Clickjack - Revision history

Joey66699912 at 03:33, 24 November 2010

2010-11-24T03:33:45Z

Joey66699912 at 03:32, 24 November 2010

2010-11-24T03:32:49Z

Joey66699912 at 03:30, 24 November 2010

2010-11-24T03:30:24Z

Joey66699912: Created page with "A framekiller (or framebuster or framebreaker) is a piece of JavaScript code that doesn't allow a Web page to be displayed within a frame. A frame is a subdivision of a Web brows…"

2010-11-24T03:22:43Z

Created page with "A framekiller (or framebuster or framebreaker) is a piece of JavaScript code that doesn't allow a Web page to be displayed within a frame. A frame is a subdivision of a Web brows…"

New page

A framekiller (or framebuster or framebreaker) is a piece of JavaScript code that doesn't allow a Web page to be displayed within a frame. A frame is a subdivision of a Web browser window and can act like a smaller window. This kind of script is often used to prevent a frame from an external Web site being loaded from within a frameset without permission.

The typical source code for a framekiller script is:

<script type="text/javascript">
if(top != self) top.location.replace(location);
</script>

There are many variations of this script. This example is cross-browser compatible, avoids depreciated objects, and uses replace which preserves the user's back-button. Comparing object references, top, self and location directly is slightly more efficient, and succinct.
== Framekiller Killers ==

The above framekiller can be prevented from working with the following JavaScript along with a server which responds with a HTTP/1.1 204 No Content, as discovered in this blog

. Just place the following code in the top frame. It works because in most browsers a 204 HTTP response will do nothing, meaning it will leave us on the current page. But the request attempt will override the previous frame busting attempt, rendering it useless.

var prevent_bust = 0;

// Event handler to catch execution of the busting script.
window.onbeforeunload = function() { prevent_bust++ };

// Continuously monitor whether busting script has fired.
setInterval(function() {
if (prevent_bust > 0) { // Yes: it has fired.
prevent_bust -= 2; // Avoid further action.
// Get a 'No Content' status which keeps us on the same page.
window.top.location = 'http://server-which-responds-with-204.com';
}
}, 1);

== Alternative Solution ==

An alternative choice is to allow the user to determine whether to let the framekiller work, as discovered by the Framekiller Killer:

.

var framekiller = true;
window.onbeforeunload = function() {
if(framekiller) {
return "..."; // any message that helps user to make decision
}
};

and the code below should be added after the frame tag:

//"my_frame" should be changed according to the real id of the frame in your page
document.getElementById("my_frame").onload = function() {
framekiller = false;
};

== Limitations ==

This client-side JavaScript solution relies on the end-user's browser enforcing their own security. This makes it a beneficial, but unreliable, means of disallowing your page to be embedded in other pages. The following situations may render the script above useless:

* The user agent does not support JavaScript.
* The user agent supports JavaScript but the user has turned support off.
* The user agent's JavaScript support is flawed or partially implemented.
* The user agent's behavior is modified by a virus or plug-in (possibly without the user's knowledge) in a way that undermines the framekiller script.

In 2010 a paper was published highlighting limitations of current frame-busting techniques and proposing improved version:

<style> html{display : none ; } </style>
<script>
if( self == top ) {
document.documentElement.style.display = 'block' ;
} else {
top.location = self.location ;
}
</script>

@@ Line 28: / Line 28: @@
 The NoScript add-on for Firefox remains the only free product providing automatic client-side protection, with no need for awareness and cooperation from the Web site authors.
-[edit] GuardedID
+ GuardedID
-GuardedID (a commercial product) provides client-side clickjack protection for users of IE or Firefox[12] without interfering with the operation of legitimate iFrames.
+GuardedID (a commercial product) provides client-side clickjack protection for users of IE or Firefox without interfering with the operation of legitimate iFrames.
-[edit] Gazelle
+ Gazelle
-Gazelle is a Microsoft Research project secure web browser based on IE, that uses an OS-like security model, and has its own unique defenses against clickjacking[13]. In Gazelle, a window of different origin may only draw dynamic content over another window's screen space if the content it draws is opaque.
+Gazelle is a Microsoft Research project secure web browser based on IE, that uses an OS-like security model, and has its own unique defenses against clickjacking. In Gazelle, a window of different origin may only draw dynamic content over another window's screen space if the content it draws is opaque.
 == Server-side ==
 == Framekiller ==

@@ Line 40: / Line 40: @@
 Such JavaScript-based protection, unfortunately, is not always reliable. This is especially true on Internet Explorer[11], where this kind of countermeasure can be circumvented "by design" by including the targeted page inside an <IFRAME SECURITY=restricted> element.
-[edit] Server and client
+== Server and client ==
-[edit] X-Frame-Options
+== X-Frame-Options ==
 On 26 January 2009 Microsoft released RC1 of Internet Explorer 8, which includes a new partial clickjacking prevention option. Web site developers will be able to add a tag in a page header to help detect and prevent frame-based UI redressing. IE 8, according to Microsoft, “will detect sites that insert the tag and give users a new error screen indicating that the content host has chosen not to allow their content to be framed, while giving users the option to open the content in a new window.”  According to NoScript's developer, Giorgio Maone, this feature can be regarded as a work-around for framekiller's brokenness on IE and, "if a Web site owner is skilled and careful enough to implement" this countermeasure, "he will surely deploy the simple and understood JavaScript frame busting one-liner too, and every browser is equally protected".

@@ Line 1: / Line 1: @@
-A framekiller (or framebuster or framebreaker) is a piece of JavaScript code that doesn't allow a Web page to be displayed within a frame. A frame is a subdivision of a Web browser window and can act like a smaller window. This kind of script is often used to prevent a frame from an external Web site being loaded from within a frameset without permission.
+Clickjacking is a malicious technique of tricking Web users into revealing confidential information or taking control of their computer while clicking on seemingly innocuous Web pages. A vulnerability across a variety of browsers and platforms, a clickjacking takes the form of embedded code or script that can execute without the user's knowledge, such as clicking on a button that appears to perform another function.
-The typical source code for a framekiller script is:
+The term "clickjacking" was coined by Jeremiah Grossman and Robert Hansen in 2008. The exploit is also known as UI redressing.
-<script type="text/javascript">
+Clickjacking can be understood as an instance of the confused deputy problem.
-  if(top != self) top.location.replace(location);
+Contents
-There are many variations of this script. This example is cross-browser compatible, avoids depreciated objects, and uses replace which preserves the user's back-button. Comparing object references, top, self and location directly is slightly more efficient, and succinct.
+== Description ==
-The above framekiller can be prevented from working with the following JavaScript along with a server which responds with a HTTP/1.1 204 No Content, as discovered in this blog
+Clickjacking is possible because seemingly harmless features of HTML Web pages can be employed to perform unexpected actions.
- var prevent_bust = 0;
+A clickjacked page tricks a user into performing undesired actions by clicking on a concealed link. On a clickjacked page, the attackers show a set of dummy buttons, then load another page over it in a transparent layer. The users think that they are clicking the visible buttons, while they are actually performing actions on the hidden page. The hidden page may be an authentic page, and therefore the attackers can trick users into performing actions which the users never intended to do and there is no way of tracing such actions later, as the user was genuinely authenticated on the other page.
- // Event handler to catch execution of the busting script.
+     The user receives an email with a link to a video about a news item, but another valid page, say a product page on amazon.com, can be "hidden" on top or underneath the "PLAY" button of the news video. The user tries to "play" the video but actually "buys" the product from Amazon.
- window.onbeforeunload = function() { prevent_bust++ };
+     Other known exploits have been:
- // Continuously monitor whether busting script has fired.
+Protection against clickjacking can be added to Mozilla Firefox versions by installing the NoScript add-on: its ClearClick
-  setInterval(function() {
-   if (prevent_bust > 0) {  // Yes: it has fired.
+feature, released on 8 October 2008, prevents users from clicking on invisible or "redressed" page elements of embedded documents or applets, defeating all the types of clickjacking (i.e. frame-based and plugin-based).
-An alternative choice is to allow the user to determine whether to let the framekiller work, as discovered by the Framekiller Killer:
+The NoScript add-on for Firefox remains the only free product providing automatic client-side protection, with no need for awareness and cooperation from the Web site authors.
+[edit] GuardedID
- var framekiller = true;
+GuardedID (a commercial product) provides client-side clickjack protection for users of IE or Firefox[12] without interfering with the operation of legitimate iFrames.
- window.onbeforeunload = function() {
+[edit] Gazelle
-and the code below should be added after the frame tag:
+Gazelle is a Microsoft Research project secure web browser based on IE, that uses an OS-like security model, and has its own unique defenses against clickjacking[13]. In Gazelle, a window of different origin may only draw dynamic content over another window's screen space if the content it draws is opaque.
- //"my_frame" should be changed according to the real id of the frame in your page
+Web site owners can protect their users against UI redressing (frame based clickjacking) on the server side by including a framekiller JavaScript snippet in those pages they do not want to be included inside frames from different sources.
-== Limitations ==
+Such JavaScript-based protection, unfortunately, is not always reliable. This is especially true on Internet Explorer[11], where this kind of countermeasure can be circumvented "by design" by including the targeted page inside an <IFRAME SECURITY=restricted> element.
-This client-side JavaScript solution relies on the end-user's browser enforcing their own security. This makes it a beneficial, but unreliable, means of disallowing your page to be embedded in other pages. The following situations may render the script above useless:
+On 26 January 2009 Microsoft released RC1 of Internet Explorer 8, which includes a new partial clickjacking prevention option. Web site developers will be able to add a tag in a page header to help detect and prevent frame-based UI redressing. IE 8, according to Microsoft, “will detect sites that insert the tag and give users a new error screen indicating that the content host has chosen not to allow their content to be framed, while giving users the option to open the content in a new window.”  According to NoScript's developer, Giorgio Maone, this feature can be regarded as a work-around for framekiller's brokenness on IE and, "if a Web site owner is skilled and careful enough to implement" this countermeasure, "he will surely deploy the simple and understood JavaScript frame busting one-liner too, and every browser is equally protected".
-    * The user agent does not support JavaScript.
+Microsoft's suggested solution, which has since also been implemented in Apple's Safari, Firefox, and Google's Chrome Web browsers, is to check for a new HTTP header, X-Frame-Options. This header can have two values, deny and sameorigin, which will block any framing or framing by external sites, respectively.
-In 2010 a paper was published highlighting limitations of current frame-busting techniques and proposing improved version:
+Both framekillers and IE8's mitigation approach, however, require Web developers to protect vulnerable pages by modifying their content or the way they are served, although, even on "protected" pages, they cannot prevent plugin-based clickjacking variants[citation needed] since they don't need frames.
- <style> html{display : none ; } </style>
+Firefox includes X-Frame-Options clickjacking protection since version 3.6.9, released on 7 September 2010.