Clickjacking





Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages.[1][2][3][4] It is a browser security issue that is a vulnerability across a variety of browsers and platforms. A clickjack takes the form of embedded code or a script that can execute without the user's knowledge, such as clicking on a button that appears to perform another function.[5] The term "clickjacking" was coined by Jeremiah Grossman and Robert Hansen in 2008.[6][7] Clickjacking is an instance of the confused deputy problem, a term used to describe when a computer is innocently fooled into misusing its authority.[8]




"potential clickjacking" warning from the "NoScript" internet-browser addon




Contents






  • 1 Description


  • 2 Examples


    • 2.1 Likejacking


    • 2.2 Cursorjacking


    • 2.3 Password manager attack




  • 3 Prevention


    • 3.1 Client-side


      • 3.1.1 NoScript


      • 3.1.2 GuardedID


      • 3.1.3 Gazelle




    • 3.2 Server-side


      • 3.2.1 Framekiller


      • 3.2.2 X-Frame-Options


      • 3.2.3 Content Security Policy






  • 4 See also


  • 5 References





Description


Clickjacking is possible because seemingly harmless features of HTML web pages can be employed to perform unexpected actions.


A clickjacked page tricks a user into performing undesired actions by clicking on a concealed link. On a clickjacked page, the attackers load another page over it in a transparent layer. The unsuspecting users think that they are clicking visible buttons, while they are actually performing actions on the invisible page. The hidden page may be an authentic page; therefore, the attackers can trick users into performing actions which the users never intended. There is no way of tracing such actions to the attackers later, as the users would have been genuinely authenticated on the hidden page.



Examples


A user might receive an email with a link to a video about a news item, but another webpage, say a product page on Amazon, can be "hidden" on top or underneath the "PLAY" button of the news video. The user tries to "play" the video but actually "buys" the product from Amazon. The hacker can only send a single click, so they rely on the fact that the visitor is both logged into Amazon.com and has 1-click ordering enabled.



Other known exploits include




  • Tricking users into enabling their webcam and microphone through Flash (though this has been fixed since originally reported)[9]

  • Tricking users into making their social networking profile information public[citation needed]

  • Downloading and running a malware (malicious software) allowing to a remote attacker to take control of other people's computers[10][11][12]

  • Making users follow someone on Twitter[13]

  • Sharing or liking links on Facebook[14][15]

  • Getting likes on Facebook fan page[16] or +1 on Google+

  • Clicking Google AdSense ads to generate pay-per-click revenue[17]

  • Playing YouTube videos to gain views

  • Following someone on Facebook


While technical implementation of these attacks may be challenging due to cross-browser incompatibilities, a number of tools such as BeEF or Metasploit Project offer almost fully automated exploitation of clients on vulnerable websites. Clickjacking may be facilitated by - or may facilitate - other web attacks, such as XSS.[18][19]



Likejacking


Likejacking is a malicious technique of tricking users of a website into "liking" a Facebook page that they did not intentionally mean to "like".[20] The term "likejacking" came from a comment posted by Corey Ballou in the article How to "Like" Anything on the Web (Safely),[21] which is one of the first documented postings explaining the possibility of malicious activity regarding Facebook's "like" button.[22]


According to an article in IEEE Spectrum, a solution to likejacking was developed at one of Facebook's hackathons.[23] A "Like" bookmarklet is available that avoids the possibility of likejacking present in the Facebook like button.[24]



Cursorjacking


Cursorjacking is a UI redressing technique to change the cursor from the location the user perceives, discovered in 2010 by Eddy Bordi, a researcher at Vulnerability.fr,[25] Marcus Niemietz demonstrated this with a custom cursor icon, and in 2012 Mario Heiderich by hiding the cursor.[26][27]


Jordi Chancel, a researcher at Alternativ-Testing.fr, discovered a cursorjacking vulnerability using Flash, HTML and JavaScript code in Mozilla Firefox on Mac OS X systems (fixed in Firefox 30.0) which can lead to arbitrary code execution and webcam spying.[28]


A second CursorJacking vulnerability was again discovered by Jordi Chancel in Mozilla Firefox on Mac OS X systems (fixed in Firefox 37.0) using once again Flash, HTML and JavaScript code which can lead also to the spying of the webcam and the execution of a malicious addon allowing the execution of a malware on the computer of the trapped user.[29]



Password manager attack


A 2014 paper from researcher at the Carnegie Mellon University found that while browsers refuse to autofill if the protocol on the current login page is different from the protocol at the time the password was saved, some password managers would insecurely fill in passwords for the http version of https-saved passwords. Most managers did not protect against iFrame- and redirection-based attacks and exposed additional passwords where password synchronization had been used between multiple devices.[30]



Prevention



Client-side



NoScript


Protection against clickjacking (including likejacking) can be added to Mozilla Firefox desktop and mobile[31] versions by installing the NoScript add-on: its ClearClick feature, released on 8 October 2008, prevents users from clicking on invisible or "redressed" page elements of embedded documents or applets.[32] According to Google's "Browser Security Handbook" from year 2008, NoScript's ClearClick is "the only freely available product that offers a reasonable degree of protection" against Clickjacking.[33] Protection from the newer cursorjacking attack was added to NoScript 2.2.8 RC1.[26]



GuardedID


GuardedID (a commercial product) includes client-side clickjack protection for users of Internet Explorer and Firefox[34] without interfering with the operation of legitimate iFrames. GuardedID clickjack protection forces all frames to become visible.



Gazelle


Gazelle is a Microsoft Research project secure web browser based on IE, that uses an OS-like security model, and has its own limited defenses against clickjacking.[35] In Gazelle, a window of different origin may only draw dynamic content over another window's screen space if the content it draws is opaque.



Server-side



Framekiller


Web site owners can protect their users against UI redressing (frame based clickjacking) on the server side by including a framekiller JavaScript snippet in those pages they do not want to be included inside frames from different sources.[33]


Such JavaScript-based protection, unfortunately, is not always reliable. This is especially true on Internet Explorer,[33] where this kind of countermeasure can be circumvented "by design" by including the targeted page inside an <IFRAME SECURITY=restricted> element.[36]



X-Frame-Options


Introduced in 2009 in Internet Explorer 8 was a new HTTP header X-Frame-Options which offered a partial protection against clickjacking[37][38] and was shortly after adopted by other browsers (Safari,[39]Firefox,[40]Chrome,[41] and Opera[42]). The header, when set by website owner, declares its preferred framing policy: values of DENY, SAMEORIGIN, or ALLOW-FROM origin will prevent any framing, framing by external sites, or allow framing only by the specified site, respectively. In addition to that, some advertising sites return a non-standard ALLOWALL value with the intention to allow framing their content on any page (equivalent of not setting X-Frame-Options at all).


In 2013 the X-Frame-Options header has been officially published as RFC 7034,[43] but is not an internet standard. The document is provided for informational purposes only.


A security header like X-Frame-Options will not protect users against clickjacking attacks that are not using a frame[44].



Content Security Policy


The frame-ancestors directive of Content Security Policy (introduced in version 1.1) can allow or disallow embedding of content by potentially hostile pages using iframe, object, etc. This directive obsoletes the X-Frame-Options directive. If a page is served with both headers, the frame-ancestors policy should be preferred by the browser.[45]—although some popular browsers disobey this requirement.[46]


Example frame-ancestors policies:


# Disallow embedding. All iframes etc. will be blank, or contain a browser specific error page.

Content-Security-Policy: frame-ancestors 'none'



# Allow embedding of own content only.

Content-Security-Policy: frame-ancestors 'self'



# Allow specific origins to embed this content

Content-Security-Policy: frame-ancestors www.example.com www.wikipedia.org


See also




  • Browser security

  • Cross-site scripting

  • Security hacker

  • Internet safety

  • Internet security

  • Phishing

  • Social jacking

  • Click fraud




References





  1. ^ Robert McMillan (17 September 2008). "At Adobe's request, hackers nix 'clickjacking' talk". PC World. Retrieved 2008-10-08..mw-parser-output cite.citation{font-style:inherit}.mw-parser-output q{quotes:"""""""'""'"}.mw-parser-output code.cs1-code{color:inherit;background:inherit;border:inherit;padding:inherit}.mw-parser-output .cs1-lock-free a{background:url("//upload.wikimedia.org/wikipedia/commons/thumb/6/65/Lock-green.svg/9px-Lock-green.svg.png")no-repeat;background-position:right .1em center}.mw-parser-output .cs1-lock-limited a,.mw-parser-output .cs1-lock-registration a{background:url("//upload.wikimedia.org/wikipedia/commons/thumb/d/d6/Lock-gray-alt-2.svg/9px-Lock-gray-alt-2.svg.png")no-repeat;background-position:right .1em center}.mw-parser-output .cs1-lock-subscription a{background:url("//upload.wikimedia.org/wikipedia/commons/thumb/a/aa/Lock-red-alt-2.svg/9px-Lock-red-alt-2.svg.png")no-repeat;background-position:right .1em center}.mw-parser-output .cs1-subscription,.mw-parser-output .cs1-registration{color:#555}.mw-parser-output .cs1-subscription span,.mw-parser-output .cs1-registration span{border-bottom:1px dotted;cursor:help}.mw-parser-output .cs1-hidden-error{display:none;font-size:100%}.mw-parser-output .cs1-visible-error{font-size:100%}.mw-parser-output .cs1-subscription,.mw-parser-output .cs1-registration,.mw-parser-output .cs1-format{font-size:95%}.mw-parser-output .cs1-kern-left,.mw-parser-output .cs1-kern-wl-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right,.mw-parser-output .cs1-kern-wl-right{padding-right:0.2em}


  2. ^ Megha Dhawan (29 September 2008). "Beware, clickjackers on the prowl". India Times. Retrieved 2008-10-08.


  3. ^ Dan Goodin (7 October 2008). "Net game turns PC into undercover surveillance zombie". The Register. Retrieved 2008-10-08.


  4. ^ Fredrick Lane (8 October 2008). "Web Surfers Face Dangerous New Threat: 'Clickjacking'". newsfactor.com. Archived from the original on 13 October 2008. Retrieved 2008-10-08.


  5. ^ Sumner Lemon (30 September 2008). "Business Center: Clickjacking Vulnerability to Be Revealed Next Month". Retrieved 2008-10-08.


  6. ^ You don't know (click)jack Robert Lemos, October 2008


  7. ^ JAstine, Berry. "Facebook Help Number 1-888-996-3777". Retrieved 7 June 2016.


  8. ^ The Confused Deputy rides again!, Tyler Close, October 2008


  9. ^ Constantin, Lucian. "Adobe to fix Flash flaw that allows webcam spying". Computerworld.


  10. ^ "select element persistance [sic] allows for attacks". Retrieved 2012-10-09.


  11. ^ "UI selection timeout missing on download prompts". Retrieved 2014-02-04.


  12. ^ "Delay following click events in file download dialog too short on OS X". Retrieved 2016-03-08.


  13. ^ Daniel Sandler (12 February 2009). "Twitter's "Don't Click" prank, explained (dsandler.org)". Retrieved 2009-12-28.


  14. ^ Krzysztof Kotowicz (21 December 2009). "New Facebook clickjacking attack in the wild". Retrieved 2009-12-29.


  15. ^ BBC (3 June 2010). "Facebook "clickjacking" spreads across site". BBC News. Retrieved 2010-06-03.


  16. ^ Josh MacDonald. "Facebook Has No Defence Against Black Hat Marketing". Retrieved 2016-02-03.


  17. ^ "Clickjacking campaign avoids click fraud, abuses Google AdSense". SC Magazine US. 10 January 2017.


  18. ^ "The Clickjacking meets XSS: a state of art". Exploit DB. 2008-12-26. Retrieved 2015-03-31.


  19. ^ Krzysztof Kotowicz. "Exploiting the unexploitable XSS with clickjacking". Retrieved 2015-03-31.


  20. ^ Cohen, Richard (31 May 2010). "Facebook Work - "Likejacking"". Sophos. Retrieved 2010-06-05.


  21. ^ Ballou, Corey (2 June 2010). ""Likejacking" Term Catches On". jqueryin.com. Archived from the original on 5 June 2010. Retrieved 2010-06-08.


  22. ^ Perez, Sarah (2 June 2010). ""Likejacking" Takes Off on Facebook". ReadWriteWeb. Retrieved 2010-06-05.


  23. ^ Kushner, David (June 2011). "Facebook Philosophy: Move Fast and Break Things". spectrum.ieee.org. Retrieved 2011-07-15.


  24. ^ Perez, Sarah (23 April 2010). "How to "Like" Anything on the Web (Safely)". ReadWriteWeb. Retrieved 24 August 2011.


  25. ^ Podlipensky, Paul. "Cursor Spoofing and Cursorjacking". Podlipensky.com. Paul Podlipensky. Retrieved 22 November 2017.


  26. ^ ab Krzysztof Kotowicz (18 January 2012). "Cursorjacking Again". Retrieved 2012-01-31.


  27. ^ Aspect Security. "Cursor-jacking attack could result in application security breaches". Retrieved 2012-01-31.


  28. ^ "Mozilla Foundation Security Advisory 2014-50". Mozilla. Retrieved 17 August 2014.


  29. ^ "Mozilla Foundation Security Advisory 2015-35". Mozilla. Retrieved 25 October 2015.


  30. ^ "Password Managers: Attacks and Defenses" (PDF). Retrieved 26 July 2015.


  31. ^ Giorgio Maone (24 June 2011). "NoScript Anywhere". hackademix.net. Retrieved 2011-06-30.


  32. ^ Giorgio Maone (8 October 2008). "Hello ClearClick, Goodbye Clickjacking". hackademix.net. Retrieved 2008-10-27.


  33. ^ abc Michal Zalevski (10 December 2008). "Browser Security Handbook, Part 2, UI Redressing". Google Inc. Retrieved 2008-10-27.


  34. ^ Robert Hansen (4 February 2009). "Clickjacking and GuardedID ha.ckers.org web application security lab". Retrieved 2011-11-30.


  35. ^ Wang, Helen J.; Grier, Chris; Moschchuk, Alexander; King, Samuel T.; Choudhury, Piali; Venter, Herman (August 2009). "The Multi-Principal OS Construction of the Gazelle Web Browser" (PDF). 18th Usenix Security Symposium, Montreal, Canada. Retrieved 2010-01-26.


  36. ^ Giorgio Maone (27 October 2008). "Hey IE8, I Can Has Some Clickjacking Protection". hackademix.net. Retrieved 2008-10-27.


  37. ^ Eric Lawrence (27 January 2009). "IE8 Security Part VII: ClickJacking Defenses". Retrieved 2010-12-30.


  38. ^ Eric Lawrence (30 March 2010). "Combating ClickJacking With X-Frame-Options". Retrieved 2010-12-30.


  39. ^ Ryan Naraine (8 June 2009). "Apple Safari jumbo patch: 50+ vulnerabilities fixed". Retrieved 2009-06-10.


  40. ^ https://developer.mozilla.org/en/The_X-FRAME-OPTIONS_response_header The X-Frame-Options response header — MDC


  41. ^ Adam Barth (26 January 2010). "Security in Depth: New Security Features". Retrieved 2010-01-26.


  42. ^ "Web specifications support in Opera Presto 2.6". 12 October 2010. Retrieved 2012-01-22.


  43. ^ "HTTP Header Field X-Frame-Options". IETF. 2013.


  44. ^ "lcamtuf's blog: X-Frame-Options, or solving the wrong problem".


  45. ^ "Content Security Policy Level 2". w3.org. 2014-07-02. Retrieved 2015-01-29.


  46. ^
    "Clickjacking Defense Cheat Sheet". Retrieved 2016-01-15.











Comments

Post a Comment

Popular posts from this blog

Information security

Image
This article is part of a series on Information security Related security categories Internet security Cyberwarfare Computer security Mobile security Network security Threats Computer crime Vulnerability Eavesdropping Malware Spyware Ransomware Trojans Viruses Worms Rootkits Bootkits Keyloggers Screen scrapers Exploits Backdoors Logic bombs Payloads Denial of service Defenses Computer access control Application security Antivirus software Secure coding Secure by default Secure by design Secure operating systems Authentication Multi-factor authentication Authorization Data-centric security Encryption Firewall Intrusion detection system Mobile secure gateway Runtime application self-protection (RASP) v t e Information security , sometimes shortened to InfoSec , is the practice of preventing unauthorized access, use, disclosure, disruption, modification, inspection, recording or destruction of information. Th...
Read more

Lambak Kiri

Image
For Lambak Kiri public housing area, see Lambak Kiri Landless Indigenous Citizens' Housing Scheme. Village in Brunei-Muara, Brunei Lambak Kiri Village Location in Brunei Coordinates: 4°59′26″N 114°57′04″E  /  4.990472°N 114.951114°E  / 4.990472; 114.951114 Coordinates: 4°59′26″N 114°57′04″E  /  4.990472°N 114.951114°E  / 4.990472; 114.951114 Country Brunei District Brunei-Muara Mukim Berakas A Government  • Village head Hamdani Omar Postcode BB1214 Lambak Kiri is a populated place in Brunei-Muara District, Brunei. It is officially a village subdivision under Berakas A, a mukim in the district. Lambak Kiri may also refer to the greater area which includes the Lambak Kiri public housing area of the Landless Indigenous Citizens' Housing Scheme (Malay: Skim Tanah Kurnia Rakyat Jati ), although the latter is a separate subdivision. Contents 1 Name 2 Administration 3 See also 4 References Name ...
Read more

章鱼与海女图

Image
本条目 可参照英語維基百科相應條目来扩充 。 （2014/5/25） 若您熟悉来源语言和主题，请协助参考外语维基扩充条目。请勿直接提交机械翻译，也不要翻译不可靠、低品质内容。依版权协议，译文需在编辑摘要注明来源，或于讨论页顶部标记 {{Translated page}} 标签。 本条目 需要擴充。 （2013年8月15日） 请協助改善这篇條目，更進一步的信息可能會在討論頁或扩充请求中找到。请在擴充條目後將此模板移除。 《 章鱼与海女 》（日语： 蛸と海女 ／ たことあま   Tako to ama ）是一幅由日本畫家葛饰北斋创作的浮世绘，出自1814年（文化4年）出版的艳本《喜能会之故真通》（日语： 喜能会之故真通 ／ きのえのこまつ   Kinoe no Komatsu ）。畫中有兩隻章鱼以觸手攻擊一名採珠的海女，並進行擬似戀獸癖的交媾行為。作品尺寸为6½" × 8¾" （16.51 cm × 22.23 cm）。 [1] 在此之前的类似作品还有北尾重政的艳本《謡曲色番組》及勝川春潮的艳本《艳本千夜多女志》等，有被北斋作为参考的可能性。 《章鱼与海女图》有不同英文翻译，一般称The Dream of the Fisherman's Wife，又作Girl Diver and Octopi、Diver and Two Octopi，Richard Douglas Lane称其为 Girl Diver and Octopi [2] ，Mathi Forrer 称其为 Pearl Diver and Two Octopi [3] ，Danielle Talerico 称其为 Diver and Two Octopi 。 [4] 目录 1 作品介绍 1.1 画中对话 1.2 解释 2 评价 3 影响 3.1 模仿作品 4 另见 5 参考来源 6 外部連結 作品介绍 画中对话 原文 译文 大蛸： いつぞハいつぞハとねらいすましてゐたかいがあつて、けふといふけふ、とうとうとらまへたア。てもむつくりとしたいいぼぼだ。いもよりハなをこうぶつだ。サアサア、すつてすつてすいつくして...
Read more