Clickjacking: Researchers raise alert for scary new cross-browser exploit
Summary: [ UPDATE: See e-mail from NoScript creator Giorgio Maone on a possible mitigation ]Researchers are beginning to raise an alarm for what looks like a scary new browser exploit/threat affecting all the major desktop platforms -- Microsoft Internet Explorer, Mozilla Firefox, Apple Safari, Opera and Adobe Flash.
[ UPDATE: See e-mail from NoScript creator Giorgio Maone on a possible mitigation ]
Researchers are beginning to raise an alarm for what looks like a scary new browser exploit/threat affecting all the major desktop platforms -- Microsoft Internet Explorer, Mozilla Firefox, Apple Safari, Opera and Adobe Flash.
The threat, called Clickjacking, was to be discussed at the OWASP NYC AppSec 2008 Conference but, at the request of Adobe and other affected vendors, the talk was nixed until a comprehensive fix is ready.
The two researchers behind the discovery -- Robert Hansen (left) and Jeremiah Grossman -- have released droplets of information to highlight the severity of this issue.
So, what exactly is Clickjacking?
According to someone who attended the semi-restricted OWASP presentation, the issue is indeed zero-day, affects all the different browsers and has nothing to do with JavaScript:
- In a nutshell, it's when you visit a malicious website and the attacker is able to take control of the links that your browser visits. The problem affects all of the different browsers except something like lynx. The issue has nothing to do with JavaScript so turning JavaScript off in your browser will not help you. It's a fundamental flaw with the way your browser works and cannot be fixed with a simple patch. With this exploit, once you're on the malicious web page, the bad guy can make you click on any link, any button, or anything on the page without you even seeing it happening.
[ SEE: Adobe Flash ads launching clipboard hijack attack ]
If that's not scary enough, consider than the average end user would have no idea what's going on during a Clickjack attack.
- Ebay, for example, would be vulnerable to this since you could embed javascript into the web page, although, javascript is not required to exploit this. "It makes it easier in many ways, but you do not need it." Use lynx to protect yourself and don’t do dynamic anything. You can “sort of” fill out forms and things like that. The exploit requires DHTML. Not letting yourself be framed (framebusting code) will prevent cross-domain clickjacking, but an attacker can still force you to click any links on their page. Each click by the user equals a clickjacking click so something like a flash game is perfect bait.
According to Hansen, the threat scenario was discussed with both Microsoft and Mozilla and they concur independently that this is a tough problem with no easy solution at the moment.
Grossman confirmed that the latest versions of Internet Explorer (including version 8) and Firefox 3 are affected.
- In the meantime, the only fix is to disable browser scripting and plugins. We realize this doesn't give people much technical detail to go on, but it's the best we can do right now.
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
Text or graphic
that should be put back in place
my web sites...
i like to keep it simple ;)
I don't understand how the clicks can hurt you.
(BTW, I still don't understand why people don't make more use of Limited accounts. The only time I ever log on to my Administrator account is when I want to install a program. I've been running this way for years, and it has never caused me the slightest inconvenience).
Actually . . .
Actually, if some of the hypotheses about how clickjacking might work are correct, it may be possible for some forms of it to detect keystrokes.
Unfortunately, we do not have all of the details, so making rash statements about what it can and can't do are ill advised until we have a better idea of what we are dealing with.
Limited User Account
What this is... and isn't
But instead he will force your browser to go to the links he wants when you click on one.
Let's say you're at the google.com webpage. Under normal functioning, you click the "search" button and it will lead to the results page.
If your clickjacked, when you click that same button, you'll go the link the hijacker want's, instead.
Or, at least, it's what I've understood of the article.
The problem is
If you leave it, and go to Google.com yourself
instead, problem solved.
Text or graphic?
As it's put, you don't even need to have any visible content for this exploit to work. You could have text only links, and those can be shown as a single space at 0.1 point size...
The crook only need to have you navigate to his malicious site, or one that have been compromised, and the exploit will be triggered without any input on your part, even after you have left that site by whatever mean, even using the back browser button, short of terminating your browser AND severing your internet connection. (PULL the plug!)
He can make you download, and install, anything, and force you to click any accept he want, without you ever seeing anything at all.
in the wild?
In the wild, not yet... maybe
There are 1000's of criminals out there searching everywhere, full time, to find something such as this.
So, as soom as something is found to NOT been impossible, the question is not:
Will there be an exploit on that flaw?
No, the question is:
WHEN?
Sounds like more fear mongering...
I agree
Are they seriously suggesting that 'everyone' switch to a command line browser?!?!
Lynx
They always leave out the affected OS
If you would RTFA
[i]The issue has nothing to do with JavaScript so turning JavaScript off in your browser will not help you. It?s a fundamental flaw with the way your browser works and cannot be fixed with a simple patch.[/i]
@mikefarinha
May I quote:
# Jeremiah Grossman Says:
September 17th, 2008 at 9:58 pm
You know, that must be one of the most reasonable and level headed statements I?ve ever heard utter surrounding the ever present FD debate. Very well said. NoScript would prevent most of the really bad clickjacking PoC, not 100%, which should be good enough to limit most risk.
http://ha.ckers.org/blog/20080915/clickjacking/
Obviously you are an MS/IE Fanboy who does not do their homework
Chad_z has a point.
It becomes important when it attacks your OS and takes
"Complete Control"
I don't put my money on MS & IE in that department.
If you read closer...
I hope this is fixed before some dipsh*t living in mommy's basement with no life figures out and starts using the exploit.
OS not same as browser
OS Irrelevant for This Exploit
Different security measures in different OSs really could have nothing to do with it. After all: they named the exploit 'clickjack' for a reason: it does the equivalent of a user click on a link, which does NOT involve the OS.
If this is really so (and the article really does imply this), then no matter how strong your OS protection is, it cannot prevent the exploit. It can only limit the damage. But the hacker can still do a lot of damage by making you click on something you did not want, a 'link' you can't even see.