Reverse-engineering the new “captchaless” ReCaptcha system

https://github.com/ReCaptchaReverser/InsideReCaptcha

by InsideReCaptcha • 12 years ago

216 50 12 years ago

github.com

majke• 12 years ago

Oh, it's the botguard we know from the gmail thread:

https://news.ycombinator.com/item?id=8275970#up_8277858

Great analysis!

warcode• 12 years ago

Does the obfuscation serve any real purpose in improving the security?

mox1• 12 years ago

It's similar to when malware authors pack and encode their stuff.

At the end of the day, it does not stop a determined individual from reverse engineering the code (and then publishing the technique).

BUT it does make it more difficult to understand, work with, etc. It simply reduces the number of individuals who have the skills necessary to follow everything though.

It will deter the less skilled people from attempting to "hack" the system....

zamalek2• 12 years ago

It will deter the less skilled people from attempting to "hack" the system....

... especially if slight changes are made. Google could change the smallest thing and run the lot back through their mangler and the attacker would have to go through the process of unobfuscating it all over again.

guan• 12 years ago

Is there a place where I can try the new ReCaptcha? The linked Google post only has screenshots.

InsideReCaptcha2• 12 years ago

It was activated a few hours ago everywhere on 4chan.

The Google post also gives the examples of Snapchat (https://support.snapchat.com/login2?next=/), WordPress (https://wordpress.org/support/register.php) and Humble Bundle (https://www.humblebundle.com/).

voctor• 12 years ago

https://www.google.com/recaptcha/api2/demo

spacefight2• 12 years ago

So in other words, it's a tracking script also serving as a captcha.

"Google servers will receive and process, at least, the following information:

    Plug-ins
    User-agent
    Screen resolution
    Execution time, timezone
    Number of click/keyboard/touch actions in the <iframe> of the captcha
    It tests the behavior of many browser-specific functions and CSS rules
    It checks the rendering of canvas elements
    Likely cookies server-side (it's executed on the www.google.com domain)
    And likely other stuff...

At least the old captcha was a more simpler image.

crxgames• 12 years ago

Some of this data is readily available in the user-agent string. The other does require some JS execution and sending the results back though. Check this out: https://valve.github.io/fingerprintjs/

TheLoneWolfling3• 12 years ago

My browser fingerprint is... Nonexistant, because I don't allow arbitrary JS execution without consent.

And my UA string is randomized (unless I override it for a particular site), so that doesn't do anything either.

I wish someone could come up with a plugin that allowed a "safe" subset of JS to run without consent, though.

homakov4• 12 years ago

At the end of the day only google.com cookies make sense, everything else can be routinely faked just like author says "Programmatically bypass the captcha by simply executing a rendering engine and automating movements of the mouse." What google was trying to hide? They seem to put a lot of effort in it.

spacefight2• 12 years ago

They are browser/canvas fingerprinting you and me at a very large scale.

homakov4• 12 years ago

But what it has to do with fighting bots? Bots can look like browsers.

chatmasta3• 12 years ago

When I was a fifteen year old "internet marketer" I was able to create 60,000 google accounts from residential IP's, despite google's CAPTCHA system. As a fifteen year old kid, that's when I knew google is not an invincible company.

The trick was that google's backend registration logic did not validate the referrer of the signup form, or that the submitting IP address matched the one that downloaded the CAPTCHA. So I cloned the form on my own server, loaded it in an invisible iFrame with all fields filled except the CAPTCHA. Then I served the CAPTCHA to the user, who solved it and clicked "submit". Then the entire hidden form in the iframe submitted and registered a google account with the visitor's IP.

I was surprised that worked, because it was a huge vulnerability. Nowadays I would go for the bug bounty, but back then I tried to sell it for $5k -- unfortunately nobody believed I could do it and I couldn't prove it without revealing the method, so I ended up unable to take advantage of the code.

I did have about 60k accounts from random page views on blogspot blogs, but I never did anything with them. Perhaps that was the only time my inability to finish projects ironically saved me from some trouble. :)

timboslice• 12 years ago

I remember seeing you post something about this back in the day (maybe on WF?)

good times :-P

neo_optimus• 12 years ago

What is (was?) WF?

chii• 12 years ago

heh, you could've made some distributed service using google appengine, and take full advantage of the free tier ;)

chatmasta3• 12 years ago

hmmmmm a litecoin miner perhaps?

cinquemb• 12 years ago

You probably wouldn't have got in much trouble, just a c&d and probably asked to fork over some money from your profits and sign a contract with google that youll never do it again (And "your" account on google disabled"). ;)

At least thats what happend with me and my friend when we mined about 1/10th of users from facebook, and crowdsourced a bunch of info from people, made it public, (we had an psudeoanonmyous no login messaging feature where people would literally share informaion that would make people question what privacy is when n-1 people are divulging everything about you) from searching names. If I wasn't a US citizen, id probably do it better now that i know more of what im up against. Maybe the landscape might be more open in the US in the future.

People moan on and on about facebook and companies like them as if they are all powerfull (they can seem that way if you play by their rules and submit to their jurisdiction for pragmatic reasons), but challenging those assumptions and leveraging user behaviors, and arbitraging legalities, one can probably crack some pretty big holes...

kyrre• 12 years ago

Saw this on /g/. Great work op.

bobcostas55• 12 years ago

The new system is incredibly cumbersome when you have to type the captcha. It went from 2 key presses to 5 (plus actually typing the text of course). Obviously if you just need to tick it everything is fine, but for me the tick works ~5% of the time.

the84722• 12 years ago

There is a <noscript> version of recaptcha which more or less displays the old version: https://developers.google.com/recaptcha/docs/faq#no_js

One could probably write a greasemonkey script that replaces the new captcha with the noscript version.

InsideReCaptcha2• 12 years ago

I received an email from Google requesting the following:

The code you reversed is used to protect many sites’ registration process including Google and many others. We are concerned that having your code and analysis publicly available will make it easier to build registration automation tools which will result in a surge of spam in all the services protected by this code and will affect negatively many Internet users.
This is why we kindly ask you to temporarily remove it from GitHub so your work won’t be used for a malicious purpose which we believe was never your intended goal.

As I wasn't aware that the botguard was also used for this purpose (separately of ReCaptcha, in Gmail and other services) before publishing my code, I removed the GitHub repository for now. I'm sorry for honest security enthusiasts who didn't read the article, but I don't want to cause harm.

Google also proposed me to come visit them in their offices to discuss about my work.

Aissen• 12 years ago

Ouch ! I was curious about looking at the implementation, now I'm even more curious. Anybody has a mirror ?

Edit: got one, just using Github's research.

Edit2: had to patch the decompiler to have it run on python 2.7.8, so that it understands that long is an int.

barbolo• 12 years ago

I had forked you, but after reading this I decided to remove the git repository too.

I think reCaptcha is overused by services that should be publicly available for automation, specially in Brazil. I think this is a bad use case for reCaptcha or any other captcha system.

But I also understand that the majority of reCaptcha users are fighting against spam, and the public description of their javascript engine could really hurt the Internet.

Anyway... congrats for your work!

userbinator• 12 years ago

That's a bit strange, usually Google will just make changes that invalidate your analyses (and they can definitely make changes rather quickly.) In other words, by reacting in this way they're basically saying "we rely on security through obscurity". I was almost expecting a "you remove it, or we'll remove your site from our search results." The fact that it's a tracking script might have something to do with it...

the84722• 12 years ago

Considering that this was done using information also available to malicious parties, is now "out there" even if you take it down yourself and is just a security by obscurity scheme it does leave an bad aftertaste in my mouth.

Google is essentially trying to run code on a user's computer but doesn't want anyone to know what it's running there while it doesn't stop the "bad guys" from doing their own analysis without publishing it. I'm not saying that they're trying to do anything evil, but it just strikes all the wrong notes for me when they try to suppress information on a system they should have known is wide-open to analysis.

Bjoern• 12 years ago

You should maybe tell them to remove their own "google cache" version as well...

chatmasta3• 12 years ago

Great example of "talk softly, carry a big stick." Thanks Teddy Roosevelt.

opless• 12 years ago

Aaaand it's down.

chetangole• 12 years ago

The code is still available at many places on GitHub, many people cloned it to their repos.

taha_jahangir• 12 years ago

From original readme:

It turned out this new ReCaptcha system is heavily obfuscated, as Google implemented a whole VM in JavaScript with a specific bytecode language.

Reverse-engineering the new “captchaless” ReCaptcha system

Related Stories