| 词条 | Clickjacking |
| 释义 |
In web browsers, clickjacking is a browser security issue that is a vulnerability across a variety of browsers and platforms. Clickjacking can also take place outside of web browsers, including applications.[5] A clickjack takes the form of embedded code or a script that can execute without the user's knowledge, such as clicking on a button that appears to perform another function.[6] Clickjacking is an instance of the confused deputy problem, wherein a computer is innocently fooled into misusing its authority.[7] HistoryIn 2002, it had been noted that it was possible to load a transparent layer over a web page and have the user's input affect the transparent layer without the user noticing. However, this was mainly ignored as a major issue until 2008.[5] In 2008, Jeremiah Grossman and Robert Hansen had discovered that Adobe Flash Player was able to be clickjacked, allowing an attacker to gain access of the computer without the user's knowledge.[5] The term "clickjacking" was coined by Jeremiah Grossman and Robert Hansen, [8][9] a portmanteau of the words "click" and "hijacking." [5] As more attacks of a similar nature were discovered, the focus of the term "UI redressing" was changed to describe the category of these attacks, rather than just clickjacking itself.[5] DescriptionClickjacking takes advantage of vulnerabilities that are present in applications and web pages to allow the attacker to manipulate the user's computer. For example, a clickjacked page tricks a user into performing undesired actions by clicking on a concealed link. On a clickjacked page, the attackers load another page over it in a transparent layer. The unsuspecting users think that they are clicking visible buttons, while they are actually performing actions on the invisible page. The hidden page may be an authentic page; therefore, the attackers can trick users into performing actions which the users never intended. There is no way of tracing such actions to the attackers later, as the users would have been genuinely authenticated on the hidden page. Clickjacking is not limited to this type though, and are present in other forms. Clickjacking categories
ClassicClassic clickjacking refers to when an attacker uses hidden layers on web pages to manipulate the actions a user's cursor does, resulting in the user being mislead about what truly is being clicked on. A user might receive an email with a link to a video about a news item, but another webpage, say a product page on Amazon, can be "hidden" on top or underneath the "PLAY" button of the news video. The user tries to "play" the video but actually "buys" the product from Amazon. The hacker can only send a single click, so they rely on the fact that the visitor is both logged into Amazon.com and has 1-click ordering enabled. While technical implementation of these attacks may be challenging due to cross-browser incompatibilities, a number of tools such as BeEF or Metasploit Project offer almost fully automated exploitation of clients on vulnerable websites. Clickjacking may be facilitated by - or may facilitate - other web attacks, such as XSS.[16][17] LikejackingLikejacking is a malicious technique of tricking users of a website into "liking" a Facebook page that they did not intentionally mean to "like".[18] The term "likejacking" came from a comment posted by Corey Ballou in the article How to "Like" Anything on the Web (Safely),[19] which is one of the first documented postings explaining the possibility of malicious activity regarding Facebook's "like" button.[20] According to an article in IEEE Spectrum, a solution to likejacking was developed at one of Facebook's hackathons.[21] A "Like" bookmarklet is available that avoids the possibility of likejacking present in the Facebook like button.[22] NestedNested clickjacking, compared to classic clickjacking, works by embedding a malicious web frame between two frames of the original, harmless web page: that from the framed page and that which is displayed on the top window. This works due to a vulnerability in the HTTP header In the past, with Google+ and the faulty version of CursorjackingCursorjacking is a UI redressing technique to change the cursor from the location the user perceives, discovered in 2010 by Eddy Bordi, a researcher at Vulnerability.fr,[23] Marcus Niemietz demonstrated this with a custom cursor icon, and in 2012 Mario Heiderich by hiding the cursor.[24][25] Jordi Chancel, a researcher at Alternativ-Testing.fr, discovered a cursorjacking vulnerability using Flash, HTML and JavaScript code in Mozilla Firefox on Mac OS X systems (fixed in Firefox 30.0) which can lead to arbitrary code execution and webcam spying.[26] A second CursorJacking vulnerability was again discovered by Jordi Chancel in Mozilla Firefox on Mac OS X systems (fixed in Firefox 37.0) using once again Flash, HTML and JavaScript code which can lead also to the spying of the webcam and the execution of a malicious addon allowing the execution of a malware on the computer of the trapped user.[27] BrowserlessIn browserless clickjacking, attackers utilize vulnerabilities in programs to replicate classic clickjacking in them, without being required to use the presence of a web browser. This method of clickjacking is mainly prevalent among mobile devices, usually on Android devices, especially due to the way in which toast notifications work. Because toast notifications have a small delay in between the moment the notification is requested and the moment the notification actually displays on-screen, attackers are capable of using that gap to create a dummy button that lies hidden underneath the notification and can still be clicked on.[5] CookiejackingCookiejacking is a form of clickjacking in which cookies are stolen from web browsers. This is done by tricking the user into dragging an object which seemingly appears harmless, but is in fact making the user select the entire content of the cookie being targeted. From there, the attacker can acquire the cookie and all of the data that is within it.[13] FilejackingIn filejacking, attackers use the web browser's capability to navigate through the computer and access computer files in order to acquire personal data. It does so by tricking the user into establishing an active file server (through the file and folder selection window that browsers use). With this, attackers can now access and take files from their victims' computers.[14] Password manager attackA 2014 paper from researcher at the Carnegie Mellon University found that while browsers refuse to autofill if the protocol on the current login page is different from the protocol at the time the password was saved, some password managers would insecurely fill in passwords for the http version of https-saved passwords. Most managers did not protect against iFrame- and redirection-based attacks and exposed additional passwords where password synchronization had been used between multiple devices.[15] PreventionClient-sideNoScriptProtection against clickjacking (including likejacking) can be added to Mozilla Firefox desktop and mobile[28] versions by installing the NoScript add-on: its ClearClick feature, released on 8 October 2008, prevents users from clicking on invisible or "redressed" page elements of embedded documents or applets.[29] According to Google's "Browser Security Handbook" from year 2008, NoScript's ClearClick is "the only freely available product that offers a reasonable degree of protection" against Clickjacking.[30] Protection from the newer cursorjacking attack was added to NoScript 2.2.8 RC1.[24] GuardedIDGuardedID (a commercial product) includes client-side clickjack protection for users of Internet Explorer and Firefox[31] without interfering with the operation of legitimate iFrames. GuardedID clickjack protection forces all frames to become visible. GazelleGazelle is a Microsoft Research project secure web browser based on IE, that uses an OS-like security model, and has its own limited defenses against clickjacking.[32] In Gazelle, a window of different origin may only draw dynamic content over another window's screen space if the content it draws is opaque. Server-sideFramekillerWeb site owners can protect their users against UI redressing (frame based clickjacking) on the server side by including a framekiller JavaScript snippet in those pages they do not want to be included inside frames from different sources.[30] Such JavaScript-based protection, unfortunately, is not always reliable. This is especially true on Internet Explorer,[30] where this kind of countermeasure can be circumvented "by design" by including the targeted page inside an |