View source for Clickjacking

{{Use dmy dates|date=July 2013}}
'''Clickjacking''' ('''User Interface redress attack''', '''UI redress attack''', '''UI redressing''') is a [[malware|malicious technique]] of tricking a [[world wide web|Web]] [[user (computing)|user]] into clicking on something different from what the user perceives they are clicking on, thus potentially revealing [[confidentiality|confidential]] information or taking control of their computer while clicking on seemingly innocuous [[web page]]s.<ref>{{cite web|url=https://www.pcworld.idg.com.au/index.php/id;979405561 |title=At Adobe's request, hackers nix 'clickjacking' talk|author=Robert McMillan |date=17 September 2008|publisher=PC World|accessdate=2008-10-08}}</ref><ref>{{Cite news|url=https://infotech.indiatimes.com/quickiearticleshow/3543527.cms |title=Beware, clickjackers on the prowl |author=Megha Dhawan|date=29 September 2008|publisher=India Times|accessdate=2008-10-08}}</ref><ref>{{cite web|url=https://www.theregister.co.uk/2008/10/07/clickjacking_surveillance_zombie/ |title=Net game turns PC into undercover surveillance zombie|author=Dan Goodin |date=7 October 2008 |work=The Register |accessdate=2008-10-08}}</ref><ref>{{cite web|url=https://news.yahoo.com/s/nf/20081008/bs_nf/62355 |title=Web Surfers Face Dangerous New Threat: 'Clickjacking' |author=Fredrick Lane |date=8 October 2008 |work= |publisher=newsfactor.com |accessdate=2008-10-08 |deadurl=yes |archiveurl=https://web.archive.org/20081013003436/https://news.yahoo.com:80/s/nf/20081008/bs_nf/62355 |archivedate=13 October 2008 }}</ref> It is a [[browser security]] issue that is a [[vulnerability (computing)|vulnerability]] across a variety of [[web browsers|browsers]] and [[platform (computing)|platform]]s. A clickjack takes the form of embedded [[source code|code]] or a script that can execute without the user's knowledge, such as clicking on a [[button (computing)|button]] that appears to perform another function.<ref>{{cite web|url=https://www.pcworld.com/businesscenter/article/151677/clickjacking_vulnerability_to_be_revealed_next_month.html |title=Business Center: Clickjacking Vulnerability to Be Revealed Next Month |author=Sumner Lemon |date=30 September 2008|accessdate=2008-10-08}}</ref> The term "clickjacking" was coined by Jeremiah Grossman and Robert Hansen in 2008.<ref>[https://www.securityfocus.com/news/11535/ You don't know (click)jack] Robert Lemos, October 2008</ref> Clickjacking can be understood as an instance of the [[confused deputy problem]], a term used to describe when a computer is innocently fooled into misusing its authority.<ref>[https://waterken.sourceforge.net/clickjacking/ The Confused Deputy rides again!], Tyler Close, October 2008</ref>

[[File:Clicking Upload button on abovetopsecret triggers clickjacking warning on NoScript 141128-cropped.png|thumb|"potential clickjacking" warning from the "NoScript" internet-browser addon]]

==Description==
Clickjacking is possible because seemingly harmless features of HTML web pages can be employed to perform unexpected actions.

A clickjacked page tricks a user into performing undesired actions by clicking on a concealed link. On a clickjacked page, the attackers load another page over it in a transparent layer. The users think that they are clicking visible buttons, while they are actually performing actions on the hidden/invisible page. The hidden page may be an authentic page; therefore, the attackers can trick users into performing actions which the users never intended. There is no way of tracing such actions to the attackers later, as the users would have been genuinely authenticated on the hidden page.

==Examples==
A user might receive an email with a link to a video about a news item, but another webpage, say a product page on [[Amazon.com]], can be "hidden" on top or underneath the "PLAY" button of the news video. The user tries to "play" the video but actually "buys" the product from Amazon. The hacker can only send a single click, so they rely on the fact that the visitor is both logged into [[Amazon.com]] and has 1-click ordering enabled.

Other known exploits include:
* Tricking users into enabling their [[webcam]] and microphone through [[Adobe Flash|Flash]] (though this has since been fixed since originally reported){{Citation needed|date = November 2015}}
* Tricking users into making their social networking profile information public{{Citation needed|date = November 2015}}
* Making users follow someone on [[Twitter]]<ref>{{cite web|url=https://dsandler.org/outgoing/dontclick_orig.html |title=Twitter's "Don't Click" prank, explained (dsandler.org) |author=Daniel Sandler |date=12 February 2009|accessdate=2009-12-28}}</ref>
* Sharing or liking links on Facebook<ref>{{cite web|url=https://blog.kotowicz.net/2009/12/new-facebook-clickjagging-attack-in.html |title=New Facebook clickjacking attack in the wild |author=Krzysztof Kotowicz |date=21 December 2009|accessdate=2009-12-29}}</ref><ref>{{Cite news|url=https://news.bbc.co.uk/2/hi/technology/10224434.stm |title=Facebook "clickjacking" spreads across site |author=BBC |date=3 June 2010|accessdate=2010-06-03 |work=BBC News}}</ref>
* Getting likes on Facebook fan page<ref>{{cite web|url=https://joshmacdonald.net/1677/facebook-has-no-defence-against-black-hat-marketing |title= Facebook Has No Defence Against Black Hat Marketing |author=Josh MacDonald |accessdate=2016-02-03}}</ref>
* Clicking [[Google Adsense]] ads to generate [[pay per click]] revenue{{Citation needed|date = November 2015}}
* Playing YouTube videos to gain views
* Following someone on Facebook
* [[Google plus#+1 Button|+1]] a website

While technical implementation of these attacks may be challenging due to cross-browser incompatibilities, a number of tools such as [[BeEF]] or [[Metasploit Project]] offer almost fully automated exploitation of clients on vulnerable websites. Clickjacking may be facilitated by - or may facilitate - other web attacks, such as [[Cross-site scripting|XSS]].<ref>{{cite web | url=https://www.exploit-db.com/papers/12987/ | title=The Clickjacking meets XSS: a state of art | publisher=Exploit DB | date=2008-12-26 | accessdate=2015-03-31}}</ref><ref>{{cite web | url=https://blog.kotowicz.net/2011/03/exploiting-unexploitable-xss-with.html | title=Exploiting the unexploitable XSS with clickjacking | accessdate=2015-03-31 | author=Krzysztof Kotowicz}}</ref>

===Likejacking===
Likejacking is a [[Hacker (computer security)|malicious technique]] of tricking users of a website into "[[Like (Facebook)|liking]]"" a [[Facebook]] page that they did not intentionally mean to "[[Like (Facebook)|like]]".<ref name="Sophos 9783">{{cite web
| url= https://www.sophos.com/blogs/sophoslabs/?p=9783
| title= Facebook Work - "Likejacking"| last=  Cohen
| first=  Richard | publisher=  [[Sophos]]
| date=  31 May 2010| accessdate = 2010-06-05
}}</ref> The term "likejacking" came from a comment posted by Corey Ballou in the article ''How to "Like" Anything on the Web (Safely)'',<ref name="corey ballou">{{cite web
| url= https://www.jqueryin.com/2010/06/02/likejacking-term-catches-on/| title= "Likejacking" Term Catches On| last=  Ballou| first=  Corey| publisher=  jqueryin.com
| date=2 June 2010| accessdate = 2010-06-08}}{{dead link|date=August 2015<!---Not actually dead, but now it is a malicious URL-->}}</ref> which is one of the first documented postings explaining the possibility of malicious activity regarding Facebook's "like" button.<ref name="readwriteweb likejacking">{{cite web| url= https://www.readwriteweb.com/archives/likejacking_takes_off_on_facebook.php
| title= "Likejacking" Takes Off on Facebook| last=  Perez| first=  Sarah | publisher=  ReadWriteWeb| date=2 June 2010| accessdate = 2010-06-05}}</ref>

According to an article in ''[[IEEE Spectrum]]'', a solution to likejacking was developed at one of Facebook's [[hackathon]]s.<ref>{{cite web | url = https://spectrum.ieee.org/at-work/innovation/facebook-philosophy-move-fast-and-break-things/2 | title = Facebook Philosophy: Move Fast and Break Things | publisher = spectrum.ieee.org | accessdate = 2011-07-15 | date = June 2011 | last =Kushner | first = David}}</ref> A "Like" [[bookmarklet]] is available that avoids the possibility of likejacking present in the [[Facebook Like Button]].<ref>{{cite news|url=https://www.readwriteweb.com/archives/how_to_like_anything_on_the_web_safely.php|title=How to "Like" Anything on the Web (Safely)|last=Perez|first=Sarah|date=23 April 2010|work=ReadWriteWeb|accessdate=24 August 2011}}</ref>

===Cursorjacking===
Cursorjacking is a UI redressing technique to change the cursor from the location the user perceives, discovered in 2010 by Eddy Bordi, a researcher at Vulnerability.fr,{{citation needed|date=June 2012}} Marcus Niemietz demonstrated this with a custom cursor icon, and in 2012 Mario Heiderich by hiding the cursor.<ref name="Kotowicz">{{cite web|url=https://blog.kotowicz.net/2012/01/cursorjacking-again.html |title=Cursorjacking Again |author=Krzysztof Kotowicz |date=18 January 2012|accessdate=2012-01-31}}</ref><ref>{{cite web|url=https://www.aspectsecurity.com/news/application-security/cursor-jacking-attack-could-result-in-application-security-breaches-3/ |title=Cursor-jacking attack could result in application security breaches |author=Aspect Security|date=|accessdate=2012-01-31}}</ref>

Jordi Chancel, a researcher at Alternativ-Testing.fr, discovered a cursorjacking vulnerability using Flash, HTML and JavaScript code in Mozilla Firefox on Mac OS X systems (fixed in Firefox 30.0) which can lead to arbitrary code execution and webcam spying.<ref>{{cite web|title=Mozilla Foundation Security Advisory 2014-50|url=https://www.mozilla.org/security/announce/2014/mfsa2014-50.html|publisher=Mozilla|accessdate=17 August 2014}}</ref>

A second CursorJacking vulnerability was again discovered by Jordi Chancel in Mozilla Firefox on Mac OS X systems (fixed in Firefox 37.0) using once again Flash, HTML and JavaScript code which can lead also to the spying of the webcam and the execution of a malicious addon allowing the execution of a malware on the computer of the trapped user.<ref>{{cite web|title=Mozilla Foundation Security Advisory 2015-35|url=https://www.mozilla.org/en-US/security/advisories/mfsa2015-35/|publisher=Mozilla|accessdate=25 October 2015}}</ref>

===Password manager attack===
A 2014 paper from researcher at the [[Carnegie Mellon University]] found that whilst browsers refuse to autofill if the protocol on the current login page is different from the protocol at the time the password was saved, some [[password manager]]s would insecurely fill in passwords for the http version of https-saved passwords. Most managers did not protect against [[Framing (World Wide Web)|iFrame]] and [[URL redirection|redirection]] based [[Attack (computing)|attacks]] and exposed additional passwords where [[password synchronization]] had been used between multiple devices.<ref>{{cite web|title=Password Managers: Attacks and Defenses|url=https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-silver.pdf|accessdate=26 July 2015}}</ref>

==Prevention==

===Client-side===

====NoScript====
Protection against clickjacking (including likejacking) can be added to [[Mozilla Firefox]] desktop and mobile<ref>{{cite web|url=https://noscript.net/nsa/|title=NoScript Anywhere |author=Giorgio Maone |date=24 June 2011|publisher=hackademix.net|accessdate=2011-06-30}}</ref> versions by installing the [[NoScript]] add-on: its ClearClick feature, released on 8 October 2008, prevents users from clicking on invisible or "redressed" page elements of embedded documents or applets.<ref>{{cite web|url=https://hackademix.net/2008/10/08/hello-clearclick-goodbye-clickjacking/ |title=Hello ClearClick, Goodbye Clickjacking |author=Giorgio Maone |date=8 October 2008|publisher=hackademix.net|accessdate=2008-10-27}}</ref> According to Google's "Browser Security Handbook" from year 2008, NoScript's ClearClick is "the only freely available product that offers a reasonable degree of protection" against Clickjacking.<ref name="Zalevski">{{cite web|url=https://code.google.com/p/browsersec/wiki/Part2#Arbitrary_page_mashups_(UI_redressing) |title=Browser Security Handbook, Part 2, UI Redressing|author=Michal Zalevski |date=10 December 2008|publisher=Google Inc.|accessdate=2008-10-27}}</ref> Protection from the newer cursorjacking attack was added to NoScript 2.2.8 RC1.<ref name="Kotowicz" />

====GuardedID====
GuardedID (a commercial product) includes client-side clickjack protection for users of Internet Explorer and Firefox<ref>{{cite web|url=https://ha.ckers.org/blog/20090204/clickjacking-and-guardedid/ |title=Clickjacking and GuardedID ha.ckers.org web application security lab |author=Robert Hansen |date=4 February 2009 |accessdate=2011-11-30}}</ref> without interfering with the operation of legitimate iFrames. GuardedID clickjack protection forces all frames to become visible.

====Gazelle====
[[Gazelle (web browser)|Gazelle]] is a [[Microsoft Research]] project secure web browser based on IE, that uses an [[Operating System|OS]]-like security model, and has its own limited defenses against clickjacking.<ref>{{cite web
  | last =  Wang | first = Helen J.
  | authorlink = Helen J. Wang
  | last2 = Grier     | first2 = Chris
  | last3 = Moschchuk | first3 = Alexander
  | last4 = King      | first4 = Samuel T.
  | last5 = Choudhury | first5 = Piali
  | last6 = Venter    | first6 = Herman
  | title = The Multi-Principal OS Construction of the Gazelle Web Browser
  | publisher = 18th Usenix Security Symposium, Montreal, Canada
  | date = August 2009
  | url = https://research.microsoft.com/en-us/um/people/helenw/papers/gazelleSecurity09.pdf
  | accessdate = 2010-01-26}}</ref> In Gazelle, a window of different origin may only draw dynamic content over another window's screen space if the content it draws is opaque.

===Server-side===

====[[Framekiller]]====
Web site owners can protect their users against UI redressing (frame based clickjacking) on the server side by including a [[framekiller]] JavaScript snippet in those pages they do not want to be included inside frames from different sources.<ref name="Zalevski" />

Such JavaScript-based protection, unfortunately, is not always reliable. This is especially true on Internet Explorer,<ref name="Zalevski" /> where this kind of countermeasure can be circumvented "by design" by including the targeted page inside an <IFRAME SECURITY=restricted> element.<ref name="hackademix2">{{cite web|url=https://hackademix.net/2009/01/27/ehy-ie8-i-can-has-some-clickjacking-protection/ |title=Hey IE8, I Can Has Some Clickjacking Protection |author=Giorgio Maone |date=27 October 2008|publisher=hackademix.net|accessdate=2008-10-27}}</ref>

====X-Frame-Options====
Introduced in 2009 in [[Internet Explorer]] 8 was a new HTTP header <code>X-Frame-Options</code> which offered a partial protection against clickjacking<ref>{{cite web|url=https://blogs.msdn.com/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx |title=IE8 Security Part VII: ClickJacking Defenses |author=Eric Lawrence |date=27 January 2009 |accessdate=2010-12-30}}</ref><ref>{{cite web|url=https://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx |title=Combating ClickJacking With X-Frame-Options |author=Eric Lawrence |date=30 March 2010 |accessdate=2010-12-30}}</ref> and was shortly after adopted by other browsers ([[Safari (web browser)|Safari]],<ref>{{cite web|url=https://blogs.zdnet.com/security/?p=3541 |title=Apple Safari jumbo patch: 50+ vulnerabilities fixed |author=Ryan Naraine |date=8 June 2009 |accessdate=2009-06-10}}</ref> [[Firefox]],<ref>https://developer.mozilla.org/en/The_X-FRAME-OPTIONS_response_header The X-Frame-Options response header&nbsp;— MDC</ref> [[Google Chrome|Chrome]],<ref>{{cite web|url=https://blog.chromium.org/2010/01/security-in-depth-new-security-features.html |title=Security in Depth: New Security Features |author=Adam Barth |date=26 January 2010 |accessdate=2010-01-26}}</ref> and [[Opera (web browser)|Opera]]<ref>{{cite web|url=https://www.opera.com/docs/specs/presto26/#network|title=Web specifications support in Opera Presto 2.6|date=12 October 2010|accessdate=2012-01-22}}</ref>). The header, when set by website owner, declares its preferred framing policy: values of <tt>DENY</tt>, <tt>SAMEORIGIN</tt>, or <tt>ALLOW-FROM ''origin''</tt> will prevent any framing, framing by external sites, or allow framing only by the specified site, respectively. In addition to that, some advertising sites return a non-standard <tt>ALLOWALL</tt> value with the intention to allow framing their content on any page (equivalent of not setting X-Frame-Options at all).

In 2013 the X-Frame-Options header has been officially published as RFC 7034,<ref>{{cite web|url=https://www.rfc-editor.org/rfc/rfc7034.txt |title=HTTP Header Field X-Frame-Options |year=2013 |publisher=IETF}}</ref> but is not an internet standard. The document is provided for informational purposes only.

====Content Security Policy====
The <code>frame-ancestors</code> directive of [[Content Security Policy]] (introduced in version 1.1) can [[Whitelist|allow]] or disallow embedding of content by potentially hostile pages using iframe, object, etc. This directive obsoletes the X-Frame-Options directive. If a page is served with both headers, the frame-ancestors policy should be preferred by the browser.<ref name="Content Security Policy Level 2">{{cite web |url=https://www.w3.org/TR/CSP11/#frame-ancestors-and-frame-options |title=Content Security Policy Level 2 |website=w3.org |accessdate=2015-01-29 |date=2014-07-02}}</ref>—although some popular browsers disobey this requirement.<ref name="Clickjacking Defense Cheat Sheet">
{{cite web |url=https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet |title=Clickjacking Defense Cheat Sheet |accessdate=2016-01-15}}</ref>

Example frame-ancestors policies:
<pre>
# Disallow embedding. All iframes etc. will be blank, or contain a browser specific error page.
Content-Security-Policy: frame-ancestors 'none'

# Allow embedding of [[same-origin policy|own content]] only.
Content-Security-Policy: frame-ancestors 'self'

# Allow specific origins to embed this content
Content-Security-Policy: frame-ancestors example.com wikipedia.org
</pre>

==See also==
* [[Browser security]]
* [[Internet security]]
* [[Internet safety]]
* [[Hacker (computer security)]]
* [[Cross-site scripting]]
* [[Phishing]]
* [[Ghostery]]
* [[Social jacking]]

==References==
{{Reflist|2}}

==External links==
* [https://www.sectheory.com/clickjacking.htm Original paper on clickjacking]

{{Prone to spam|date=November 2014}}
{{Z148}}<!--     {{No more links}}

       Please be cautious adding more external links.

Wikipedia is not a collection of links and should not be used for advertising.

     Excessive or inappropriate links will be removed.

 See [[Wikipedia:External links]] and [[Wikipedia:Spam]] for details.

If there are already suitable links, propose additions or replacements on
the article's talk page, or submit your link to the relevant category at
DMOZ (dmoz.org) and link there using {{Dmoz}}.

-->
{{Scams and confidence tricks}}
{{Malware}}

[[Category:Hacking (computer security)]]
[[Category:Computing culture]]
[[Category:Web security exploits]]
[[Category:Social engineering (computer security)]]