[ insider_reports_insider ]
Clickjacking Is Scary, Real, And Kinda Hypothetical
SecurityProNews
Staff Writer
2008-11-04
 Insider Reports RSS Feed
The new boogieman of the security world is the practice of "clickjacking," or slipping an invisible link over a legitimate link to trick surfers into clicking it. Prevalence: unknown. Alert level: high, because only Firefox and Adobe can stop it.
 | | Clickjacking Is Scary, Real, And Kinda Hypothetical |  |
Clickjacking is still a bit of a boogieman because the vulnerability to this type of attack is very real and scary, but the actual execution of it is thus far untracked. It's possible in the way that the Army conducts red-teaming scenarios to devise defense strategies.
Though the type of attack-a form of cross-site scripting-has been around for awhile, this new tack started getting attention at the beginning of last month. (Author's note: Sorry if I missed it then. My daughter was born at the same time and I was a little busy.)
Though not the only means of attack, iFrame makes it possible for attackers to overlay a clickable link where a user is expected to click for some other reason: a buy button, send, download, etc. When clicked, the link brings up a page of the attackers desire, often without the user even noticing.
Obviously this is ugly, like a room full of Steve Buscemi ugly.
Internet Explorer, Opera, Chrome, and Safari are all said to be vulnerable to this kind of Web-based attack. Firefox 3, as well, but with a much-touted plugin called NoScript, it can be managed a webpage at a time. Adobe was (relatively) quick about patching flaws inherent in Flash applications-games seemed especially good targets-and issued a patch.
For other browsers, the proposed answer isn't so simple and involves disabling JavaScript, plugins/ActiveX and iFrames, or switching to Linx, all of which makes the Internet 1993 again.
Websites can protect themselves by using dynamic URLs and by having much-used buttons appear in different places randomly. Attackers would need static URLs and static hot-button placement to do any clickjacking.
About the Author:
SecurityProNews is a daily online and email publication focusing on internet security issues.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
