Detecting Fraudulent CAPTCHA Solvers
summary
Claims that CAPTCHA farms are detectable by measuring site key and token propagation times between client CAPTCHA provider and server and comparing those delays to expected network latencies given geolocation via IP and known provider/server locations. Implementation details: synchronized timestamps, picking the shorter of two propagation measurements, statistical ranges to handle congestion, VPN whitelisting and auxiliary signals to reduce false positives, a volunteer-sourced baseline of real-user timings, ongoing tests and early results but not yet production-ready.
AI-written summary · about
chapters (7)
- 0:00Fraudulent CAPTCHA solvers
- 1:10Sophisticated bot threats
- 8:36CAPTCHA solver bypasses
- 10:41Network detection of CAPTCHA farms
- 23:09Testing and volunteer recruitment
- 24:55Mitigating solver risks with timing
- 31:21Q&A
related talks
33mThe Phantoms of the Fraudpera: An Overview of Anti-Detection Tooling
01mCAPTCHA defeat
29mYou Can’t Hide: How a Device Can Give Away a Fraudster’s Secrets.
58mCatching Transparent Phish: Understanding and Detecting MITM Phishing Kits
11mLet The Right One In: Attestation as a Usable CAPTCHA Alternative
37mFraud prevention in the age of online privacy
54mDetecting and managing bot activity more efficiently
34mFakeCaptcha Is So Yesterday