Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I read a number of IT security blogs (though I'm no security expert), and it seems a significant percentage of exploits in the wild are delivered through adding malicious iframes to a hacked website, with the iframe pointing to the malicious payload.

Given this, together with the fact that I have really seen almost no legitimate iframe applications that aren't obnoxious, why are they allowed at all in modern browsers? It seems to me that a easy way to block a significant number of the drive-by attacks would be to simply disable iframe support in the browser.

Alternatively, a "click-to-load" mechanism, similar to the "click-to-flash" plugins common for many browsers would have a similar effect, without completely preventing existing sites that use iframes from working.
Alternatively, disallowing iframes that load content from another domain would probably be effective too.


I certainly don't claim that blocking iframes would solve every web-security solution, but from a cost-benefit perspective, it seems a very easy way to blok a significant number of security issues.

share|improve this question
6  
Embedding a youtube video isn't legitimate? With an iframe I can just add the video and let youtube worry about whether to serve the user the HTML5 or Flash version for example. –  ewanm89 Feb 21 '13 at 8:27
1  
It seems this is a good example of the toupee fallacy (on my part). If the only time I notice an iframe is when it's obnoxious, I wind up thinking iframws are obnoxious. However, this fails to account for all the iframe applications that I don't notice in the first place, which leads to massive sample bias. –  Fake Name Feb 23 '13 at 2:45
add comment

5 Answers

up vote 8 down vote accepted

Given that framing is deprecated, and AJAX has origin control, iframes is pretty much the only way to embed another page into yours.

Another thing is that you can use iframes to display PDFs/etc. Sure, you can use <object> for that as well, but iframes are easier.

GMail is made from iframes. The smooth UX of GMail (you can still use it when your internet connection breaks, smooth navigation without having to reload every time) comes from iframes. Again, this could be implemented in AJAX, but it's harder.

One last thing that comes to mind is backwards compatibility. A lot of sites use iframes, and disabling it would break too many of them. Sure, click-to-enable won't cut it here, either. One of the precursors of AJAX was a trick with iframes and javascript. A lot of websites used to use that, and "click to load" will break the flow of the JS.

On the other hand, issues with iframes (CSRF, clickjacking, etc) are well known to modern developers and they can take measures to avoid that.


If you look at it, the arguments in this question could be equally applied to Java applets. Or Flash. Or PDF embedding. Or images (CSRF). Or cookies. For example, other sites can CSRF you via images. It's up to you to make sure that your site isn't vulnerable to these.

share|improve this answer
    
Without iframes one can set up a proxy page for foreign content. Almost any web developer can do this. With jQuery it is trivial to load same-origin content into a div. ($.load) In fact divs are even more flexible to layout... But sure, if you want to embed cnn.com, you should probably use an iframe. –  Philip Feb 23 '13 at 11:14
    
@Philip: For that, you need PHP/etc. And, again, disabling iframes will break a quite a lot of websites. –  Manishearth Feb 23 '13 at 11:35
add comment

3-D Secure payment systems (e.g. MasterCard SecureCode) use an iframe. Previous versions used a popup, the provenance of which being much more easily verified by the user. It apparently turned out that users being presented with a popup from VISA / MasterCard does not, actually, verify the provenance of the popup; instead, he becomes confused, and bails out, aborting his transaction.

From this we can draw the following conclusion: iframes will not disappear soon. They are now needed for backward compatibility with the payment systems which, ultimately, pay for the whole Internet. Also, we can say that not using iframes gives security benefits only insofar as users activate their brain and don't panic -- I would not bet on that.

share|improve this answer
1  
The pop-ups previously used by 3DS providers were worse than that - they typically didn't even include the address bar (and browsers didn't force the issue in those days). So we got all the inconvenience of a pop-up, without even being able to verify the source of the page. Even then, the domain was typically a third-party MPI provider (eg securesuite), completely unknown to the consumer. So yeah, the pop-up was pretty useless. –  bobince Feb 22 '13 at 10:38
    
Yeah, those payment things trigger all of NoScript's XSS warnings every time too. –  ewanm89 Feb 23 '13 at 9:50
add comment

Disallowing iframes would break functionality, and achieve nothing.

Exploit injection is typically done with an iframe because that's the most convenient way for attackers to set up and manage redirection. But the actual iframes are not anything to do with exploits. It's not like Click-to-Play where you are being protected from real exploits in the Java and Flash plugins directly.

If just a few users have iframes turned off, they get a security benefit by avoiding these attacks. (Although, given that iframes are widely used for many different kinds of functionality across the web, it's questionable whether it's worth it.)

But if every browser turned off iframe support, attackers would just choose some other method of injecting exploits into compromised sites, such as direct <script>, page redirection, pop-ups and so on.

A security measure that addresses symptoms like <iframe> instead of the root cause of the problem is only useful if it is unusual, so that attackers don't expect it. As soon as it becomes mainstream, it loses its value. If you are a major browser vendor there is little point implementing a security control that will immediately make itself useless.

share|improve this answer
add comment

The world wide web is a collection of linked resources. The iframe is the ultimate linker, it links to whole bundles of resources. And like any technology, it can be used for good and bad.

The iframe is not the only way to link to malware resources. Ultimately, there is a JavaScript script or other resource like a SWF or a JAR that exploits the browser. The iframe is just a nice, flexible and compact way to manage the loading of malware content from centralized sources.

Noscript has the kind of controls that would block iframes. It is disabled by default because it breaks a lot of stuff. A lot of web technology is based on the iframe and a lot of the internet would break if you block or prompt for iframes.

share|improve this answer
add comment

The iframe is just an element that permits mixing content from different sources towards one client. There are other elements like this. If you forbid iframe elements, the same security risks will still exist, with Flash animations for example. In an object or embed element, a site A displaying Flash ads allows a site B to decide which content will be displayed to the users of site A. Flash anims can run scripts, access micro-storage… So the cross-site risks are there.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.