How to protect against clickjacking via pop-under windows?

Question

Huang and Jackson described a method of clickjacking that does not rely on iframes, but on pop-under windows. Is this attack still relevant today, or is it prevented by pop-up blockers? Is there any way a site can protect against it?

The attack works like this: a window is opened behind the current window, and the user is asked to double click. The first click brings the pop-under to the front, and the second click performs some interaction the user does not intended.

Step 1: user is asked to click twice on the button:

Step 2: after one click, a window is layed over the page so that the button click is handled by another page:

Is this still possible with today's browsers? Is there anything a user or a site can do to prevent this?

Answer 1

I use Tab Mix Plus plugin in Firefox and configure it to turn all pop-up/new window into tabs. This also prevents Javascript from bringing tabs into the foreground/background.

You can additionally configure it to disallow scripts from changing window size and position, so accurate placement is impossible.

A similar plugin may exist for other browsers.

Answer 2

Browsers generally include click-jacking protection for their internal popups. For example to keep you from accidentally opening a downloaded file without realizing what you are doing.

However, in the scenario you describe, the responsibility of protection is at the site that hosts the Allow Access button. (in this case, Google) There is no 100% fooluser-proof solution. So, unfortunately part of this has to be general anti-phishing initiatives. (Google tries to database malicious sites, but this is a reactionary system.)

The most simple form of click-jacking is of course page navigation, or a plain popup triggered by the first of the two clicks. Popup blockers do not take effect when the popup is triggered directly by a user's click, and of course the popup blockers do not stop plain navigation.

Is there any way a site can protect against it?

1. Does Google include a minimum time before the approve button begins to function?

2. It just so happens the page at Google might not load fast enough to catch the second click.

---

The pop-under technique is a clever way to make sure that the page has been loaded ahead of time.

1. Get user to click something.
2. Pop up the Allow page, and immediately call self.focus() bringing malicious site in front.
3. On the first click, popup.focus() to bring it in front, so that the second click will hit Allow.

That is the scenario you described, but it actually doesn't work (thankfully) because of Same Origin Policy, preventing the malicious site from calling .focus() if the popup is on a different site.

Unfortunately, the following would work

1. Get user to click something.
2. Pop up a 'malicious popup'.
3. Get user to click something else.
4. Pop up the Allow page, and immediately call self.focus() bringing 'malicious popup' in front.
5. On the first click, self.close() to get rid of 'malicious popup', and then the second click will hit Allow.

Is there any way a site can protect against it?

1. A really easy thing is to check history.length == 1, and if that is the case, Google knows it was opened via popup. This is not a comprehensive mitigation.

2. Google can use either the Visibility API, and/or self.onfocus and self.onblur events to require a minimum time before click will take effect. I think this can be a comprehensive protection. But it is subject to browser support.

---

I can imagine a more complex scenario where the Google logo is hidden by other popup(s), thereby fooling the user.

Is there anything a user ... can do to prevent this?

Just be sure not to double-click on a site you don't trust. In fact stay away from any suspicious site. ☺