Adapted from  2004 Prentice Hall, Inc. All rights reserved. Clickjacking

Adapted from  2004 Prentice Hall, Inc. All rights reserved.

Imagine an attacker who builds a web site that has a button on it that says “click here for a free iPod”. However, on top of that web page, the attacker has loaded an with your mail account, and lined up exactly the “delete all messages” button directly on top of the “free iPod” button. The victim tries to click on the “free iPod” button but instead actually clicked on the invisible “delete all messages” button. In essence, the attacker has “hijacked” the user’s click, hence the name “Clickjacking”.

Adapted from  2004 Prentice Hall, Inc. All rights reserved. The tag specifies an inline frame. An inline frame is used to embed another document within the current HTML document.

Adapted from  2004 Prentice Hall, Inc. All rights reserved. Clickjacking Attackers load a page over another page in a transparent layer. The users think that they are clicking visible buttons, while they are actually performing actions on the hidden/invisible page. The hidden page may be an authentic page; therefore, the attackers can trick users into performing actions which the users never intended. There is no way of tracing such actions to the attackers later, as the users would have been genuinely authenticated on the hidden page.

Adapted from  2004 Prentice Hall, Inc. All rights reserved. By loading Adobe Flash plugin settings page into an invisible iframe, an attacker could trick a user into altering the security settings of Flash, giving permission for any Flash animation to utilize the computer's microphone and camera. Twitter worm. This clickjacking attack convinced users to click on a button which caused them to re-tweet the location of the malicious page, and propagated massively. Attackers can trick logged-in Facebook users to arbitrarily like fan pages, links, groups, etc Past Clickjacking attacks

Adapted from  2004 Prentice Hall, Inc. All rights reserved. Defense NoScript- Mozilla add-on prevents users from clicking on invisible or "redressed" page elements of embedded documents or applets. Guarded ID- Forces all iframes to become visible Framekiller- web server does NOT allow itself to be framed ie(facebook, gmail, etc)