• Abstract and Figures
• Public Full-text

A Solution for the Automated Detection of Clickjacking Attacks Marco Balduzzi Manuel Egele Institute Eurecom Technical University Vienna Sophia-Antipolis [email protected] [email protected] Engin Kirda Davide Balzarotti Christopher Kruegel Institute Eurecom Institute Eurecom University of California Sophia-Antipolis Sophia-Antipolis Santa Barbara [email protected] [email protected] [email protected] ABSTRACT 1. INTRODUCTION Clickjacking is a web-based attack that has recently received Web applications have evolved from simple collections of a wide media coverage. In a clickjacking attack, a malicious static HTML documents to complex, full-fledged applica- page is constructed such that it tricks victims into clicking tions containing hundreds of dynamically generated pages. on an element of a different page that is only barely (or not The combined use of client and server-side scripting allows at all) visible. By stealing the victim’s clicks, an attacker developers to provide highly sophisticated user interfaces could force the user to perform an unintended action that is with the look-and-feel and functionalities that were previ- advantageous for the attacker (e.g., initiate an online money ously only reserved to traditional desktop applications. At transaction). Although clickjacking has been the subject the same time, many web applications have evolved into of many discussions and alarming reports, it is currently mesh-ups and aggregation sites that are dynamically con- unclear to what extent clickjacking is being used by attackers structed by combining together content and functionalities in the wild, and how significant the attack is for the security provided by different sources. This rapid evolution, com- of Internet users. bined with the increasing amount of sensitive information In this paper, we propose a novel solution for the auto- that is now accessible through the web, has brought a corre- mated and efficient detection of clickjacking attacks. We sponding increase in the number and sophistication of web- describe the system that we designed, implemented and de- based attacks and vulnerabilities. ployed to analyze over a million unique web pages. The The same origin policy, first introduced in Netscape Nav- experiments show that our approach is feasible in practice. igator 2.0 [31], is still the keystone around which the entire Also, the empirical study that we conducted on a large num- security of cross-domain applications is built. The main idea ber of popular websites suggests that clickjacking has not yet is to implement a set of mechanisms in the browser that been largely adopted by attackers on the Internet. enforce a strict separation between different sources. This separation is achieved by preventing the interaction between pages that are from different origins (where the origin of a Categories and Subject Descriptors page is usually defined as a combination of the domain name, K.6.5 [Management of Computing and Information the application layer protocol, and the TCP port number). Systems]: Security and Protection The same origin policy, hence, can guarantee that cookies and JavaScript code from different websites can safely co- exist in the user’s browser. General Terms Unfortunately, attackers, often driven by a flourishing un- Security, Design, Experimentation derground economy, are constantly looking for exceptions, browser bugs, or corner cases to circumvent the same origin checks with the aim of stealing or modifying sensitive user Keywords information. One of these techniques, previously known as Clickjacking, Web Security, ClickIDS, HTML IFRAME, CSS, UI Redress [40], has recently gained increasing attention un- Javascript, Browser Plug-In der the new, appealing name of clickjacking. Since Robert Hansen and Jeremiah Grossman announced a talk on the topic at OWASP AppSec 2008 [20], there has been a flood of news, discussions, and demonstrations on clickjacking. Permission to make digital or hard copies of all or part of this work for The idea behind a clickjacking attack is simple: A mali- personal or classroom use is granted without fee provided that copies are cious page is constructed such that it tricks users into click- not made or distributed for profit or commercial advantage and that copies ing on an element of a different page that is only barely, or bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific not at all noticeable. Thus, the victim’s click causes uninten- permission and/or a fee. tional actions in the context of a legitimate website. Since ASIACCS’10 April 13–16, 2010, Beijing, China. it is the victim who actually, but unknowingly, clicks on the Copyright 2010 ACM 978-1-60558-936-7 ...$10.00. element of the legitimate page, the action looks “safe” from of a page, while her intention is to interact with the con- the browser’s point of view; that is, the same origin policy tent of a different site. That is, even though the victim is is not violated. under the impression of clicking on a seemingly harmless Clickjacking attacks have been reported to be usable in page, she is actually clicking on an element of the attacker’s practice to trick users into initiating money transfers, click- choice. The typical scenario, as described by Grossman and ing on banner ads that are part of an advertising click fraud, Hansen [16], involves two different websites: A target site posting blog or forum messages, or, in general, to perform T , and a malicious site M. any action that can be triggered by a mouse click. T is a website accessible to the victim and important for Beside several proof-of-concept clickjacking examples that the attacker. Such sites include, for example, online-banking have been posted on security-related blogs, it is not clear to portals, auction sites, and web mail services. The goal of the what extent clickjacking is used by attackers in practice. attacker is to lure the victim into unsuspectingly clicking on To the best of our knowledge, there has only been a single, elements of the target page T . large-scale real-world clickjacking attack, where the attack M, on the other hand, is under control of the attacker. was used to spread a message on the Twitter network [24]. Commonly, this page is created in a way so that a trans- We describe this attack in more detail in Section 2. parent IFRAME containing T overlays the content of M. In this paper, we present a novel approach to detect click- Since the victim is not aware of the invisible IFRAME, by jacking attempts. By using a real browser, we designed and correctly aligning T over M, an attacker can lure the victim developed an automated system that is able to analyze web into clicking elements in T , while she is under the impres- pages for clickjacking attacks. We conducted an empirical sion of clicking on M. A successful clickjacking attack, for study on over one million unique Internet web pages. The example, might result in the victim deleting all messages experiments we conducted show that our system works well from her web mail inbox, or generating artificial clicks on in practice. advertisement banners. Our solution can be adopted by security experts to au- Figure 1 shows a real-world clickjacking attack that has tomatically test a large number of websites for clickjacking. been used to propagate a message among Twitter users [24]. Moreover, the clickjacking plug-in we developed can be in- In this attack, the malicious page embeds Twitter.com on a tegrated into a standard browser configuration in order to transparent IFRAME. The status-message field is initialized protect normal users from clickjacking during their daily In- with the URL of the malicious page itself. To provoke the ternet use. click, which is necessary to publish the entry, the malicious To the best of our knowledge, we are the first to conduct a page displays a button labeled “Don’t Click.” This button is large-scale study of the clickjacking problem, and to propose aligned with the invisible “Update” button of Twitter. Once a novel system for the automated testing, and detection of the user performs the click, the status message (i.e., a link the attack. Our paper provides a first insight into the cur- to the malicious page itself) is posted to her Twitter profile. rent prevalence of clickjacking attempts on the Internet. While clickjacking attacks can be performed in plain HTML, the use of JavaScript can be used to create more The main contributions of this paper are as follows: sophisticated attacks. For instance, JavaScript allows the attacker to dynamically align the framed content with the • We present our automated approach to detect click- jacking attacks. user’s mouse cursor, thus making it possible to perform at- tacks that require multiple clicks. • We describe the ClickIDS browser plug-in we devel- Note that manipulating the frame’s opacity level (e.g., oped, and the system we deployed to analyze more making it transparent) is not the only way to mount a click- than a million unique Internet web pages. jacking attack. A click can also be “stolen” by covering the frame containing the victim page with opaque elements, and • We present a first, large-scale attempt to estimate the then leaving a small hole aligned with the target element on prevalence of clickjacking attacks on the Internet. the underlying page. Another possible approach consists of resizing and/or moving the IFRAME in front of the mouse • We assess to what extent clickjacking defense tech- just before the user performs a click. niques have been adopted by examining thousands of Unlike other common web vulnerabilities such as cross- popular websites.

Load more

  10

Copy Link