top of page
Writer's picturepusradojatipszubou

Clickjacking attacks: A guide to understanding and preventing this web security threat



Clickjacking attacks rely on visual tricks to get website visitors to click on user interface elements that will perform actions on another website. This article shows you how a clickjacking attack works in practice and how you can prevent them.


To run the sample application you are going to download, you just need Node.js installed on your machine. However, the principles behind the clickjacking vulnerability and the prevention strategies are independent of the specific programming language or framework.




What are Clickjacking attacks Protection and Prevention tips




In fact, in the CSRF case, the attacker builds an HTTP request and exploits the user session to send it to the server. In the clickjacking case, the user is directly interacting with the target website. No request is built by the attacker. The request sent to the target server is a legitimate user request. Check out this blog post to learn more about CSRF attacks and how to prevent them.


Since clickjacking attacks leverage iframes, you may think that applying some sort of client-side defense that prevent your website from being loaded in iframes can protect it. This technique, known as frame-busting, can be implemented with a few lines of JavaScript.


Consider that, besides the approach shown here, there are other similar techniques based on JavaScript and HTML that try to prevent clickjacking attacks. However, in general, client-side attempts to block clickjacking attacks usually don't work well since they are easy to get around.


Major browsers support the X-Frame-Options header. However, it has never been standardized, so there might be browsers not supporting it. An alternative standard approach to prevent clickjacking attacks is by using specific Content Security Policy (CSP) directives.


Many clickjacking attacks occur on duplicates of legitimate websites. An attacker could clone your website and weaponize it with hijacked links hidden on top of it. Besides the devastating consequences for users, your business could suffer irremediable reputation damage.


Frame busting scripts are not a recommended defense against clickjacking attacks. Many web browsers block frame busting Javascript code and the browsers that don't can be easily tricked to permit the malicious overlay.


Clickjacking attacks attempt to trick the user into unintentionally clicking an unexpected web page element. Most clickjacking methods exploit vulnerabilities related to HTML iframes and prevention centers around preventing page framing. In this blog post, we will see how clickjacking works, how it can be prevented, and why this threat to application security is not going away any time soon.


Clickjacking attacks trick the user into clicking unintentionally on a webpage element that is invisible or disguised as another element. Since clickjacking attacks do not affect the website per se, businesses might not take these vulnerabilities seriously. However, these attacks affect users and only businesses can protect them through robust clickjacking prevention measures. Businesses that do not take proper preventive measures are essentially risking their brand value and business continuity.


In clickjacking attacks, the attacker captures user clicks through UI tricks that make the user believe that they are performing desired actions. These attacks are also known as User Interface (UI) Redressing. A majority of attackers leverage clickjacking vulnerabilities related to HTML iframes and protection methods that focus on preventing page framing.


The vulnerability of the website to clickjacking attacks can be gauged using testing. The tester would try to include a sensitive page from the website in an iframe. They will execute code from another server and evaluate if the webpage is vulnerable to clickjacking. They will also test the strength of the anti-clickjacking methods used on the website.


The use of X-Frame-Options or a frame-breaking script is a more fail-safe method of clickjacking protection. However, in scenarios where content must be frameable, then a window.confirm() can be used to help mitigate Clickjacking by informing the user of the action they are about to perform.


Invoking window.confirm() will display a popup that cannot be framed. If the window.confirm() originates from within an iframe with a different domain than the parent, then the dialog box will display what domain the window.confirm() originated from. In this scenario the browser is displaying the origin of the dialog box to help mitigate Clickjacking attacks. It should be noted that Internet Explorer is the only known browser that does not display the domain that the window.confirm() dialog box originated from, to address this issue with Internet Explorer insure that the message within the dialog box contains contextual information about the type of action being performed. For example:


IE8 and Google Chrome introduced reflective XSS filters that help protect web pages from certain types of XSS attacks. Nava and Lindsay (at Blackhat) observed that these filters can be used to circumvent frame busting code. The IE8 XSS filter compares given request parameters to a set of regular expressions in order to look for obvious attempts at cross-site scripting. Using "induced false positives", the filter can be used to disable selected scripts. By matching the beginning of any script tag in the request parameters, the XSS filter will disable all inline scripts within the page, including frame busting scripts. External scripts can also be targeted by matching an external include, effectively disabling all external scripts. Since subsets of the JavaScript loaded is still functional (inline or external) and cookies are still available, this attack is effective for clickjacking.


The target website iframe is positioned within the browser so that there is a precise overlap of the target action with the decoy website using appropriate width and height position values. Absolute and relative position values are used to ensure that the target website accurately overlaps the decoy regardless of screen size, browser type and platform. The z-index determines the stacking order of the iframe and website layers. The opacity value is defined as 0.0 (or close to 0.0) so that the iframe content is transparent to the user. Browser clickjacking protection might apply threshold-based iframe transparency detection (for example, Chrome version 76 includes this behavior but Firefox does not). The attacker selects opacity values so that the desired effect is achieved without triggering protection behaviors.


Clickjacking attacks are possible whenever websites can be framed. Therefore, preventative techniques are based upon restricting the framing capability for websites. A common client-side protection enacted through the web browser is to use frame busting or frame breaking scripts. These can be implemented via proprietary browser JavaScript add-ons or extensions such as NoScript. Scripts are often crafted so that they perform some or all of the following behaviors:


We have discussed a commonly encountered browser-side prevention mechanism, namely frame busting scripts. However, we have seen that it is often straightforward for an attacker to circumvent these protections. Consequently, server driven protocols have been devised that constrain browser iframe usage and mitigate against clickjacking.


Clickjacking is a browser-side behavior and its success or otherwise depends upon browser functionality and conformity to prevailing web standards and best practice. Server-side protection against clickjacking is provided by defining and communicating constraints over the use of components such as iframes. However, implementation of protection depends upon browser compliance and enforcement of these constraints. Two mechanisms for server-side clickjacking protection are X-Frame-Options and Content Security Policy.


X-Frame-Options is not implemented consistently across browsers (the allow-from directive is not supported in Chrome version 76 or Safari 12 for example). However, when properly applied in conjunction with Content Security Policy as part of a multi-layer defense strategy it can provide effective protection against clickjacking attacks.


Content Security Policy (CSP) is a detection and prevention mechanism that provides mitigation against attacks such as XSS and clickjacking. CSP is usually implemented in the web server as a return header of the form:


The recommended clickjacking protection is to incorporate the frame-ancestors directive in the application's Content Security Policy. The frame-ancestors 'none' directive is similar in behavior to the X-Frame-Options deny directive. The frame-ancestors 'self' directive is broadly equivalent to the X-Frame-Options sameorigin directive. The following CSP whitelists frames to the same domain only:


Cursorjacking is another version of clickjacking. In cursorjacking, attackers trick users by adding a custom cursor image that confuses victims into clicking on parts of the page they have no intention of clicking. In more advanced clickjacking scenarios, victims do more than just click. They might even enter usernames, passwords, credit card numbers, and other personal information into what they believe to be common sites they use frequently. But instead, their information is being scraped by a malicious, hidden website.


Due to the dynamic, innovative nature of the web, including new JavaScript frameworks, cyberattacks similar to clickjacking will continue to proliferate. Victims will continue to be tricked into performing unexpected actions on websites that seem identical to sites they have used before. As such, clickjacking might be difficult to detect, but in large organizations, as employees and customers interact with the company's web properties at scale, odd click behavior should be reported and acted upon quickly to thwart a cyberattack.


Luckily, there are several steps that an organization can take to protect its employees, customers, and other stakeholders from a clickjacking attack. These protections are typically undertaken by the web development team, as they are server-driven and require some coding and knowledge of the functionality of the web. 2ff7e9595c


0 views0 comments

Recent Posts

See All

Comments


bottom of page