CLICKSAFE : PROVIDING SECURITY AGAINST CLICK JACKING ATTACKS Jawwad A. Shamsi #1 , Sufian Hameed #2, Waleed Rahman #3 , Farooq Zuberi #4 , Kaiser Altaf #5 , Ammar Amjad #6 #C.S Dept., National University of Computer and Emerging Sciences – Karachi Campus ST-4 Sector 17-D, on National Highway, Karachi, Pakistan (021) 111-128-128 [email protected] , [email protected] , [email protected] [email protected] , [email protected] , [email protected] Abstract – Clickjacking is an act of hijacking user clicks in which contained a link to the malicious website itself, is order to perform unintended actions that is advantageous for the posted on the user’s behalf. attacker. We propose Clicksafe, a browser-based tool to provide Clcikjacking can also be implemented by simply hiding increased security and reliability against clickjacking attacks. single UI elements, rather than the whole page in an IFRAME. Clicksafe is based on three major components. The detection unit Likejacking attacks [5] and Tapjacking attacks [6] are detects malicious components in a webpage that redirect users to examples of such link of attacks. While tapjacking is related external links. The mitigation unit provides interception of user to mobiles but since the main area of attack are browsers, clicks and give educated warnings to users who can then choose mobile are also susceptible to clickjacking type attacks. For to continue or not. Clicksafe also incorporate a feedback unit which records the user’s actions, converts them into ratings and finding a solution that will be applicable to all, our description allows future interactions to be more informed. Clicksafe is will be in the context of web browsers. Since, the concepts predominant from other similar tools as the detection and and solutions described are generally applicable to all client mitigation is based on a comprehensive framework which utilizes operating systems where display is shared by different pages. detection of malicious web components and incorporating user Many defences have been suggested for clickjacking for feedback. We explain the mechanism of clicksafe, describes its web browsers but they have all been circumvented by performance, and highlights its potential in providing safety malicious users. Mostly, the defence consists of frame busting against click jacking to a large number of users. [7], [8], which simply limits browser functionality by disallowing the IFRAME feature, but it does work as the Keywords - Clickjacking, Browser Security, Soft assurance of webpage cannot get framed over another webpage. But the safe browsing, Security, Safety. biggest problem with this technique is that it doesn’t work with third-party widgets, such as Facebook ‘Like’ button. There are other defences that have been suggested (Discussed I. INTRODUCTION in Section II), but most have been circumvented, or more Assurance of safety from clickjacking is significant for importantly can be circumvented later, and suffer from poor web users. Ensuring this safety requires extensive mechanism usability and incompatibility with webpages and widgets. of verification and validation against websites that hijack Clickjacking was still not properly addressed and prevented as users’ clicks in order to initiate a malicious action. of 2012 [9], as it was found out that some test attacks still had Clickjacking [1] is a very common attack through frames, an effectiveness of 98%. in which, the user unknowingly clicks on a malicious page During the course of our literature review we realized that that sits on top a benign page. This is usually done by loading the paper by Balduzzi [10] gave out the best mitigation results the malicious page as a transparent page over a benign page and was also the, most cited and authoritative result. One very that genuinely requires a click or some input (Like user login, important thing to realize here is that almost all of these send email, etc). When the user gives the input that was asked, techniques try to work before the user has clicked the an event is sent to the malicious page (usually a click event) clickjacked link and offer no support for the false negatives that causes dome undesirable action to be taken on the user’s that they can’t detect. So in effect, if these methods are behalf. Clickjacking is also referred to as UI redressing [3,4]. somehow circumvented then these methods become The most famous example of overlaying an invisible frame essentially useless. was the Clickjacking Tweet bomb [2]. In this attack, the Looking at the current defence techniques and some of malicious page embedded Twitter.com on a transparent their shortcomings, we kept the following objectives when IFRAME. The victim page enticed the user by placing a developing our own defence to clickjacking: ‘Don’t click’ button directly above the invisible ‘Tweet’ • Compatibility – Our solution shouldn’t break an old button. If the user clicked on the button, a status message, websites code and stop it from working properly. • Future proof: The solution should grow with time TABLE I rather than remain stagnant. LIST OF CLICKJACKING MITIGATION TECHNIQUES IN LITERATURE • Lightweight: The solution shouldn’t degrade the Clickjacking Mitigation Techniques Type of browser’s surfing speed performance. Technique • Low learning curve: Even the most naive users should be able to make use of the solution. Using the Same Origin Policy on a Website to Website Based • Extensible: The solution should have the potential to be avoid attacks applied to other browser vulnerabilities as well. HTTP X-Frame Options to enforce Same Browser + Website Origin Policy To achieve the above goals, we developed our solution, called Clicksafe, which recognizes the potential malicious UI Frame Busting of iframes JavaScript Code elements and then upon a ‘click’ on these, informs the user of (Website) the intent of that particular click. For a naive user, Clicksafe Disable onBeforeUnload event to ensure Browser based will have an option of recommendations based on previous frame busting user’s experience; the user’s next action will then extend the ratings of this particular URL by choosing to go through with Static Reference Bitmap on sensitive elements Browser + Website the click he made, or opting to stop the external redirection. We implemented a prototype of Clicksafe, as an add-on, on ClearClick (NoScript) Firefox Add-on Browser Add-on Mozilla Firefox Browser and found that it is very practical to use; depending upon the size of HTTP request, it added at FlashBlock Firefox Add-on Browser Add-on most 1s of delay for identifying a malicious click. In summary, we make the following key contributions in Opaque Overlay Policy to deliver all cross - Browser this paper: origin frames to be opaque • We provide a through sum-up of the current detection Disable windows switching via JavaScript Browser Add -on techniques which try to mitigate clickjacking attacks. Code We also try to list down the shortcomings of tools like ClearClick technique introduced by NoScript [11]. CSS checking (using position, size, opacity Browser Add-on • We present Clicksafe, a solution to clickjacking that and z-index) we developed, which works by incorporating Disable all JavaScript (NoScript) Browser Add-on clickjacking detection and user feedback to ensure that even the most naive of users can make an educated guess, when clicking on a malicious link. Disable cursor customization on sensitive Browser + elements Website The rest of the paper is structured as follows. Section 2 covers the latest Clickjacking protection mechanisms. In Screen Freezing on sensitive elements Browser + Section 3 we introduce our approach to counter clickjacking, Website Clicksafe, then we will evaluate it in Section 4. Finally, in Section 5, we conclude the paper by discussing the limitations Muting on sensitive elements Browser + Website of our solution and the future work that is needed to make it better. Lightbox/Greyout on sensitive elements Browser + Website II. BACKGROUND AND RELATED WORK UI Randomization Website In this section, we discuss the known defences of InContext Defence System to provide Browser + clickjacking, and compare them to our approach. One contextual integrity Website important thing to realize is that all of the techniques listed below, work before the actual click is done. Hence they offer Freezing of DOM to check on elements Browser Add-on no support if a false negative is made. Click jacking can be mitigated in a series of ways as shown below in Table 1. According to our study, all of these • Website code/script: These mitigation techniques are techniques can be classified into 3 categories based on how those that are implemented on the website where the the mitigation is being done: website is solely responsible for mitigation. Examples • Browser Add-on/Browser based: It refers to mitigation of such techniques include frame busting scripts [7], techniques that are solely based upon the browser or an [8] which disable iframes from employing add-on. In such a case, the browser itself is responsible for clickjacking. the mitigation of clickjacking. Examples of such add-ons • Website + Browser Code: This category represents a are NoScript [11] and FlashBlock [12]. new, yet more difficult to implement techniques which require coordination from the browser and the website. The first of these techniques was the X-Frame options unchangeable [19]. This prevents malicious code from [13] presented by IE8 and soon adopted by other changing object properties in a potentially malicious browsers as well. This category of techniques requires manner inducing clickjacking. that the browser is capable of utilizing the technique and that the website also employs the relevant code. 2) Website code/script: • Using the Same Origin Policy on a Website to avoid Table 1 summarizes existing techniques of clickjacking attacks: The same origin policy [18] prevents a webpage from loading a document or script from one A.