    router := gin.Default()
    router.GET("/captcha", generateCaptcha)
    router.Run(":8080")
}

func generateCaptcha(c *gin.Context) {
    captchaId := captcha.New()
    captcha.Reload(captchaId)
    c.JSON(200, gin.H{"captchaId": captchaId})
}

The original code was using a weak CAPTCHA implementation that could be bypassed using optical recognition tools. The new code replaces the old CAPTCHA implementation with a more secure one that is resistant to such tools.

The new CAPTCHA implementation uses the dchest/captcha package, which provides a more robust and secure CAPTCHA generation. This package generates CAPTCHAs that include features such as distortion, noise, and randomization, making it harder for automated tools to bypass.

The captcha.New() function generates a new CAPTCHA id, and captcha.Reload(captchaId) generates a new CAPTCHA image for that id. The id is then sent to the client, which must retrieve the CAPTCHA image separately and present it to the user.

This new implementation increases the complexity for automated tools trying to bypass the CAPTCHA. It also allows for additional security measures such as rate limiting or IP blocking to prevent brute-force attacks on the CAPTCHA.

It's important to regularly update the CAPTCHA implementation to stay ahead of new techniques used by automated tools, and to monitor CAPTCHA usage for any suspicious patterns or activities. Users should also be educated about the importance of CAPTCHA and the risks of automated attacks.

References​

Last updated on