Clickjacking on a site without user accounts

Question

My understanding of clickjacking attacks is that an attacker could embed my site in his. The attacker then uses clever styling to trick the user into performing actions on my site, that they did not intend to perform.
Suppose my site does not have the concept of a user account where someone could perform more actions, than one could without being logged in.
Then is a clickjacking attack still applicable to my site?

More specifically, if I allow users to purchase things on my site but require them to enter their personal and CC info each time because they don't have an "account" with the site can I allow my site to be embedded in iFrames of other sites?

Answer 1

Suppose my site does not have the concept of a user account... Then is a clickjacking attack still applicable to my site?

Even though there are no accounts, if there is a concept of user sessions, then Clickjacking could possibly apply. It all depends on what is being stored at session level.

The best way to think of this is that if your site remembers state at session level, and you are not setting X-Frame-Options to prevent framing, then an attacker could possibly trick a user into submitting this state information in order to execute an action.

The other requirement would be a clickable item somewhere on your site, usually a button, that doesn't require any input on the page except for the click.

Clickjacking is sort of a "way to circumvent" CSRF protection on pages where no user input is required to submit them.

An example:

1. User adds a "widget" to their basket on your site.
2. User goes to checkout and enters their personal information and card details.
3. This information is stored server side in the user session, identified via a random token which is stored in a cookie.
4. The user gets redirected to a confirmation page so they can check their details before sending the order: A GET request to example.com/confirm.php shows their order and they can click a submit button to to complete their order which submits an empty form (except for a CSRF token) resulting in a POST request to complete.php.

Now an attacker could frame the confirm.php page and display another button over the top so when the user clicks the button they submit their order to your site. Maybe this could be combined with a CSRF vulnerability elsewhere for adding items to a user's basket, and could be executed at a point where it is known that session is populated (maybe the attacker has gained control of one of the advertiser's sites that are displayed after the user's first checkout and this vulnerability allows them to do it again with an item of the attacker's choosing).

So yes, your site could be vulnerable and it is down to the specific implementation details and the business model of your site to see whether it poses a real threat or not.

Answer 2

Yes, your site can be clickjacked, whether you have user accounts or not.
If users have accounts on your site, then the clickjacking attack can be made against the account. But one could also perform a clickjacking attack against some other aspect of the target.

Wikipedia has a a few examples: tricking a user into enabling their webcam, into following someone on Twitter, or make them "like" something on Facebook.

The fact that our users don't have an account does not protect them from a clickjacking attack. If the clickjacker is after the credit card number, the requirement for the user to type all their information makes it easier for the clickjacker to get that personal data as well.

Answer 3

Clickjacking can be done to your site. If authenticated user is logged in to your application and the attacker sends him a malicious link then when the user clicks on that link he will get a site that has a click here button on it. Below the click here Button there will be an Iframe of your site to delete the user. When the user clicks on the click here button his account will be deleted. More information on clickjacking