Slashdot Mirror
Fixes Released (and More Promised) For "Clickjacking" Exploits
An anonymous reader writes "As discussed previously on Slashdot, concern has been raised over a class of 'clickjacking' vulnerabilities which affect all major Web browsers. These exploits allow an attacker to place invisible or seemingly legit objects on a Web page that perform undesired actions when a user clicks on them. In recent developments, 'Guya' posted a scary proof-of-concept that hijacks Adobe Flash Player to spy on users with a webcam and/or microphone. In response, Adobe released an advisory with a temporary workaround, and stated that a future Player update will address the exploit. This prompted the original disclosers of the vulnerabilities to post a summary of the exploits. Additionally, Giorgio Maone, creator of the popular NoScript extension for Firefox and other Gecko-based browsers, released version 1.8.2.1 of NoScript, which adds 'ClearClick,' a feature that intercepts clicks made on invisible or otherwise obscured elements on a page. Although issues remain, there seems to be progress in addressing these security problems."
Well, an example is the "Get Add-on" link on the NoScript website: clicking it causes an iframed link from Mozilla's add-on page to be "clicked" instead.
Clickjacking's new in terminology only.
But that's the user clicking on a visible item, simply embedded in the page. It's misleading, sure! But it's not the same as having a user click anywhere and it hitting an invisible item that does something completely unrelated to whatever's displayed.
I've solved this problem by removing my mouse from the computer. Now I never click anything malicious! Or anything at all... Its all wonderfully frustrating.
-=Bang Bang=-
Comment removed based on user account deletion
Like I need yet another NoScript update this week.
..even have a facility for the webcam and mic anyways?
I was describing this article to my boss, and here is what he said to me verbatim. My Emp. added.
So, should I be afraid of my web browser clickjacking me off of my normally visited websites to some spyware?
Anyone actually seen a POC of clickjacking? I know I haven't...
Yes. I've run across it on GCW, MSNBC and Wowhead through 3rdparty advertisers. It's already in the wild, the only thing that stopped it was noscript.
Om, nomnomnom...
Not only am I an exhibitionist, I'm also unbelievably ugly! You won't be 'clickjacking' to my warped, drooling countenance!
(-1, Raw and Uncut is the only way to read)
Just because I had to hunt for the image:
http://bay01.imagebay.com/bay.php?view=61388_poshijack.jpg
Om, nomnomnom...
http://www.cgisecurity.org/2008/10/interview-jerem.html
Well, there's a POC linked in TFA. I tried it. It looked like it was going to work but NoScript warned me about it. Pretty cool.
NoScript is my friend.
John
Click the proof-of-concept link in the article summary.
---- Liquid was a patriot ----
I was under the impression that Flash runs with full privileges and can basically do anything if you have the plugin installed. Is this not the case?
I have the Flash plugin, but I also run FlashBlock. It's awesome. No crappy flashy anything unless I actually want it, and then it's only a few mouseclicks away. That plus NoScript meant it took me about half a dozen clicks before I had both the permission and the ability to run the clickjacking demo. I feel pretty safe with Firefox.
John
Why not just use flashblock for firefox instead of firing up IE? You can enable/disable individual flash objects on the fly with flashblock.
In IE you have to let everything load, which is less secure. If the page is full of flash adverts it'll also consume more CPU cycles.
i.e. for banking.
and you expect us to trust you with security advice? Please!
John
Now if only NoScript, when I choose (for example) "Temporarily allow doubleclick.net", granted that allowance only on the page I'm viewing and its descendants and not in every open tab in every window to every site their scripts are on!
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
It's a .0 release. Haven't you learned anything from all the linux threads here?
Are they really saying this newly-uncovered, ultra-hyped, horrible, end-of-the-internet, cross-browser, gotta-fix-the-world-but-it's-SO-hard, threat... ... was INVISIBLE BUTTONS?
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
It's always kind of creeped me out that Flash even gives applets access to the microphone and webcam, and I never enable those capabilities in the program.
Yes, I understand the point of it, I just think it's creepy.
Any form of invisible link, invisible button, link or button in an iframe, getURL() call in Flash, or JavaScript handler for any normally non-clickable item that makes you go somewhere, yeah.
Comment removed based on user account deletion
Except it doesn't at all. Mouse over the link and you can clearly see in your status bar that it goes to Mozilla's site. Clickjacking my ass.
That would be great if flashblock itself wasn't susceptible to clickjacking...
Pleaseread.
Nice job looking at the page source, but you've really got to look at the javascript.
Note this bit (this is only a part; see the source for the rest):
document.getElementById("amo-install").innerHTML +=
'<iframe id="amo-installer" width="1" height="1" style="visibility: hidden; filter: alpha(opacity=0)" scrolling="no"></iframe>';
Yep. Looks like this is exactly what I was talking about.
This attack makes it possible for third parties to trick you into performing actions on third-party sites, by overlaying them invisibly on something you think you want to click. An attacker could overlay a seemingly innocuous game, for instance, with an administrative panel from a common website. The settings panel would be invisible (zero or low alpha), but still would receive mouse clicks. When the "game" asks you to click two seemingly random points, you're actually clicking the "Delete my account" checkbox and "Continue" button, for instance.
Off the top of my head, it's not a world-ender, just another problem like XSS or XSRF to be vigilant against. Possible solutions (from the top of my head) would be for sensitive form pages to have a framebusting script (although this doesn't help if JS is off), and require a password or CAPTCHA (a password could be phished around, but a CAPTCHA could work, since the fake site still has no actual way to read or write the legit site).
Information wants to be free.
Entertainment wants to be paid.
You just want to be cheap.
While the "different browser" idea would work, turning off JS would be marginal to harmful. This is a straight HTML/CSS exploit, and, actually, turning off JS could stop preventive framebusting scripts from running.
Information wants to be free.
Entertainment wants to be paid.
You just want to be cheap.
When the "game" asks you to click two seemingly random points,
s/random/arbitrary/
Information wants to be free.
Entertainment wants to be paid.
You just want to be cheap.
Except that it doesn't come up with that box at all, and I'm running the latest version of NoScript. Looks like they fixed it.
No, the noscript site is on your whitelist by default (along with googlesyndication.com so the developer can collect ad revenue off his site). The demo on his blog was an example of what would happen if you removed noscript.net from your whitelist and went to his site with the blocker enabled.
Comment removed based on user account deletion
In the case of iframes abuse, wouldn't it make sense for browsers to refuse to allow iframes to show pages which include some sort of "no_remote_display" tag? So if your page has a form which could potentially be abused, add the tag and browsers which recognise it will only show the page in it's entirety, and not as part of another page or from another domain?
I realise that this may well be far too simplistic and people will probably point out a dozen reasons why it won't work and would break all sorts of things. :)
Cress, cress, lovely lovely cress
See, this is why I think NoScript and CookieSafe (CS Lite) should be standard functionality in Firefox. In fact, they already have the functionality, they just need the friendly UI so normal people can actually use it.
But Mozilla won't do it, because it would piss off the advertisers who use JavaScript and cookies to surreptitiously track people. They might be an open source project, but they don't have the users' best interests at heart.
GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
Re: IE for banking - I know some banking sites weren't compatible with FF for a loooong time. I'm still not sure if BofA's site is. It can be frustrating.
You are using English. Please learn the difference between loose and lose; they're, there, and their; your and you're.
Yeah, which is lame because I've been using those for years. They're actually really handy in certain situations. ...And that's for legitimate web app work, not spamtastic garbage. In fact if the changes they make are sweeping enough it may break some of my old code... yay.
You are using English. Please learn the difference between loose and lose; they're, there, and their; your and you're.