Thread: ClickJacking in a new way

Tweet

Hi All,

Clickjacking is one of the client side attacks which renders vulnerable action from target site in invisible/partially visible iframe. The attacker lures the victim to click on the button or link. These buttons or links are actully placed on top of vulnerable actions from target site.

The proposed mitigations for these types of attacks are:
X-Frame-Options
Frame Bursting Code

Michal Zalewski has come up with a new way to perform clickjacking attacks even target site is protected using above mentioned mitigations.

From his Full Disclosure post:
"The basic idea here is that instead of placing the UI you want to tamper with in an invisible or only partly-visible <iframe>, you can achieve a similar effect simply by predicting the time of a premeditated click (which is fairly easy if you look at mouse velocity and distance to the expected destination), and then either destroying the current window, or navigating to a different document (in this case, a cheesy banking site)."

Check PoC:
http://lcamtuf.coredump.cx/clickit/

Cheers,
AMol NAik