CAPTCHAs are something most of us have come across while browsing the internet. Sometimes we're asked to identify traffic lights in pictures, solve a small puzzle, or simply tick a box to confirm we're human. Websites use these challenges to help distinguish real users from automated bots.
But there's an interesting problem with this approach. What happens when a bot doesn't need to solve the CAPTCHA itself because a real person can solve it for them?
This is how CAPTCHA farms work. Attackers use services where real people solve CAPTCHA challenges on behalf of automated programs. The person completing the challenge is human, but the activity happening behind it may still be controlled by a bot. This makes it harder for websites to identify suspicious requests, even when their CAPTCHA system appears to be working correctly.
Here, we'll look at how CAPTCHA farm attacks work, why attackers use human solvers, and what makes these attacks difficult to detect. We'll also go through some of the security measures developers can use to identify suspicious activity and better protect their websites.
Source: freeCodeCamp News — Read the full article on the original site ↗