DOCSLIB.ORG

Procedures for Detecting Cybercrime Activities on Websites

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Procedures for Detecting Cybercrime Activities on Websites The correction belongs to the author. © 2017 Sitech Publishing, Craiova All rights reserved. This book is protected by copyright. No part of this book may be reproduced in any form or by any means, including photocopying or utilized any information storage and retrieval system without written permission from the copyright owner. SITECH Publishing is part of the list of prestigious Romanian publishing houses recognized by CNATDCU, for Panel 4, which includes the fields: legal sciences, sociological sciences, political and administrative sciences, communication sciences, military sciences, information and public order, economics sciences and business administration, psychological sciences, education sciences, physical education and sport. Editura SITECH Craiova, România Aleea Teatrului, nr. 2, Bloc T1, parter Tel/fax: 0251/414003 E-mail: [email protected] ISBN 978-606-11-6119-5 2 ABSTRACT The research “Procedures for Detecting Cybercrime Activities on Websites” aims to analyze the procedures for detecting the cybercrime activities on the websites compromised by cybercriminals. The research intends to emphasize the importance of cyberspace security and to propose methods to mitigate the cyber-attacks effects. The specific objectives of the research are identification and classification of websites vulnerabilities, analysis of cyber-attacks evolution and structure, identification of best practices for cyber-attacks prevention and mitigation, improving methods for monitoring websites security, identifying methods for alerting websites owners in case of detection of intrusion or infection with malware, and enhancing cooperation between institutions involved in cyberspace security by providing procedures for preventing cyber-attacks and mitigating their effects. The actuality of this research is determined by developing a study on the cybercrime activities on compromised websites for improving cyber-attacks detection capability and defining procedures for monitoring the cyberspace security. The added value of the research is given by the strategies analysis for remote monitoring of the websites security and the alerting methods of the administrators in case of detection of cybercrime activities, leading to a better protection of the cyber infrastructures and the maintenance of a secure cyberspace. 3 The research website, necessary for the visibility and the promotion of the results, is hosted on web-scan.eu domain. The purpose of this platform is to promote the procedures for detecting cybercrime activities on websites. Keywords: cybercrime, cyber-attacks, cybersecurity, cyberspace, website scanner 4 TABLE OF CONTENTS LIST OF ABBREVIATIONS AND ACRONYMS ...................................... 8 CHAPTER I INTRODUCTION ......................................................................................... 11 1.1. Objectives of the research ................................................................... 11 1.2. The background to the research .......................................................... 11 1.3. Structure of the research report ........................................................... 14 CHAPTER II THE STUDY OF CYBER-ATTACKS ....................................................... 17 2.1. Evolution of cyber-attacks .................................................................. 17 2.2. Classification of cyber-attacks ............................................................ 19 2.3. Structure of cyber-attacks ................................................................... 23 2.3.1. The Cyber Kill Chain intrusion model ....................................... 23 2.3.2. Cyber-attacks analysis ................................................................ 25 2.3.3. Study of cyber-attack vectors ..................................................... 32 2.4. Methods to prevent cyber-attacks ....................................................... 35 2.5. Conclusions ......................................................................................... 37 5 CHAPTER III MONITORING WEBSITES SECURITY .................................................. 39 3.1. Developing an attack tree .................................................................... 39 3.1.1. The structure of an attack tree ..................................................... 40 3.1.2. Developing an attack tree for websites ....................................... 42 3.2. Analysis of the impact of cyber-attacks .............................................. 46 3.2.1. Vulnerabilities of websites .......................................................... 46 3.2.2. Impact of cyber-attacks on the websites ..................................... 49 3.3. Monitoring websites security .............................................................. 51 3.3.1. Intrusion detection ...................................................................... 51 3.3.2. Malware detection ....................................................................... 54 3.3.3. Suspicious activities detection .................................................... 55 3.4. Methods to alert the platform administrators ...................................... 61 3.5. Conclusions ......................................................................................... 62 CHAPTER IV DEVELOPING THE RESEARCH WEBSITE .......................................... 64 4.1. The website aims and objectives ......................................................... 64 4.2. The website structure .......................................................................... 65 4.3. Integration of the monitoring procedures into an app ........................ 66 4.4. Conclusions ......................................................................................... 71 6 CHAPTER V CONCLUSIONS ............................................................................................ 73 5.1. The main issues presented in the research .......................................... 73 5.2. Original contributions to the research ................................................. 75 5.3. Methods of data collection and analysis ............................................. 75 5.4. Perspectives for further development ................................................. 77 REFERENCES .............................................................................................. 79 7 LIST OF ABBREVIATIONS AND ACRONYMS A AES – Advanced Encryption Standard API – Application Programming Interface APT – Advanced Persistent Threats C CERT-RO – Romanian National Computer Incident Response Team CSRF – Cross-Site Request Forgery D DDoS – Distributed Denial of Service DNS – Domain Name System DoS – Denial of Service H HTML – Hyper Text Markup Language I ICMP – Internet Control Message Protocol IDS – Intrusion Detection System IP – Internet Protocol IRC – Internet Relay Chat 8 L LDAP – Lightweight Directory Access Protocol M MAC – Media Access Controller MBR – Master Boot Record O OWASP – Open Web Application Security Project P PDF – Portable Document Format PHP – Hypertext Preprocessor PSK – Pre-Shared Key R RAISA – Romanian Association for Information Security Assurance RDoS – Ransom Denial of Service RAM – Random Access Memory S SHA2 – Secure Hash Algorithm 2 SMS – Short Message Service SQL – Structured Query Language SQLi – SQL Injection SSID – Service Set Identifier T TCP – Transmission Control Protocol 9 U UDP – User Datagram Protocol URL – Uniform Resource Locator USB – Universal Serial Bus W WAF – Web Application Firewall WPA2 – Wi-Fi Protected Access 2 X XPath – XML Path Language XSS – Cross Site Scripting 10 CHAPTER I INTRODUCTION 1.1. Objectives of the research The research project “Procedures for Detecting Cybercrime Activities on Websites” aims to detect the cybercrime activities on websites compromised by cyber criminals. The research intends to emphasize the importance of online environment safety and to propose procedures to mitigate the cyber-attacks effects in the cyberspace. The specific objectives of the project are: - Identification and classification of computer vulnerabilities; - Analysis of cyber-attacks evolution and structure; - Identification of good practices on cyber-attacks prevention and mitigation; - Improving methods for monitoring websites security; - Identifying methods of alerting websites owners in case of detection of intrusion or infection with malware; - Enhancing cooperation between institutions involved in cyberspace security by providing procedures for preventing cyber-attacks and mitigate their effects. 1.2. The background to the research The online environment, which is in a continuous process of evolution, is generating both solutions for the development of the information society, as well 11 as risks related to its activities. The computer vulnerabilities that can be exploited by cyber criminals, makes cybersecurity a major concern. From this perspective, at the national level, steps have been taken to adopt new policies on the fight against the phenomenon of computer-related. In Romania, The Cybersecurity Strategy1 was adopted in 2013 in order to define and maintain a secure virtual environment, with a high degree of safety and reliability. This Strategy proposes regulatory and institutional framework to the dynamics of environmental threats, the establishment and application of minimal security requirements for national information infrastructures, ensuring their resilience and the development of cooperation at national and international levels. Implementation of the Romanian Cybersecurity
Load more

Recommended publications
  • Clickjacking
    Security Now! Transcript of Episode #168 Page 1 of 18 Transcript of Episode #168 ClickJacking Description: Steve and Leo discuss yet another challenge to surfing safely in the web world: Known as "ClickJacking," or more formally as "UI Redressing," this class of newly popular threats tricks web users into performing web-based actions they don't intend by leading them to believe they are doing something else entirely. High quality (64 kbps) mp3 audio file URL: http://media.GRC.com/sn/SN-168.mp3 Quarter size (16 kbps) mp3 audio file URL: http://media.GRC.com/sn/sn-168-lq.mp3 INTRO: Netcasts you love, from people you trust. This is TWiT. Leo Laporte: Bandwidth for Security Now! is provided by AOL Radio at AOL.com/podcasting. This is Security Now! with Steve Gibson, Episode 168 for October 30, 2008: Clickjacking. It's time for Security Now!, the show where we cover everything you'd ever want to know about security. And we do it with a guy who is the king, really, as far as I'm concerned, the man who discovered spyware, named spyware, wrote some of the most used security utilities out there, including ShieldsUP!, Mr. Steve Gibson of GRC.com. Hi, Steve. Steve Gibson: Yes, in fact sometimes we're discussing things that you'd rather wish weren't the case. I mean... Leo: Well, lately it's been kind of bleak because it's like, there's bad stuff, and there doesn't really seem like there's any cure. Steve: Yes, that's true.
    [Show full text]
  • Flipping 419 Cybercrime Scams: Targeting the Weak and the Vulnerable
    Flipping 419 Cybercrime Scams: Targeting the Weak and the Vulnerable Gibson Mba Jeremiah Onaolapo Royal Holloway University College London University of London Gianluca Stringhini Lorenzo Cavallaro University College London Royal Holloway University of London ABSTRACT ans living in Nigeria. While the long history and advanced Most of cyberscam-related studies focus on threats perpe- use of Information and Communication Technology (ICT) trated against the Western society, with a particular atten- in the Western societies justify the large body of literature tion to the USA and Europe. Regrettably, no research has dealing with its misuse, the absence of detailed studies on been done on scams targeting African countries, especially other regions, such as Africa, creates the impression that Nigeria, where the notorious and (in)famous 419 advanced- these societies are immune from cyber attacks. On the con- fee scam, targeted towards other countries, originated. How- trary, there is more happening out there that has not been ever, as we know, cybercrime is a global problem affecting brought to the attention of the concerned public. Our study all parties. In this study, we investigate a form of advance aims at bridging this gap, i.e., the paucity of African unique fee fraud scam unique to Nigeria and targeted at Nigerians, contribution to the global cybercrime, by studying in de- but unknown to the Western world. For the study, we rely tail a form of 419 (advance fee fraud) scam unknown to the substantially on almost two years worth of data harvested West but unique to Africa|Nigeria in particular|targeted from an online discussion forum used by criminals.
    [Show full text]
  • A Semi-Automated Security Advisory System to Resist Cyber-Attack in Social Networks
    A Semi-Automated Security Advisory System to Resist Cyber-attack in Social Networks Samar Muslah Albladi and George R S Weir University of Strathclyde, Glasgow G1 1XH, UK {samar.albladi; george.weir}@strath.ac.uk Abstract. Social networking sites often witness various types of social engi- neering (SE) attacks. Yet, limited research has addressed the most severe types of social engineering in social networks (SNs). The present study in- vestigates the extent to which people respond differently to different types of attack in a social network context and how we can segment users based on their vulnerability. In turn, this leads to the prospect of a personalised security advisory system. 316 participants have completed an online-ques- tionnaire that includes a scenario-based experiment. The study result re- veals that people respond to cyber-attacks differently based on their de- mographics. Furthermore, people’s competence, social network experience, and their limited connections with strangers in social networks can decrease their likelihood of falling victim to some types of attacks more than others. Keywords: Advisory System, Social Engineering, Social Networks. 1 Introduction Individuals and organisations are becoming increasingly dependent on working with computers, accessing the World Wide Web and, more importantly, sharing data through virtual communication. This makes cyber-security one of today’s greatest issues. Pro- tecting people and organisations from being targeted by cybercriminals is becoming a priority for industry and academia [1]. This is due to the huge potential damage that could be associated with losing valuable data and documents in such attacks. Previous research focuses on identifying factors that influence people’s vulnerability to cyber-attack [2] as the human has been characterised as the weakest link in infor- mation security research.
    [Show full text]
  • Financial Fraud and Internet Banking: Threats and Countermeasures
    Report Financial Fraud and Internet Banking: Threats and Countermeasures By François Paget, McAfee® Avert® Labs Report Financial Fraud and Internet Banking: Threats and Countermeasures Table of Contents Some Figures 3 U.S. Federal Trade Commission Statistics 3 CyberSource 4 Internet Crime Complaint Center 4 In Europe 5 The Many Faces of Fraud 6 Small- and large-scale identity theft 7 Carding and skimming 8 Phishing and pharming 8 Crimeware 9 Money laundering 10 Mules 10 Virtual casinos 11 Pump and dump 12 Nigerian advance fee fraud (419 fraud) 12 Auctions 14 Online shopping 16 Anonymous payment methods 17 Protective Measures 18 Scoring 18 Europay, MasterCard, and Visa (EMV) standard 18 PCI-DSS 19 Secure Sockets Layer (SSL) and Transport Secured Layer (TLS) protocols 19 SSL extended validation 20 3-D Secure technology 21 Strong authentication and one-time password devices 22 Knowledge-based authentication 23 Email authentication 23 Conclusion 24 About McAfee, Inc. 26 Report Financial Fraud and Internet Banking: Threats and Countermeasures Financial fraud has many faces. Whether it involves swindling, debit or credit card fraud, real estate fraud, drug trafficking, identity theft, deceptive telemarketing, or money laundering, the goal of cybercriminals is to make as much money as possible within a short time and to do so inconspicuously. This paper will introduce you to an array of threats facing banks and their customers. It includes some statistics and descriptions of solutions that should give readers—whether they are responsible for security in a financial organization or a customer—an overview of the current situation. Some Figures U.S.
    [Show full text]
  • Hacks, Leaks and Disruptions | Russian Cyber Strategies
    CHAILLOT PAPER Nº 148 — October 2018 Hacks, leaks and disruptions Russian cyber strategies EDITED BY Nicu Popescu and Stanislav Secrieru WITH CONTRIBUTIONS FROM Siim Alatalu, Irina Borogan, Elena Chernenko, Sven Herpig, Oscar Jonsson, Xymena Kurowska, Jarno Limnell, Patryk Pawlak, Piret Pernik, Thomas Reinhold, Anatoly Reshetnikov, Andrei Soldatov and Jean-Baptiste Jeangène Vilmer Chaillot Papers HACKS, LEAKS AND DISRUPTIONS RUSSIAN CYBER STRATEGIES Edited by Nicu Popescu and Stanislav Secrieru CHAILLOT PAPERS October 2018 148 Disclaimer The views expressed in this Chaillot Paper are solely those of the authors and do not necessarily reflect the views of the Institute or of the European Union. European Union Institute for Security Studies Paris Director: Gustav Lindstrom © EU Institute for Security Studies, 2018. Reproduction is authorised, provided prior permission is sought from the Institute and the source is acknowledged, save where otherwise stated. Contents Executive summary 5 Introduction: Russia’s cyber prowess – where, how and what for? 9 Nicu Popescu and Stanislav Secrieru Russia’s cyber posture Russia’s approach to cyber: the best defence is a good offence 15 1 Andrei Soldatov and Irina Borogan Russia’s trolling complex at home and abroad 25 2 Xymena Kurowska and Anatoly Reshetnikov Spotting the bear: credible attribution and Russian 3 operations in cyberspace 33 Sven Herpig and Thomas Reinhold Russia’s cyber diplomacy 43 4 Elena Chernenko Case studies of Russian cyberattacks The early days of cyberattacks: 5 the cases of Estonia,
    [Show full text]
  • 2016 Wrap-Up Cybercrime Tactics and Techniques
    Cybercrime tactics and techniques 2016 wrap-up TABLE OF CONTENTS 01 Executive summary 02 Windows malware 05 Early 2017 Windows malware predictions 06 Mac malware 06 Early 2017 OS X malware predictions 07 Exploit kits 08 Early 2017 exploit kit predictions 09 Phishing and malspam 10 Early 2017 phishing and malspam predictions 11 Potentially Unwanted Programs 11 Early 2017 PUP predictions 12 Tech support scams 13 Early 2017 tech support scam predictions 14 Conclusion Introduction Last year was interesting for malware distribution and development. While we still experienced a flood of ransomware and immense distribution of malware using malspam/phishing/exploit kits, some major players, such as TeslaCrypt and Angler EK, vanished, while some new names dominated. In our first wrap-up of the threat landscape, we are going to cover the trends observed during the last few months of 2016, take an analyst’s view of the threats, and offer some predictions for the beginning of 2017. Moving forward, every quarter we will bring you a view of the threat landscape through the eyes of Malwarebytes researchers and analysts. Executive summary Ransomware dominated in 2016 and continued to do so However, it’s market share and capabilities are not quite into 2017. We expect to see very little variation in this at par with Angler, though this is likely going to change in early 2017, and if anything, it is getting worse. The as we expect to observe an increase in exploit kit most notable ransomware families of the end of 2016 activity by the middle of 2017. While late 2016 showed were Locky and Cerber, two very similar ransomware a decrease in the amount of malicious spam/phishing families that took the number one slot multiple times attacks targeting users in the wild, we are seeing greater during the last part of the year.
    [Show full text]
  • Clickjacking: Attacks and Defenses
    Clickjacking: Attacks and Defenses Lin-Shung Huang Alex Moshchuk Helen J. Wang Carnegie Mellon University Microsoft Research Microsoft Research [email protected] [email protected] [email protected] Stuart Schechter Collin Jackson Microsoft Research Carnegie Mellon University [email protected] [email protected] Abstract such as a “claim your free iPad” button. Hence, when Clickjacking attacks are an emerging threat on the web. the user “claims” a free iPad, a story appears in the user’s In this paper, we design new clickjacking attack variants Facebook friends’ news feed stating that she “likes” the using existing techniques and demonstrate that existing attacker web site. For ease of exposition, our description clickjacking defenses are insufficient. Our attacks show will be in the context of web browsers. Nevertheless, the that clickjacking can cause severe damages, including concepts and techniques described are generally applica- compromising a user’s private webcam, email or other ble to all client operating systems where display is shared private data, and web surfing anonymity. by mutually distrusting principals. We observe the root cause of clickjacking is that an Several clickjacking defenses have been proposed and attacker application presents a sensitive UI element of a deployed for web browsers, but all have shortcomings. target application out of context to a user (such as hiding Today’s most widely deployed defenses rely on frame- the sensitive UI by making it transparent), and hence the busting [21, 37], which disallows a sensitive page from user is tricked to act out of context. To address this root being framed (i.e., embedded within another web page).
    [Show full text]
  • A Case Study on Clickjacking Attack and Location Leakage
    International Journal of Scientific & Engineering Research, Volume 5, Issue 7, July-2014 190 ISSN 2229-5518 A Case Study on Clickjacking Attack and Location Leakage Lim Chin Nei, Loo Yow Cherng, Manmeet Mahinderjit Singh Abstract— The advanced in technologies such as mobile devices, GSP, WIFI, and 3G has encourage the information sharing using social media. The large amount of information shared on social media often lead to security issues which are unaware by the users. This information may include sensitive information such as a person’s name, location, relationship status and many more and can be dangerous if is put in a wrong hand. In this research, we provide a review on the type of social media ad what are the current threat in social media. We then focus on two specific threat namely clickjacking and location leakage, and proposed a solution for each of it as well as the evaluation of the solution. Index Terms—Security; Social media; Attack; Defense Machine, Clickjacking, Location leakage —————————— —————————— 1 INTRODUCTION This rapid shift of technologies in this era of informa- media. With this large amount of information shared online, tion and communication has dramatically boosted the usage the social media actually has become a perfect platform for of the social media. With the advanced in technologies such hackers to find their victims. The information shared using as smart mobile devices, GPS, WIFI, and 3G services, user social media often contain sensitive and private information were able to connect to the internet regardless of time and which can be easily compromised by the hackers.
    [Show full text]
  • Cisco 2017 Midyear Cybersecurity Report
    Cisco 2017 Midyear Cybersecurity Report 1 Executive Summary Table of Contents Executive Summary ..........................................................03 Vulnerabilities update: Rise in attacks following key disclosures ................................................................ 47 Major Findings ..................................................................05 Don’t let DevOps technologies leave the Introduction ......................................................................07 business exposed ............................................................ 50 Attacker Behavior .............................................................09 Organizations not moving fast enough to patch Exploit kits: Down, but not likely out ................................. 09 known Memcached server vulnerabilities ......................... 54 How defender behavior can shift attackers’ focus ...........11 Malicious hackers head to the cloud to shorten the path to top targets ..................................................... 56 Web attack methods provide evidence of a mature Internet ............................................................. 12 Unmanaged infrastructure and endpoints leave organizations at risk ......................................................... 59 Web block activity around the globe ................................ 13 Security Challenges and Opportunities Spyware really is as bad as it sounds............................... 14 for Defenders ...................................................................61
    [Show full text]
  • Financial Crime in the Twenty-First Century: the Rise of the Virtual Collar Criminal
    Financial crime in the twenty-first century: the rise of the virtual collar criminal REID, Alan <http://orcid.org/0000-0003-2019-5629> Available from Sheffield Hallam University Research Archive (SHURA) at: http://shura.shu.ac.uk/22836/ This document is the author deposited version. You are advised to consult the publisher's version if you wish to cite from it. Published version REID, Alan (2018). Financial crime in the twenty-first century: the rise of the virtual collar criminal. In: RYDER, Nic, (ed.) White collar crime and risk: Financial crime, corruption and the financial crisis. Palgrave Studies in Risk, Crime and Society . London, Palgrave Macmillan, 231-251. Copyright and re-use policy See http://shura.shu.ac.uk/information.html Sheffield Hallam University Research Archive http://shura.shu.ac.uk Financial crime in the 21st Century: The rise of the Virtual Collar Criminal Alan S Reid, Senior Lecturer in Law, Sheffield Hallam University Abstract This chapter introduces the phenomenon of virtual collar crime, that is quintessentially white collar crimes that are perpetrated entirely in cyberspace. Trust, trust dependency, high skill base criminals and opportunity zones were, and are, the hallmarks of white collar crime. The emerging paradigm of virtual collar crimes negates the requirement that perpetrators be highly skilled. Computer sagacity is no longer the sine qua non for cybercriminals - the phenomenon of 'Crime as a Service' has outsourced the skill requirement to third party providers of the required technological knowhow. Alongside the cascading down of such technical knowledge, twenty-first century society has driven headlong down the information superhighway, with hardly any area of human activity left unexposed to the effects of the ether.
    [Show full text]
  • Comparisons of Machine Learning Techniques for Detecting Malicious Webpages ⇑ H.B
    Expert Systems with Applications 42 (2015) 1166–1177 Contents lists available at ScienceDirect Expert Systems with Applications journal homepage: www.elsevier.com/locate/eswa Comparisons of machine learning techniques for detecting malicious webpages ⇑ H.B. Kazemian , S. Ahmed Intelligent Systems Research Centre, School of Computing, London Metropolitan University, United Kingdom article info abstract Article history: This paper compares machine learning techniques for detecting malicious webpages. The conventional Available online 16 September 2014 method of detecting malicious webpages is going through the black list and checking whether the web- pages are listed. Black list is a list of webpages which are classified as malicious from a user’s point of Keywords: view. These black lists are created by trusted organizations and volunteers. They are then used by modern K-Nearest Neighbor web browsers such as Chrome, Firefox, Internet Explorer, etc. However, black list is ineffective because of Support Vector Machine the frequent-changing nature of webpages, growing numbers of webpages that pose scalability issues Naive Bayes and the crawlers’ inability to visit intranet webpages that require computer operators to log in as authen- Affinity Propagation ticated users. In this paper therefore alternative and novel approaches are used by applying machine K-Means Supervised and unsupervised learning learning algorithms to detect malicious webpages. In this paper three supervised machine learning techniques such as K-Nearest Neighbor, Support Vector Machine and Naive Bayes Classifier, and two unsupervised machine learning techniques such as K-Means and Affinity Propagation are employed. Please note that K-Means and Affinity Propagation have not been applied to detection of malicious web- pages by other researchers.
    [Show full text]
  • UI Redressing and Clickjacking: About Click Fraud and Data Theft
    Introduction Attack vectors Counteractive measures Conclusion and outlook UI Redressing and Clickjacking: About click fraud and data theft Marcus Niemietz [email protected] Ruhr-University Bochum Chair for Network and Data Security 25th of November 2011 Marcus Niemietz, RUB @Zeronights UI Redressing and Clickjacking Introduction Attack vectors Counteractive measures Conclusion and outlook Short and crisp details about me Studying \IT-Security/Information Technology", RUB \Computer Science", Distance University Hagen B.Sc. in \IT-Security/Information Technology" Books Authentication Web Pages with Selenium ≥Feb. 2012: Clickjacking und UI-Redressing International speaker Work: RUB, Pixelboxx, ISP and IT-Security, Freelancer (trainings, penetration tests) Twitter: @mniemietz Marcus Niemietz, RUB @Zeronights UI Redressing and Clickjacking Introduction Attack vectors Counteractive measures Conclusion and outlook Contents 1 Introduction UI redressing Clickjacking 2 Attack vectors UI redressing Round up Clickjacking Tool 3 Counteractive measures Frame busting Busting frame busting Clickjacking statistics 4 Conclusion and outlook Marcus Niemietz, RUB @Zeronights UI Redressing and Clickjacking Introduction Attack vectors UI redressing Counteractive measures Clickjacking Conclusion and outlook Introduction Google Inc. can generate a profit of over $8.5 billion in 2010 Interesting for commercial companies to offer web applications shopping banking share status messages New attacks available that can bypass existing protection mechanisms CSRF
    [Show full text]