19

I read a number of IT security blogs (though I'm no security expert), and it seems a significant percentage of exploits in the wild are delivered through adding malicious iframes to a hacked website, with the iframe pointing to the malicious payload.

Given this, together with the fact that I have really seen almost no legitimate iframe applications that aren't obnoxious, why are they allowed at all in modern browsers? It seems to me that a easy way to block a significant number of the drive-by attacks would be to simply disable iframe support in the browser.

Alternatively, a "click-to-load" mechanism, similar to the "click-to-flash" plugins common for many browsers would have a similar effect, without completely preventing existing sites that use iframes from working.
Alternatively, disallowing iframes that load content from another domain would probably be effective too.

I certainly don't claim that blocking iframes would solve every web-security solution, but from a cost-benefit perspective, it seems a very easy way to blok a significant number of security issues.

Improve this question
2
  • 12
    Embedding a youtube video isn't legitimate? With an iframe I can just add the video and let youtube worry about whether to serve the user the HTML5 or Flash version for example.
    – ewanm89
    Feb 21, 2013 at 8:27
  • 4
    It seems this is a good example of the toupee fallacy (on my part). If the only time I notice an iframe is when it's obnoxious, I wind up thinking iframws are obnoxious. However, this fails to account for all the iframe applications that I don't notice in the first place, which leads to massive sample bias.
    – Fake Name
    Feb 23, 2013 at 2:45

6 Answers 6

Reset to default
21

Given that framing is deprecated, and AJAX has origin control, iframes is pretty much the only way to embed another page into yours.

Another thing is that you can use iframes to display PDFs/etc. Sure, you can use <object> for that as well, but iframes are easier.

GMail is made from iframes. The smooth UX of GMail (you can still use it when your internet connection breaks, smooth navigation without having to reload every time) comes from iframes. Again, this could be implemented in AJAX, but it's harder.

One last thing that comes to mind is backwards compatibility. A lot of sites use iframes, and disabling it would break too many of them. Sure, click-to-enable won't cut it here, either. One of the precursors of AJAX was a trick with iframes and javascript. A lot of websites used to use that, and "click to load" will break the flow of the JS.

On the other hand, issues with iframes (CSRF, clickjacking, etc) are well known to modern developers and they can take measures to avoid that.

If you look at it, the arguments in this question could be equally applied to Java applets. Or Flash. Or PDF embedding. Or images (CSRF). Or cookies. For example, other sites can CSRF you via images. It's up to you to make sure that your site isn't vulnerable to these.

Improve this answer
3
  • Without iframes one can set up a proxy page for foreign content. Almost any web developer can do this. With jQuery it is trivial to load same-origin content into a div. ($.load) In fact divs are even more flexible to layout... But sure, if you want to embed cnn.com, you should probably use an iframe.
    – Philip
    Feb 23, 2013 at 11:14
  • @Philip: For that, you need PHP/etc. And, again, disabling iframes will break a quite a lot of websites.
    – Manishearth
    Feb 23, 2013 at 11:35
  • 1
    Update 2018: I block third-party iframes by default, and I only have to enable them in rare cases. (Embedded YouTube is one of those cases, but I usually prefer that to be blocked anyway.)
    – SilverWolf
    Jun 17, 2018 at 22:43
9

3-D Secure payment systems (e.g. MasterCard SecureCode) use an iframe. Previous versions used a popup, the provenance of which being much more easily verified by the user. It apparently turned out that users being presented with a popup from VISA / MasterCard does not, actually, verify the provenance of the popup; instead, he becomes confused, and bails out, aborting his transaction.

From this we can draw the following conclusion: iframes will not disappear soon. They are now needed for backward compatibility with the payment systems which, ultimately, pay for the whole Internet. Also, we can say that not using iframes gives security benefits only insofar as users activate their brain and don't panic -- I would not bet on that.

Improve this answer
2
  • 1
    The pop-ups previously used by 3DS providers were worse than that - they typically didn't even include the address bar (and browsers didn't force the issue in those days). So we got all the inconvenience of a pop-up, without even being able to verify the source of the page. Even then, the domain was typically a third-party MPI provider (eg securesuite), completely unknown to the consumer. So yeah, the pop-up was pretty useless.
    – bobince
    Feb 22, 2013 at 10:38
  • Yeah, those payment things trigger all of NoScript's XSS warnings every time too.
    – ewanm89
    Feb 23, 2013 at 9:50
6

Disallowing iframes would break functionality, and achieve nothing.

Exploit injection is typically done with an iframe because that's the most convenient way for attackers to set up and manage redirection. But the actual iframes are not anything to do with exploits. It's not like Click-to-Play where you are being protected from real exploits in the Java and Flash plugins directly.

If just a few users have iframes turned off, they get a security benefit by avoiding these attacks. (Although, given that iframes are widely used for many different kinds of functionality across the web, it's questionable whether it's worth it.)

But if every browser turned off iframe support, attackers would just choose some other method of injecting exploits into compromised sites, such as direct <script>, page redirection, pop-ups and so on.

A security measure that addresses symptoms like <iframe> instead of the root cause of the problem is only useful if it is unusual, so that attackers don't expect it. As soon as it becomes mainstream, it loses its value. If you are a major browser vendor there is little point implementing a security control that will immediately make itself useless.

Improve this answer
2

The iframe is just an element that permits mixing content from different sources towards one client. There are other elements like this. If you forbid iframe elements, the same security risks will still exist, with Flash animations for example. In an object or embed element, a site A displaying Flash ads allows a site B to decide which content will be displayed to the users of site A. Flash anims can run scripts, access micro-storage… So the cross-site risks are there.

Improve this answer
2

99% of videos are presented in iframes - including Youtube, vimeo, Vk, as well as the majority of the file hosts.

Also look at Paypal, 3d secure, most banking systems, EBAY, Amazon, Alibaba, Facebook, the list is endless.

ALL use iframes. Take a visit to the top 100 websites, view source - bet you find iframes on almost every one.

Improve this answer
0
1

The world wide web is a collection of linked resources. The iframe is the ultimate linker, it links to whole bundles of resources. And like any technology, it can be used for good and bad.

The iframe is not the only way to link to malware resources. Ultimately, there is a JavaScript script or other resource like a SWF or a JAR that exploits the browser. The iframe is just a nice, flexible and compact way to manage the loading of malware content from centralized sources.

Noscript has the kind of controls that would block iframes. It is disabled by default because it breaks a lot of stuff. A lot of web technology is based on the iframe and a lot of the internet would break if you block or prompt for iframes.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .