2

Huang and Jackson described a method of clickjacking that does not rely on iframes, but on pop-under windows. Is this attack still relevant today, or is it prevented by pop-up blockers? Is there any way a site can protect against it?

The attack works like this: a window is opened behind the current window, and the user is asked to double click. The first click brings the pop-under to the front, and the second click performs some interaction the user does not intended.

Step 1: user is asked to click twice on the button: Page asking the user to double click

Step 2: after one click, a window is layed over the page so that the button click is handled by another page: Google popup over the previous button

Is this still possible with today's browsers? Is there anything a user or a site can do to prevent this?

  • BeEF uses this to persistence the connection to hooked webbrowsers. You can find it under the category "Persistence", as far as I know, browsers don't give pop-up-block warnings for the pop-under BeEF uses. – O'Niel Jul 8 '16 at 15:31
  • it's not a great practical vector for many reasons, among them: difficulty knowing exactly where to position the under button, the after-click delay of the mouse stack waiting for a dbl-click or not, window animation slowing down the popup scoot, lack of double-clicking expectations, doesn't work on non-mouse devices, customary confirmations/notifications after doing something important, requirement of pre-login cookies, not all browsers allow sized or positioned popups, and zoom levels affecting the position math (popup is on a different domain). there are likely other limitations as well. – dandavis Jul 8 '16 at 17:18
1

I use Tab Mix Plus plugin in Firefox and configure it to turn all pop-up/new window into tabs. This also prevents Javascript from bringing tabs into the foreground/background.

You can additionally configure it to disallow scripts from changing window size and position, so accurate placement is impossible.

A similar plugin may exist for other browsers.

0

Browsers generally include click-jacking protection for their internal popups. For example to keep you from accidentally opening a downloaded file without realizing what you are doing.

However, in the scenario you describe, the responsibility of protection is at the site that hosts the Allow Access button. (in this case, Google) There is no 100% fooluser-proof solution. So, unfortunately part of this has to be general anti-phishing initiatives. (Google tries to database malicious sites, but this is a reactionary system.)

The most simple form of click-jacking is of course page navigation, or a plain popup triggered by the first of the two clicks. Popup blockers do not take effect when the popup is triggered directly by a user's click, and of course the popup blockers do not stop plain navigation.

Is there any way a site can protect against it?

  1. Does Google include a minimum time before the approve button begins to function?

  2. It just so happens the page at Google might not load fast enough to catch the second click.


The pop-under technique is a clever way to make sure that the page has been loaded ahead of time.

  1. Get user to click something.
  2. Pop up the Allow page, and immediately call self.focus() bringing malicious site in front.
  3. On the first click, popup.focus() to bring it in front, so that the second click will hit Allow.

That is the scenario you described, but it actually doesn't work (thankfully) because of Same Origin Policy, preventing the malicious site from calling .focus() if the popup is on a different site.

Unfortunately, the following would work

  1. Get user to click something.
  2. Pop up a 'malicious popup'.
  3. Get user to click something else.
  4. Pop up the Allow page, and immediately call self.focus() bringing 'malicious popup' in front.
  5. On the first click, self.close() to get rid of 'malicious popup', and then the second click will hit Allow.

Is there any way a site can protect against it?

  1. A really easy thing is to check history.length == 1, and if that is the case, Google knows it was opened via popup. This is not a comprehensive mitigation.

  2. Google can use either the Visibility API, and/or self.onfocus and self.onblur events to require a minimum time before click will take effect. I think this can be a comprehensive protection. But it is subject to browser support.


I can imagine a more complex scenario where the Google logo is hidden by other popup(s), thereby fooling the user.

Is there anything a user ... can do to prevent this?

Just be sure not to double-click on a site you don't trust. In fact stay away from any suspicious site. ☺

  • "Just be sure not to double-click on a site you don't trust" Have you ever had to "double-click" on any legit website ??? I never did. – niilzon Jul 8 '16 at 13:44
  • Indeed, it's pretty rare. The only legit instance I remember is Google Docs. Other than that it's just been online gaming sites, so be careful when doing that. – Bryan Field Jul 8 '16 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.