Slashdot Mirror
Fixes Released (and More Promised) For "Clickjacking" Exploits
An anonymous reader writes "As discussed previously on Slashdot, concern has been raised over a class of 'clickjacking' vulnerabilities which affect all major Web browsers. These exploits allow an attacker to place invisible or seemingly legit objects on a Web page that perform undesired actions when a user clicks on them. In recent developments, 'Guya' posted a scary proof-of-concept that hijacks Adobe Flash Player to spy on users with a webcam and/or microphone. In response, Adobe released an advisory with a temporary workaround, and stated that a future Player update will address the exploit. This prompted the original disclosers of the vulnerabilities to post a summary of the exploits. Additionally, Giorgio Maone, creator of the popular NoScript extension for Firefox and other Gecko-based browsers, released version 1.8.2.1 of NoScript, which adds 'ClearClick,' a feature that intercepts clicks made on invisible or otherwise obscured elements on a page. Although issues remain, there seems to be progress in addressing these security problems."
Anyone actually seen a POC of clickjacking? I know I haven't...
I've solved this problem by removing my mouse from the computer. Now I never click anything malicious! Or anything at all... Its all wonderfully frustrating.
-=Bang Bang=-
This stuff is why I use NoScript and haven't even installed the Flash plugin addon to Firefox. If I REALLY want to view something in flash and I trust the content provider, I'll fire up IETab.
Not perfect, but a far sight safer than Joe Q. User.
The Digital Sorceress
Comment removed based on user account deletion
Like I need yet another NoScript update this week.
It seems to me that ACORN just hired a bunch of low lifes who made a lot of fraudulent voter registration cards to make it look like they were doing work. It also seems like a set up to me. If election fraud does occur it'll be nice to have a patsy to blame it on.
The real way this election will be rigged is by the electronic voting machines, especially the ones that tabulate the vote at a central location and have no paper trail. It is even easy to manipulate the scantron election results.
This ACORN business is misdirection.
..even have a facility for the webcam and mic anyways?
Turn off JavaScript, Java, Flash, and other plugins on the browser you use for web searches and general goofing around on the web. Use a different browser for trusted sites for serious uses, i.e. for banking.
Not only am I an exhibitionist, I'm also unbelievably ugly! You won't be 'clickjacking' to my warped, drooling countenance!
(-1, Raw and Uncut is the only way to read)
I'll just fire up my webcam, stand in front of it naked and commence clicking on said sites.
Surely, after that, once (if) the hackers regain their sight, they will surely be afraid to ever try that again
http://www.cgisecurity.org/2008/10/interview-jerem.html
I was under the impression that Flash runs with full privileges and can basically do anything if you have the plugin installed. Is this not the case?
Now if only NoScript, when I choose (for example) "Temporarily allow doubleclick.net", granted that allowance only on the page I'm viewing and its descendants and not in every open tab in every window to every site their scripts are on!
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
It's a .0 release. Haven't you learned anything from all the linux threads here?
sux0r 2.0 - it sux0rs up all the web [sux0r.org]
Mildly intrigued by your signature I decided to click on it:
In many a drunken rant alone in front of a terminal, I dropped buzzwords like "distributed blogging", "content refactoring" and "harnessing the power of selfishness" which quite frankly sounds a lot like me talking out of my ass.
Your mother must be so proud
Are they really saying this newly-uncovered, ultra-hyped, horrible, end-of-the-internet, cross-browser, gotta-fix-the-world-but-it's-SO-hard, threat... ... was INVISIBLE BUTTONS?
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
It's always kind of creeped me out that Flash even gives applets access to the microphone and webcam, and I never enable those capabilities in the program.
Yes, I understand the point of it, I just think it's creepy.
Any form of invisible link, invisible button, link or button in an iframe, getURL() call in Flash, or JavaScript handler for any normally non-clickable item that makes you go somewhere, yeah.
Comment removed based on user account deletion
Years of Goatse abuse has rendered most of slashdot blind, and sterile.
So why is this "exploit" so "new and dangerous"?
I mean, does not every damn news site (with the exception of the great Slashdot) have that annoying "first time you click, we pop up an ad" thing going on? Doesn't matter if you click on whitespace, text (like to highlight it), or whatever.. first click = ad.
That was already 'clicking causing an undesired link'. This is hardly new. Boo on the finders of this 'major bug', spammers and marketing majors beat you to it by at least a year, and that's embarrassing.
Comment removed based on user account deletion
In the case of iframes abuse, wouldn't it make sense for browsers to refuse to allow iframes to show pages which include some sort of "no_remote_display" tag? So if your page has a form which could potentially be abused, add the tag and browsers which recognise it will only show the page in it's entirety, and not as part of another page or from another domain?
I realise that this may well be far too simplistic and people will probably point out a dozen reasons why it won't work and would break all sorts of things. :)
Cress, cress, lovely lovely cress
I can't imagine browsing without NoScript. Firefox has no competition on the computers I own and those I manage not because it's good or better than the others, but because NoScript runs on it.
At least ACORN isn't paying off it's goons in crack this election. Well, we haven't caught them doing it this time anyways. But ACORN has a long track record of fraud. Not much new there.
...Slashdot pages come up much faster now!
FixingTheWeb.com Helping to keep the bad guys out...
Yeah, which is lame because I've been using those for years. They're actually really handy in certain situations. ...And that's for legitimate web app work, not spamtastic garbage. In fact if the changes they make are sweeping enough it may break some of my old code... yay.
You are using English. Please learn the difference between loose and lose; they're, there, and their; your and you're.
"That would be great if flashblock itself wasn't susceptible to clickjacking." - by id (11164) on Thursday October 09, @08:15PM (#25322671) Homepage
Which is a reason why I had suggested other methods vs. the possibility you noted, here on this website a couple weeks back when this surfaced:
Alarm Raised For "Clickjacking" Browser Exploit:
http://it.slashdot.org/comments.pl?sid=976325&threshold=-1&commentsort=0&mode=thread&no_d2=1&cid=25158835
& that'll do the job also.
APK
P.S.=> This is why I've been warning folks about the faulty DOM (why javascript's risky really, mostly) for years now, & more recently in a security guide I wrote that states that basic protective method (i.e.-> "If you don't go into the scripting/iframes/plugins kitchen, you can't get burned"), in the news link URL above...&, it just works - simple, effective, & even allows gains in page rendering speeds as a bonus. Less risk as well, IF a plugin is faulty vs. a certain style of attack also!
That is, IF you can "obey some rules online/use some constraints" etc. et al ...
After all - Nearly all the attacks today come from some form of abuse of javascript/iframes/plugins for webbrowsers the past 3-4 yrs. now it seems, & just going to SECUNIA.COM &/or SECURITYFOCUS.COM can show anybody this much... & to myself @ least? This makes utilizing javascript/iframes/plugins, wholesale online on every site you visit... well, risky!
(imo & this type of news this article denotes, really only seconds my approach as an effective defense method, for me (& I only use javascript/activex/plugins/iframes on sites that DEMAND I do so, for FULL functionality, minimizing the risk, & as a bonus, you also process webpages faster by not using scripting & plugins too))... apk
http://www.securityfocus.com/news/11534/2
SALIENT QUOTE:
----
"JavaScript increases the effectiveness of this attacks hugely, because it ensures that user will click our target no matter where he points -- that is, we can move the target around to stay always under the mouse pointer"
----
Also, just taking a look around @ sites like securityfocus.com &/or secunia.com will show you, easily mind you, that the majority of attacks out there today online? Javascript/Iframes/plugins driven... & for the past 3-4 yrs. or more, no less.
Turning off Javascript/IFrames/Plugins keeps you safe(r) vs. THIS attack, & countless others (that aren't only on 'bad site pages' but, even in adbanners the past few years now as well).
APK
P.S.=> I had it right here, 2 weeks ago, in regards to the EXACT PLUGIN (Adobe Flash) USED, first off... when news of this FIRST surfaced:
Alarm Raised For "Clickjacking" Browser Exploit:
http://it.slashdot.org/comments.pl?sid=976325&threshold=-1&commentsort=0&mode=thread&no_d2=1&cid=25158835
& Secondly?
Well - for more than a year now (& for years beforehand no less), I had been advising folks on 1 of the link URL's I posted there in that URL above (over 27 computer tech forums worldwide) to turn off javascript/iframes/plugins on sites you do NOT "need" to have them running on, for FULL functionality - this way, you stay safe(r) by far...
(Leave javascript on, for instance, for sites that require data access on say, online banking &/or shopping-commerce websites - BUT, THESE ONLY (to minimize the attack surface upon YOUR system, basically))...
That way, you're safe, regardless of the browser used (OR, even the OS used, since Javascript's DOM is the same & it is present even on *NIX variants - the only reason Windows is SO often targetted is twofold, imo - First, it has the majority of users (mostly less technically inclined than say, *NIX heads are), & Secondly, it presents the largest target to attack, thus, the highest "ROI" really)... apk