Clickjacking
Clickjacking (User
Interface redress attack, UI redress attack, UI
redressing) is a malicious technique of
tricking a Web user into clicking on something different
from what the user perceives they are clicking on, thus potentially revealing confidential information or taking
control of their computer while clicking on seemingly innocuous web pages. It is a browser security issue that is a vulnerability across
a variety of browsers and platforms.
A clickjack takes the form of embedded code or a script that can execute without
the user's knowledge, such as clicking on a button that
appears to perform another function.[5] The term
"clickjacking" was coined by Jeremiah Grossman and Robert Hansen in
2008.[citation needed] Clickjacking
can be understood as an instance of the confused deputy
problem.[6]
Contents
|
[edit]Description
Clickjacking is possible because seemingly harmless features of
HTML web pages can be employed to perform unexpected actions.
A clickjacked page tricks a user into performing undesired actions
by clicking on a concealed link. On a clickjacked page, the attackers load
another page over it in a transparent layer. The users think that they are
clicking visible buttons, while they are actually performing actions on the
hidden page. The hidden page may be an authentic page; therefore, the attackers
can trick users into performing actions which the users never intended. There
is no way of tracing such actions to the attackers later, as the users would
have been genuinely authenticated on the hidden page.
[edit]Examples
A user might receive an email with a link to a video about a news
item, but another valid page, say a product page on amazon.com, can be
"hidden" on top or underneath the "PLAY" button of the news
video. The user tries to "play" the video but actually
"buys" the product from Amazon.
Other known exploits include:
·
tricking users into
enabling their webcam and microphone through Flash (which has since been corrected by Adobe);
·
tricking users into
making their social networking profile information public;
·
making users follow
someone on Twitter;[7]
[edit]Likejacking
Likejacking is a malicious
technique of tricking users of a website into posting a Facebook status update for a site they
did not intentionally mean to "like".[10] The term "likejacking"
came from a comment posted by Corey Ballou[11] in the article How to
"Like" Anything on the Web (Safely), which is one of the first
documented postings explaining the possibility of malicious activity regarding
Facebook's "like" button.[12]
According to an article in IEEE Spectrum, a solution to likejacking was
developed at one of Facebook's hackathons.[13] A "Like" bookmarklet is available that avoids the
possibility of likejacking present in the Facebook Like Button.[14]
[edit]Cursorjacking
Cursorjacking is a UI redressing technique to change the cursor
from the location the user perceives, discovered in 2010 by Eddy Bordi,
researcher at Vulnerability.fr,[citation needed] Marcus
Niemietz demonstrated this with a custom cursor icon, and in 2012 Mario
Heiderich by hiding the cursor. [15][16]
[edit]Prevention
[edit]Client-side
[edit]NoScript
Protection against clickjacking (including likejacking) can be
added to Mozilla Firefox desktop
and mobile[17] versions by installing the NoScript add-on: its ClearClick feature,
released on 8 October 2008, prevents users from clicking on invisible or
"redressed" page elements of embedded documents or applets.[18] According to Google's "Browser
Security Handbook", NoScript's ClearClick is "the only
freely available product that offers a reasonable degree of protection"
against Clickjacking.[19] Protection from the newer
cursorjacking attack was added to NoScript 2.2.8 RC1.[15]
[edit]GuardedID
GuardedID (a commercial product) includes client-side clickjack
protection for users of Internet Explorer and Firefox[20] without interfering with the
operation of legitimate iFrames. GuardedID clickjack protection forces all
frames to become visible.
[edit]Gazelle
Gazelle is
a Microsoft Research project
secure web browser based on IE, that uses an OS-like security model, and has its own
limited defenses against clickjacking.[21] In Gazelle, a window of
different origin may only draw dynamic content over another window's screen
space if the content it draws is opaque.
[edit]Server-side
[edit]Framekiller
Web site owners can protect their users against UI redressing
(frame based clickjacking) on the server side by including a framekiller JavaScript snippet in those
pages they do not want to be included inside frames from different sources.[19]
Such JavaScript-based protection, unfortunately, is not always
reliable. This is especially true on Internet Explorer,[19] where this kind of
countermeasure can be circumvented "by design" by including the
targeted page inside an <IFRAME SECURITY=restricted> element.[22]
[edit]Server and client
[edit]X-Frame-Options
On 26 January 2009 Microsoft released RC1 of Internet Explorer 8, which includes a new
partial clickjacking prevention option. Web site developers will be able to add
a page header to help detect and prevent frame-based UI redressing. IE 8,
according to Microsoft, “will detect
sites that insert the tag and give users a new error screen indicating that the
content host has chosen not to allow their content to be framed, while giving
users the option to open the content in a new window.” [23]
Microsoft's suggested solution,[24][25] which has since also been
implemented in the Safari,[26] Firefox,[27] Chrome,[28] and Opera[29] Web browsers, is to check for
a new HTTP header, X-Frame-Options. This header can take the values DENY, SAMEORIGIN, or ALLOW-FROM origin, which will prevent any framing, prevent framing by external
sites, or allow framing only by the specified site, respectively.
Comments
Post a Comment