7 ms·
Reverse-engineering the new “captchaless” ReCaptcha system
- majke 12y agoOh, it's the botguard we know from the gmail thread: https://news.ycombinator.com/item?id=8275970#up_8277858 https://news.ycombinator.com/item?id=8275970#up_8277858 Great analysis!
- warcode 12y agoDoes the obfuscation serve any real purpose in improving the security?
- mox1 12y agoIt's similar to when malware authors pack and encode their stuff. At the end of the day, it does not stop a determined individual from reverse engineering the code (and then publishing the technique). BUT it does make it more difficult to understand, work with, etc. It simply reduces the number of individuals who have the skills necessary to follow everything though. It will deter the less skilled people from attempting to "hack" the system....
- zamalek 12y ago> It will deter the less skilled people from attempting to "hack" the system.... ... especially if slight changes are made. Google could change the smallest thing and run the lot back through their mangler and the attacker would have to go through the process of unobfuscating it all over again.
- coldcode 12y agoCreating an ever increasing war of mangler vs demangler.
- yincrash 12y agoWhich is exactly the case with regular captchas except now this is less annoying for real human users.
- instakill 12y agoYour username is the slang name for Carling Black Label beer in South Africa :)
- zamalek 12y agoExactly, it's good beer :)
- guan 12y agoIs there a place where I can try the new ReCaptcha? The linked Google post only has screenshots.
- InsideReCaptcha 12y agoIt was activated a few hours ago everywhere on 4chan. The Google post also gives the examples of Snapchat (https://support.snapchat.com/login2?next=/ https://support.snapchat.com/login2?next=/), WordPress (https://wordpress.org/support/register.php https://wordpress.org/support/register.php) and Humble Bundle (https://www.humblebundle.com/ https://www.humblebundle.com/).
- deleted 12y ago[deleted]
- voctor 12y agohttps://www.google.com/recaptcha/api2/demo https://www.google.com/recaptcha/api2/demo
- spacefight 12y agoSo in other words, it's a tracking script also serving as a captcha. "Google servers will receive and process, at least, the following information: Plug-ins User-agent Screen resolution Execution time, timezone Number of click/keyboard/touch actions in the <iframe> of the captcha It tests the behavior of many browser-specific functions and CSS rules It checks the rendering of canvas elements Likely cookies server-side (it's executed on the www.google.com domain) And likely other stuff... " At least the old captcha was a more simpler image.
- crxgames 12y agoSome of this data is readily available in the user-agent string. The other does require some JS execution and sending the results back though. Check this out: https://valve.github.io/fingerprintjs/ https://valve.github.io/fingerprintjs/
- TheLoneWolfling 12y agoMy browser fingerprint is... Nonexistant, because I don't allow arbitrary JS execution without consent. And my UA string is randomized (unless I override it for a particular site), so that doesn't do anything either. I wish someone could come up with a plugin that allowed a "safe" subset of JS to run without consent, though.
- notatoad 12y agocongratulations, you're this guy: http://www.xkcd.com/1105/ http://www.xkcd.com/1105/ until there's a significant number of people doing the same thing, you're simply "that guy in <insert geoip lookup city here> with the randomized UA", and you're infinitely more fingerprintable than just about anybody else on the internet. got to EFF's panopticlick to see how unique your fingerprint is. using an iPad with up-to-date software gets me the same fingerprint as about 18000 other people in my geoip region, i haven't been able to do better than that yet.
- 12y ago
- homakov 12y agoAt the end of the day only google.com cookies make sense, everything else can be routinely faked just like author says "Programmatically bypass the captcha by simply executing a rendering engine and automating movements of the mouse." What google was trying to hide? They seem to put a lot of effort in it.
- spacefight 12y agoThey are browser/canvas fingerprinting you and me at a very large scale.
- homakov 12y agoBut what it has to do with fighting bots? Bots can look like browsers.
- lojack 12y agoIt's enough information to come up with a unique fingerprint without using cookies. With that fingerprint they can track your habits across multiple domains. Bots can look like browsers, but they can't necessarily browse the internet the same way a human can.
- ipedrazas 12y agoI'm surprised nobody else has seen this. Google is removing the cookies because that's how advertisers track users. No cookies? no way of tracking. Or if you want to see it like this, they are getting something standard and turning it into something that it's under their control.
- homakov 12y agoWhat habits? There's nothing else google can see, they only track movements inside of recaptcha iframe. They have 0 information about how you browse web.
- 12y ago
- chatmasta 12y agoWhen I was a fifteen year old "internet marketer" I was able to create 60,000 google accounts from residential IP's, despite google's CAPTCHA system. As a fifteen year old kid, that's when I knew google is not an invincible company. The trick was that google's backend registration logic did not validate the referrer of the signup form, or that the submitting IP address matched the one that downloaded the CAPTCHA. So I cloned the form on my own server, loaded it in an invisible iFrame with all fields filled except the CAPTCHA. Then I served the CAPTCHA to the user, who solved it and clicked "submit". Then the entire hidden form in the iframe submitted and registered a google account with the visitor's IP. I was surprised that worked, because it was a huge vulnerability. Nowadays I would go for the bug bounty, but back then I tried to sell it for $5k -- unfortunately nobody believed I could do it and I couldn't prove it without revealing the method, so I ended up unable to take advantage of the code. I did have about 60k accounts from random page views on blogspot blogs, but I never did anything with them. Perhaps that was the only time my inability to finish projects ironically saved me from some trouble. :)
- timboslice 12y agoI remember seeing you post something about this back in the day (maybe on WF?) good times :-P
- neo_optimus 12y agoWhat is (was?) WF?
- us0r 12y agoWickedFire
- chii 12y agoheh, you could've made some distributed service using google appengine, and take full advantage of the free tier ;)
- 12y ago
- kyrre 12y agoSaw this on /g/. Great work op.
- bobcostas55 12y agoThe new system is incredibly cumbersome when you have to type the captcha. It went from 2 key presses to 5 (plus actually typing the text of course). Obviously if you just need to tick it everything is fine, but for me the tick works ~5% of the time.
- the8472 12y agoThere is a <noscript> version of recaptcha which more or less displays the old version: https://developers.google.com/recaptcha/docs/faq#no_js https://developers.google.com/recaptcha/docs/faq#no_js One could probably write a greasemonkey script that replaces the new captcha with the noscript version.
- InsideReCaptcha 12y agoI received an email from Google requesting the following: > The code you reversed is used to protect many sites’ registration process including Google and many others. We are concerned that having your code and analysis publicly available will make it easier to build registration automation tools which will result in a surge of spam in all the services protected by this code and will affect negatively many Internet users. > This is why we kindly ask you to temporarily remove it from GitHub so your work won’t be used for a malicious purpose which we believe was never your intended goal. As I wasn't aware that the botguard was also used for this purpose (separately of ReCaptcha, in Gmail and other services) before publishing my code, I removed the GitHub repository for now. I'm sorry for honest security enthusiasts who didn't read the article, but I don't want to cause harm. Google also proposed me to come visit them in their offices to discuss about my work.
- Aissen 12y agoOuch ! I was curious about looking at the implementation, now I'm even more curious. Anybody has a mirror ? Edit: got one, just using Github's research. Edit2: had to patch the decompiler to have it run on python 2.7.8, so that it understands that long is an int.
- barbolo 12y agoI had forked you, but after reading this I decided to remove the git repository too. I think reCaptcha is overused by services that should be publicly available for automation, specially in Brazil. I think this is a bad use case for reCaptcha or any other captcha system. But I also understand that the majority of reCaptcha users are fighting against spam, and the public description of their javascript engine could really hurt the Internet. Anyway... congrats for your work!
- userbinator 12y agoThat's a bit strange, usually Google will just make changes that invalidate your analyses (and they can definitely make changes rather quickly.) In other words, by reacting in this way they're basically saying "we rely on security through obscurity". I was almost expecting a "you remove it, or we'll remove your site from our search results." The fact that it's a tracking script might have something to do with it...
- opless 12y agoAaaand it's down.
- chetangole 12y agoThe code is still available at many places on GitHub, many people cloned it to their repos.
- taha_jahangir 12y agoFrom original readme: > It turned out this new ReCaptcha system is heavily obfuscated, as Google implemented a whole VM in JavaScript with a specific bytecode language.