The online security landscape is always evolving, and businesses must actively grapple with challenges that rear their ugly heads. One such challenge is the emergence of AI, which has proven to be a real double-edged sword. Although AI can actually boost online security in many ways, it has also ushered in an insidious influx of increasingly sophisticated spambots.
Our recent experiences with Growth Lending, one of our long-standing partners, have really served to highlight an alarming trend where bots are successfully spoofing forms with reCAPTCHA.
AI bots are undermining the entire purpose of this widely-used security measure.
As the threat landscape continues to shift, it’s therefore crucial to not only assess the effectiveness of existing safeguards, but also explore proactive measures to stay ahead of the game. In the latest of our ongoing series of AI-focused blogs, we dive into the essentials…
TL;DR: AI-driven spam bots are at the point where they can bypass CAPTCHAs much more reliably. We’re making use of effective solutions like reCAPTCHA upgrades, invisible reCAPTCHAs, honeypots, bot traps, and sophisticated anti-spam plugins to combat this development.
The Rise of AI Bots
In a sense, we should perhaps be talking about the “return” of bots, not the “rise”, although the inclusion of AI is definitely a new picture rather than a sequel!
When the internet was first catching on, bots were prolific, and so a solution was introduced: the CAPTCHA.
CAPTCHA is a blessedly short acronym for the jaw-crunching “Completely Automated Public Turing Test to Tell Computers and Humans Apart“.
In these early days, people found CAPTCHAs pretty hard to decipher, and they sometimes ended up reducing more human interaction than bot interaction on websites! In 2009, reCAPTCHA was introduced and has drastically boosted the usability of this system. It’s long been a stalwart defence against automated bots.
However, the rise of artificial intelligence has ushered in a new era. Bots are becoming more intelligent, and are now much better at bypassing traditional security measures.
Why It Matters to Businesses
Believe us when we say that understanding the recent challenges to the CAPTCHA system is vital for successful businesses.
Why do we say that?
Well, the infiltration of AI-driven bots poses a major risk. In fact, spambots, in a more general sense, pose a number of challenges:
- They can spread viruses. Spambots can include spyware, keyloggers, Trojans or ransomware. Not things you want to let in the back door!
- They can flood your website with traffic. As well as ruining your analytics data, heavy spam traffic (i.e DDoS attacks) can take your site offline.
- They can hijack your domain. This can result in spam emails being sent to your user base, and the resulting damage to your brand is enormous.
- They can infect you with “negative SEO”. Link insertions, UGC spam, page redirects and more can soon torpedo your SEO efforts.
Clearly, spambots are bad, but in the context of AI spambots we’re mostly concerned with their potential to generate an influx of bad or irrelevant leads.
The rise of AI bots will waste your time and waste your money.
Nowhere is this more evident than within Pay-Per-Click (PPC). In PPC, Cost Per Acquisition (CPA) is a key metric, and businesses that end up paying for dead leads are going to suffer. The fundamental issue here is that spam leads count as conversions in the account. If you’re running a Max Conversions-style bid strategy, then Google will take that data and think “this is a conversion, and must be good traffic!” and then optimise towards acquiring more users that fit this pattern.
A vicious cycle is thereby created where Google is actively incentivised to go after more spam leads!
Essentially, Google doesn’t know what’s good and what’s bad, and there’s no handy system to “disavow” conversions (like SEOs sometimes do for especially toxic backlinks). The result of this is your CPA will be artificially low. Ensuring purity of data going into the account is vital; only qualified leads have the potential to ultimately return some ROI. CAPTCHA has long been an important way of trying to mitigate this danger by stopping spam leads from showing up in the first place, but more sophisticated AI bots are reducing its effectiveness.
In a world where every lead counts, the implications of compromised security measures are far reaching indeed.
The evolving landscape of AI-driven spam bots also demands a strategic response. The intricacies of these attacks can mimic human behaviour and fool traditional security checks. As a result, businesses need to exercise constant vigilance. Outdated security measures are pitfalls that must be avoided, and your online presence can only be safeguarded by investing in adaptive solutions.
What We Are Doing to Stay Ahead
In response to these emerging threats, businesses must adapt and fortify their defences. That’s exactly what we’re working to do with our own partners.
Take Growth Lending, our partner that we mentioned in our opening paragraph. They were experiencing an escalating series of spam attacks on their main contact us form. In response to this problem, our development team dedicated hours of internal industry research time to find a solution. We scoured Google. We even asked ChatGPT for a few suggestions, proving that not all AI is bad news! After we were finally satisfied that we’d settled upon a great fix, we installed the highly-recommended Akismet Anti-spam: Spam Protection plugin.
During our research into how the form was able to be subjected to such a sustained spam attack, we found that the spam entries were bypassing the reCAPTCHA security score. reCAPTCHA returns a score ranging from 0.0 to 1.0, with 1.0 indicating that a form entry is most likely coming from a human, and 0.0 representing a form entry that’s highly likely to be coming from a bot. The reCAPTCHA executes in the background and analyses the interaction with the form. It then assigns a score that indicates how likely the user is to be a human or a bot. The problem for Growth Lending was that spam enquiries – most of which contained malicious links – were tricking the system into being awarded a 0.9!
A key point to note is that AI is now basically at the point of being able to solve reCAPTCHA puzzles better than humans. AI bots can therefore easily spoof reCAPTCHA scoring to get through and submit entries. Installing Akismet made all the difference. The plugin was installed and activated on January 30th, 2024, and the last bot spam entry with malicious content was registered on February 8th, 2024.
From being a real problem, we’ve seen a significant decrease in spam entries to almost zero. The few entries that do get through appear to be related to human spam, and not from AI bots sharing links.
As a result of our experience with Growth Lending, we’re now looking to make all of our sites as strongly anti-spam as possible. We’re now monitoring the entries on all of our clients’ forms to see if Growth Lending was a one-off situation, or if AI spam has now become such an issue that an anti-spam solution (like Akismet) needs to replace reCAPTCHA scoring from this point onwards.
How You Can Protect Your Business
If we were to try to boil down our approach to something akin to a handy checklist, then we’d probably recommend that you follow something like the below:
- Upgrade to the Latest reCAPTCHA Version – Use the latest version of reCAPTCHA. Developers frequently release updates that are specifically designed to address new security challenges. Simply upgrading reCAPTCHA can therefore boost your defences against AI bots and algorithms.
- Implement Invisible reCAPTCHA – Invisible reCAPTCHA offers a seamless user experience via minimal interaction. Gone are the days when you needed to agonise over whether square 5 in a grid of 9 contained part of the image of a traffic light, only to finally make your decision and be required to select every square that contains a bridge. This is an additional layer of protection that can thwart bots at the same time as minimising user friction. We love multi-purpose solutions, so this is a favourite of ours.
- Utilise Honeypots – Honeypots are hidden decoy fields that are only visible to bots. Legitimate users won’t ever interact with these fields, but bots will. If a honeypot field is filled out, it instantly indicates bot activity, allowing you to deal with it accordingly. Clever!
- Deploy Behaviour Analysis – Behaviour analysis tools evaluate user interactions on your site. AI bots often have distinct patterns that are quite different to genuine user behaviour. By analysing these patterns, you can quickly detect and block malicious activity.
- Customise Bot Traps – Create bespoke bot traps that are tailored to the specific vulnerabilities and characteristics of your website. These traps set unique challenges for bots, and make it much harder for them to navigate and successfully submit forms.
- Consider Third-Party Security Services – Explore third-party security services that specialise in combating AI-driven threats. These services provide advanced monitoring, detection, and mitigation techniques that go beyond standard security measures, so they’re especially effective.
- Regularly Monitor Analytics and Logs – Regularly monitor your website analytics and server logs. Unusual spikes in traffic or suspicious patterns are both tell-tale signs of bot activity. Real-time monitoring lets you identify and quash threats as soon as possible.
- Employ Rate Limiting – Rate-limiting mechanisms control the number of requests that a user (or IP address) can make within a specified time frame. This can help to mitigate the impact of bot-driven attacks by limiting their ability to flood your site with requests.
- Educate Your Team – All the technology in the world is no use if you miss the fact that the goalposts have been moved! Make sure your team keeps up to date with the latest developments in AI-driven spam bot tactics. Regular training sessions are invaluable for staying ahead of the game and proactively adapting your security measures.
Ultimately, it’s about staying agile to the threat that’s posed by spambots.
Once upon a time, the humble CAPTCHA alone would serve you pretty well.
Nowadays, it needs a bit of a helping hand to stay relevant and stay effective.
Tomorrow, it might be rendered completely ineffective. We just don’t know.
The question of whether reCAPTCHA is still effective in the age of generative AI is one that demands attention. As businesses grapple with the repercussions of compromised security measures, staying ahead of the curve is not just a necessity, but a strategic imperative. And this is where we can help you.
We’ve got one of the most experienced web development teams in the business, and we’re leading the way as many of our partners seek to navigate each and every challenge that this new world of AI can throw at them.
Get in touch with us today to boost your spam protection, secure your PPC leads, and start uncovering how AI can help you, rather than hinder you.
Further Reading
