Clickjacking allows
an attacker to trick your users into clicking parts of your interface without
their consent. A simple way to describe describe this is, an attacker will embed
your application in their site as an iframe. On top of the iframe they can
show a completely different interface. You're thinking you're clicking buttons
on your own interface, while in fact you are hitting the 'Delete my account'
button in for example GMail.
Because this technique completely operates with frames, it can be
circumvented by using a 'Frame busting' technique. As a bonus, this will also
disallow for example Digg to steal and monetize your content.
Frame busting can be achieved with a simple javascript technique:
- <script type="text/javascript">
- if (top !== self) top.location.replace(self.location.href);
- </script>
Security through javascript?
If you think this sounds like a bad idea, you are probably right. Users might
simply have javascript disabled, and I also don't like relying on UI developers
too much to implement preventive security measures (although I realize in most
cases you do have to).
In Internet Explorer the situation is worse, IE allows you to specify the
non-standard attribute security="restricted":
- <iframe src="http://www.rooftopsolutions.nl/ security="restricted"></iframe>
This attribute tells IE to not allow executing of javascript in the iframe,
which actually is not a bad security measure for other types of attacks. In this
case however, it allows the attacker to disable the framebusting script.
X-Frame-Options
Thankfully, Internet Explorer 8 introduces a new feature that allows the site
owner to disallow frames altogether, which is in my opinion an even better
protection mechanism, because it doesn't rely on javascript to be executed.
The name of the http header is specified as such:
- X-FRAME-OPTIONS: SAMEORIGIN
- X-FRAME-OPTIONS: DENY
You only have to specify one of these two, 'sameorigin' means the page
can only be framed from an html page hosted on the same domain, deny will
kill framing altogether.
PHP example:
- <?php
- header('X-FRAME-OPTIONS: DENY');
- ?>
Firefox also appears to
have started implementing this feature, and there's afeature request for
webkit open as well.
Protecting yourself
Unfortunately you can safely assume most sites don't implement either of
these security measures. For firefox users I would therefore strongly recommend
using the NoScript plugin. Not only
does it implement the X-FRAME-OPTIONS for firefox, it also actively detects
clickjacking attempts.
Reference: hackademix.net
