CLICKJACKINGSecurity Nightmare

Jeremiah Grossman (Whitehat Security)

Robert Hansen(SecTheory)

2008

also known as a "UI redress attack"

…is a malicious technique of tricking a web user…

…into clicking on something different… from what the user perceives they are clicking on

12 cases

+ Browser+ Plug-in+ Website

NOT ALL

<iframe>opacity & z-index

My page (malicious page)w3schools.com

<iframe src=http://www.w3schools.com></iframe>

opacity: 1;z-index: 0;

opacity: 0.5;z-index: 1;

Server side

• X-Frame-Options

• Framebuster

Client side

• No-Script

Header append X-Frame-Options “DENY”

Framebuster

No-Scripts add-on