Clickjacking.pdf

(1907 KB) Pobierz

CS 361S

Clickjacking

Vitaly Shmatikov

Reading Assignment

“Next

Generation Clickjacking”

“Clickjacking:

Attacks and Defenses”

slide 2

Clickjacking (UI Redressing)

[Hansen and Grossman 2008]

Attacker

overlays multiple transparent or

opaque frames to trick a user into clicking on a

button or link on another page

Clicks

meant for the visible page are hijacked

and routed to another, invisible page

slide 3

Clickjacking in the Wild

Google

search for “clickjacking” returns 624,000

results… this is not a hypothetical threat!

Summer

2010: Facebook worm superimposes

an invisible iframe over the entire page that

links back to the victim's Facebook page

•

If victim is logged in, automatically recommends link

to new friends as soon as the page is clicked on

Many

clickjacking attacks against Twitter

•

Users send out tweets against their will

slide 4

Clickjacking Meets Spamming

slide 5