0

I've learned about Clickjacking. If I got it right, it boils down to tricking user into heading to the [malicious] link, which he/she never intended to do, but was tricked into doing so, due to the deceiving visual appearance of the HTML element (web page, graphic, whatever) that's behind the actual (being clicked, but transparent) element.

My questions is following:

What would be different if I just embed a deceiving image into anchor, as:

<a href="..."><img src="google_logo.png"></a>

?

Well, of course Google logo image is just an example here.. we could have some larger image, that depicts an entire web site or some other deceiving imagery.

Do I get it correct, that the difference are the following points:

  1. Image will be easier to spot, as it's an entire big graphic (that's one thing under mouseover) and it will look much more suspicious;
  2. Image will render differently on different devices (although this can be adjusted with CSS?);
  3. Point is to have almost normal website, embedded in iframe, so that nothing is different, apart from a little (hidden) element?

I mean.. I sort of see some differences, but the actual principle, to me at least, seems pretty similar - it's to show some deceiving visual and thereby trick the user into clicking on something one has no idea about.

Appreciations.

1 Answer 1

1

You have fundamentally misunderstood clickjacking. It's not about the victim navigating to an unintended site at all; a malicious site can trivially navigate a user to any arbitrary site, or cause their browser to make requests to the other site without a top-level navigation.

Rather, clickjacking is about a victim unintentionally, unknowingly, and predictably interacting with a vulnerable third-party site (the "target"), typically while the victim is logged into the target. This happens because the attacker uses an iframe (or similar sub-page embedding HTML element) to host the target page, and then uses CSS to hide the embedded target page and show the attacker's chosen UI, but cause clicks and typing to be sent to the embedded target page. If the victim is logged into the target page, then the attacker can trick the victim into taking actions of the attacker's choosing using the victim's own account on the target page. In other words, the attacker can achieve a limited degree of control over the victim's account on the target page.

An example: if StackExchange were vulnerable to clickjacking, an attacker could create an unrelated website that embeds this question page, display their own content on top of it. That content would give the user (victim) a reason to click the spot over the "Add a comment" button, and then type some sequence of characters and hit Enter. Those reasons might be any number of things; the usual examples are a game or challenge, perhaps for some prize, but it could easily be something else. The important part is that the victim, unaware of what site they're actually interacting with, thinks the action is fine, when actually it's doing something totally different.

A silly example might be a purported challenge to see how many times you can type "goats" in 20 seconds. In fact, the top-level site isn't even tracking your keystrokes... but every minute you click a "Start!" button (actually "Add a comment" on a new question), type "goats" as many times as you can while a counter ticks down, and then hit "Enter" when it tells you you're done and have to hit Enter to see the results. In reality, you're posting three spam comments a minute on this site, and will probably end up with a moderator taking action against you.

Of course, it can get much worse than silly spam comments. A slightly more convoluted set of steps carried out targeting various types of sites might cause you to delete your account, approve an attacker-chosen purchase or money transfer, send an email or post on social media with a chosen message, grant permissions to a user account on your GitHub project, use moderator access to ban an innocent user, trash your production environment configuration by e.g. deleting all your server VMs, join a video call with the attacker on a trusted site that already has camera access, or so on. Basically, anything that doesn't require you to do anything you definitely wouldn't do on an untrusted website (like type your password for a different site), the attacker can potentially trick you into doing.

6
  • Seems like I read a bad article, which has explained clickjacking as follows: you create very similar (but fake) website, that mimics the real one (e.g. factbook.com instead of facebook.com), then you embed a real facebook.com in that mimicking website and you then put some anchor (or any other element that's within an anchor) element(s) with a higher z-index than the z-index of embedded site and a transparent opacity, and finally - those anchor links refer to malicious links.. basically, you trick user to go to a fake page, that fake page embeds real on, but with malicious hidden links. Commented Nov 24, 2022 at 11:41
  • What I now understood (from your answer) is this: 1) user isn't entering fake website.. he/she enters a legit, real, correct website; however, 2) on that website, you've got some parts, that have higher z-index and hidden elements.. so, basically, user surfs real page, but when clicking something there, under the hood, requests to different page(s) are made. Simple example: say there's a POST request for giving points into Mario game - one click is giving one coin.. on your site, you've got something that makes user want to click it.. but in reality, that click brings you coins. Commented Nov 24, 2022 at 11:47
  • So, user thinks he/she does whatever is visible, but some different requests are being sent under the hood. Main thing is, that user goes to a LEGIT website (no misspelling) and does some "legit" action there.. but that legit action, does something else behind the scenes. Also, in that case, this attack is ONLY possible on the website which you have control over.. you cannot attack other websites (unless you hack them and change the content) with this. Did I get it right? Commented Nov 24, 2022 at 11:49
  • Well... my first assumption is confirmed even here. :/ Commented Nov 24, 2022 at 13:55
  • Pff..... there are as many opinions on this, as many articles/tutorials.. I'm lost. Commented Nov 24, 2022 at 14:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .