UPDATED: Browser-Makers Seek Clickjacking Fix

What is clickjacking? Security pros are trying to make sense of a new bug found by researchers that apparently affects various Web browsers, including Microsoft's Internet Explorer.

The new threat, revealed late last week by SecTheory LLC CEO Robert Hansen and Jeremiah Grossman, WhiteHat's chief technology officer, is being called "clickjacking." According to these researchers, clickjacking happens when users are directed to malicious Web sites where hackers lay in wait to take control of a user's browser profile.

The clickjacking technique "gives an attacker the ability to trick a user into clicking on something only barely or momentarily noticeable," explained a warning on the homepage of the United States Computer Emergency Readiness Team, or CERT. "Therefore, if a user clicks on a web page, they may actually be clicking on content from another page."

The vulnerability reportedly can affect multiple browsers and even Web applications, such as Adobe's Flash. Browsers at risk include Internet Explorer, Mozilla Firefox, Apple's Safari, Opera and Google's new Chrome browser, which altogether constitute more than 95 percent of browser market share, according to Aliso Viejo-Calif.-based Net Applications.

"It's pretty pervasive," said Ryan Naraine, an IT security analyst at U.K.-based Kaspersky Lab. "[The exploit] attacks a fundamental flaws in the way most browsers work, and cannot be fixed with a simple patch."

Moreover, a hacker doesn't need access to a trusted Web site to roll out a clickjack, the researchers say. It's not so much a Web site security issue; rather, it's something that browser vendors need to fix.

Hansen and Grossman were slated to expound on the threat and its implications at last week's OWASP NYC AppSec 2008 Conference. They postponed their conference talk on the vulnerability at the request of Adobe and other "affected vendors," which wanted to wait until a systemic workaround or hotfix could be applied.

Apple and Google have yet to comment on the threat. However, Mozilla on Monday released updates to its Thunderbird v2.0.0.17 e-mail application and Firefox v3.0.3 Web browser in an effort to "address multiple vulnerabilities." The updates are designed to prevent hackers from executing "arbitrary code," stealing personal information, undertaking cross-site scripting and denial of service attacks as well as clickjacking.

Experts say that NoScript, a security add-on to Firefox that blocks JavaScript execution, is designed to defend against most attack scenarios.

Hansen and Grossman said on Friday that they plan to release their research and a proof-of-concept exploit but won't do so until Adobe issues a patch.

A Microsoft spokesperson released a statement about clickjacking by e-mail.

"Microsoft is investigating the new public claims of a possible vulnerability in Internet Browsers and is in dialog with the researcher(s)," the e-mail stated. "Microsoft is currently unaware of any attacks trying to use the claimed vulnerability or of customer impact and the company will take steps to determine how customers can protect themselves should they confirm the vulnerability."

If an action is necessary, Microsoft would release a security update through its monthly patch cycle or an "out-of-cycle update," the spokesperson added.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.


  • Microsoft Nabs IoT Platform Provider Express Logic

    As part of its plan to invest $5 billion in IoT technologies, Microsoft this week acquired Express Logic, which provides real-time operating systems for industrial embedded and IoT devices.

  • Dealing with Broken Dependencies in SCVMM

    Brien shows you how to resolve some broken, template-related dependencies in Microsoft's System Center Virtual Machine Manager.

  • AzCopy Preview Adds AWS S3 Data Transfer Improvements

    Microsoft announced this week that it has improved the preview version of its AzCopy tool to better handle Amazon Web Services (AWS) S3 data.

  • Microsoft Adding Google G Suite Migration in Exchange Admin Center

    Microsoft's Exchange Admin Center will be getting the ability to move Google G Suite calendar, contacts and e-mail data over to the Office 365 service "in the coming weeks."

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.