ClickJacking Attack | ClickJacking Prevention

clickjacking attack | clickjacking prevention

Clickjacking Attack & Prevention

It is also referred as REDRESS

  1. User Interface redress Attack
  2. UI redress Attack
  3. UI redressing

ClickJacking is a technique in which users are tricked into clicking malicious links from something different from what the user perceives. The attackers hijack your website and reroute them to an unknown link which are intended to have malicious activities.
While using a such technique, passwords and secret keys can also be hijacked. Attackers can craft a combination of stylesheets, iframes, and text boxes that are similar to websites you are intending to login. Users are believed they are typing password to their E-mail or bank account, but are instead typing into an invisible attacker’s clikjacing Attack.

ClickJacking Attack can be divided into the sub-category

Classic Attacks refers to mainly web browser and their target users who are using a web browser to access the website. Works mostly through a web browser.
LikeJacking is to hijack the main purpose and change to like the Facebook pages or we can say use Facebook’s social media capabilities
Nested Attack is similar to classic, a malicious frame is inserted between to frames on a harmless website is said to be a Nested attack. This works due to vulnerability in the HTTP header “X-FRAME-Options”. clickjacking tailored to affect Google+ is one of the examples of a Nested Attack.
CursorJacking is a UI redressing technique to change the cursor from the location the user perceives, manipulates the cursor’s appearance and location
MouseJacking is referred to as Hardware vulnerability, as we use external hardware (such as mouse, keyboards) it was reported that input to be injected into vulnerable dongles. Only LogitechLogitech Mouse – Buy Logitech Mouse Online at Best Prices In India | updated their firmware successfully to stop such attacks and other companies failed to do so.
Browserless ClickJacking mainly occurs in Mobiles, These clickJacking are browserless. Example – As we receive notifications on our mobiles, there is a small delay displaying notifications in that delay time attackers create a button that lies behind the notifications.
Cookies are stolen, then tricked a user into dragging an object which seemingly appears harmless.
Attackers use the web browser’s capability to navigate and tricking the user into establishing an active file server capable of setting up the affected device as a file server.
Password manager attack:
Password manager attack is related to Autofill password managers. This occurs due to a change in the protocol used while passwords are saved and password managers insecurely fill in the private information (password).

How to Defend our Website against ClickJacking

There are three main mechanism clickjacking prevention attacks

  1. Using Header X-Frame-Options & ContentSecurity Policy
  2. Preventing session cookies.
  3. Using Javascripts

Refernces for more Details

CSP: frame-ancestors – HTTP | MDN

SecTheory – Internet Security

Sophos Security Topics | What is Likejacking


I love helping beautiful people like you. I love hanging out with my dogs.

You may also like...

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.