Use CAPTCHA to protect sites from abuse - PHP Approach

First thing first, lets take a look at CAPTCHA's physical appearance (a screenshot from my application) :


Ah... CAPTCHA is a program to tell whether the user is a human or a computer.

Secondly, CAPTCHA is very very secure as it uses two layers of protection when generating the image. It starts with images that can't be read by computers, and then distorts them even more as shown in the screenshot above. The OCR software read the image (screenshot above) as "ibataz Iueqm". :-)

-------------------------------------------------------------------------------------------------------
Now, Lets implement it by using PHP:

Step One: Display the image

require_once('recaptchalib.php');
$publickey = "xxxxxxxxxxxxxxxxxxxxxxxx";
$capImg = recaptcha_get_html($publickey);
echo $capImg; //Display the image

Step Two: Check if the user input is correct
The reason to use $_SESSION['Code'] is to stop checking it again if the last attempt was correct. For example, you need a user to specify a valid email address AND to get this image correct. But, he forgot to put his email ... So, he only need to tell you what his email address is on the next screen.

require_once('recaptchalib.php');
if ($_SESSION['Code'] != "yes") // user's last input was correct
{
$privatekey = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
$resp = recaptcha_check_answer ($privatekey,
$_SERVER["REMOTE_ADDR"],
$_POST["recaptcha_challenge_field"],
$_POST["recaptcha_response_field"]);

if (!$resp->is_valid)
{
$_SESSION['Code'] = "no";
} else {
$_SESSION['Code'] = "yes";
}
}

Step Three: Display another image if the user's input was incorrect

if ($_SESSION['spamCode'] != "yes")
{
$Info = "Oops! You got it wrong, please try again ...";
$publickey = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
$capImg = recaptcha_get_html($publickey);
echo $capImg;
session_unregister('Code');
} else {
$Info = "Correct!";
}
echo $Info;

PHP Basics (Section 3) - Security

Defense in Depth

1. When you plan with defense in depth, you plan for failure. Rather than internal functions assuming the data they receive is already validated or escaped, they will check and confirm.
2. Application that demonstrate defense in depth are not noly more resistant to attack when they are developed, they also remain more resistant over time as new attacks are developed, and as more code is added to them.

Least Privilege

1. Your PHP applications by default has a lot of power, they execute as the web user (often apache or www-data) with all the rights and privileges thereof.
2. If an attacker gains control of PHP through an application vulnerability this can be used and abused.

Validation vs Escaping

1. These terms are often confused, or used interchangeably.
2. Validation or Filtering is the process by which you subject data to a series of rules, either it passes (validates) or does not.
3. Escaping is the process by which you prepare data for a specific resource by "escaping" certain portions of the data to avoid confusion of instruction and data.

Validate Input

1. Whenever you receive data one of three things can be said about it: 1) It is valid, the user entered the data you want, in the format you desire; 2) It is invalid because the user either did not comply or did not understand the rules on the data you requested (eg. Poorly formatted postcode); 3) It is invalid because the user is attempting to compromise your application.
2. Data from the end user can not be trusted, it must be validated before it can be used.
3. Validate data first don't save it for last.
4. Fail early, tell the user what went wrong.

Whitelist vs Blacklist

1. There are two major approaches to data validation, the whitelist and blacklist approach.
2. Under the whitelist approach you select a series of valid characteristics (frequently characters) only data that follows these rules is accepted as valid.
3. Under the blacklist approach you select a series of invalid characteristics, any data that contains these characteristics is considered invalid.

XSS

1. Under a cross site scripting attack an attacker injects code into your page (forum post, shout box, etc) that contains code that re-writes the page to do something nefarious.
2. This can be prevented through proper escaping and data validation techniques

CSRF

1. Under a cross site request forgery attack a site exploits another sites persistent user trust relationship to make something happen.
2. iFrames are another common tool leveraged in this technique.

Sessions

1. Sessions provide safer state, it may not nesesarily be safe.
2. Basically, sessions combine cookies containing a session ID with a local(ish) data store corresponding to that session id.
3. If the session id is compromised, or the data store is not secure (/tmp on a shared machine) sessions are still vulnerable to attack.
4. Session IDs are very random.
5. Predicting them is hard, it’s much easier to: 1) Check out /tmp on a shared server, see what people have; 2)Intercept communications; 3)Implement session fixation.
6. To defend, implement some browser fingerprinting.

For more information, please read my another post PHP Application Security Rules

PHP Application Security Rules

Some basic but very important rules for PHP Apps:

1. Set register_globals off (default value is off);
2. Initialize all variables;
3. Set the error_reporting (E_ALL) off;
4. Grant permissions to users only to the level needed
5. Only pass an identifier in a cookie, not actual data
6. Set display_errors off, log_errors on
7. Use PHP data validation rather than javascript validation which can be disabled
   
8. Purge phpinfo.php
9. If you use phpmyadmin, please do change its initial password
10. MySQL : only select the fields you need rather than 'select *'
11. The Tidy extension can also be used for a whilelist approach to HTML
    
12. Escape the data before outputting it. i.e. htmlspecialchars(); htmlentities(); strip_tags()
13. Don't forget to use is_uploaded_file($_FILES['upload_file']['tmp_name']) to prevent 'uploading' fake files

Properly validate user input (may not be enough; always remember to escape user-supplied content given in HTML, unless sure it was filtered)

Newest login methods also provide user-chosen image to help prevent against tricking them with 'pseudo' sites