02 February 2009 | 7,026 views

Chrome and Firefox Face Clickjacking Exploit

Check For Vulnerabilities with Acunetix

Just remember that even though Firefox tends to be more secure than Internet Exploder – it’s not immune from vulnerabilities (although they do tend to get fixed much much faster).

The latest one that’s cropped up in both Firefox and Chrome is a clickjacking vulnerability. This is basically where a link is replaced by an attacker to lead to a site (which would usually be setup to deliver malware).

You can find the Proof of Concept (PoC) here.

Security researchers have discovered a flaw affecting Google’s Chrome browser that exposes it to “clickjacking”–in which an attacker hijacks a browser’s functions by substituting a legitimate link with one of the attacker’s choice.

Google has acknowledged the flaw and is working toward a patch for Chrome versions 1.0.154.43 and earlier when running within Windows XP SP2 systems, according to SecNiche security researcher Aditya Sood.

Sood disclosed the flaw on Tuesday and has since posted a proof of concept on the Bugtraq vulnerability disclosure forum.

“Attackers can trick users into performing actions which the users never intended to do and there is no way of tracing such actions later, as the user was genuinely authenticated on the other page,” Sood said within the disclosure.

While Google is working on a fix, a representative for the Australian arm of the company pointed out that clickjacking can affect all browsers, not just Chrome.

I’m pretty sure there has been an Internet Explorer Clickjacking bug going around recently too. There was something with IE8 and apparently the ‘fix’ didn’t even help much.

So as always be cautious with what you’re clicking, and if you are super Paranoid just turn off all Javascript.

If you are even more paranoid…just go back to using Lynx on the command line :)

Either way it’s a fairly new brand of vulnerability so I’m sure it will be developed into a more complex and perhaps damaging variation.

However, Nishad Herath, an independent security researcher and CEO of Australian security consultancy Novologica, told ZDNet.com.au that after running Sood’s proof of concept he found that Internet Explorer 8 (release candidate 1 and beta 2 versions) and Opera 9.63 (the latest version) were not exposed to the flaw. But, like Chrome, Firefox 3.0.5 was exposed.

Google’s security researchers had not found any attacks in the wild that exploited the specific vulnerability, said Google’s representative.

Clickjacking is a relatively new browser attack that security researchers Robert Hansen and Jeremiah Grossman gave a talk on it late last year at the Open Web Application Security Project security conference in New York. Such an attack broadly fits within the category of cross-site scripting forgery, where an attacker uses maliciously crafted HTML or JavaScript code to force a victim’s browser to send an HTTP request to a Web site of their choosing.

“Clickjacking means that any interaction you have with a Web site you’re on, for example like clicking on a link, may not do what you expect it to do,” explained Herath.

I’d except Firefox to come out with an updated version pretty soon patched against this vulnerability, I’m not so sure about the release cycle of Chrome but I’d be surprised if Google let this slide.

It’ll be interesting to watch how far this goes.

Source: Cnet (Thanks Navin)



Recent in Exploits/Vulnerabilities:
- Hacking Your Fridge – Internet of Things Security
- Important OpenSSL Patch – 6 More Vulnerabilities
- Spotify Hacked – Rolls Out New Android App

Related Posts:
- Mozilla Denies Firefox 3.5 Bug Is Exploitable
- Twitter ClickJacking Vulnerability
- Data Leakage Bug in Mozilla Firefox Confirmed

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 226,944 views
- AJAX: Is your application secure enough? - 119,052 views
- eEye Launches 0-Day Exploit Tracker - 85,036 views

Advertise on Darknet

7 Responses to “Chrome and Firefox Face Clickjacking Exploit”

  1. LightOS 2 February 2009 at 7:17 pm Permalink

    I.E. 7 is also affected, here’s a PoC for each browser.

    http://milw0rm.com/exploits/7912 – IE 7
    http://milw0rm.com/exploits/7903 – Chrome 1.0
    http://milw0rm.com/exploits/7842 – FF 3.0.5

    These attacks don’t always require JavaScript, they can also be accomplished with CSS.

  2. Morgan Storey 2 February 2009 at 11:11 pm Permalink

    Oh noes clickjacking in firefox and Chrome… I really think these vulns were hyped by Microsofts IE8 department now that they have their rather badly implemented anti-clickjacking technology…

    FF with no scripts built in clikcjacking defence stops this no questions asked. IE7 and even IE8 are still vulnerable to a lot of clickjacking that is done. Chrome updates without user interaction so it is probably already updated by the time I hit submit.

  3. dblackshell 3 February 2009 at 3:05 am Permalink

    @Morgan Storey: the clickjacking defense in NoScripts is called ClearClick ;)

    and IE8 (which even isn’t out yet) isn’t patched against ClickJacking, it only implements an additional HTTP reader, X-FRAME… (forgot the whole name of the header) =)

  4. navin 3 February 2009 at 4:09 pm Permalink

    @ lightOS
    Thanks for the links!!

    @Dblackshell
    Thanks for Clearclick ….might sound very n00bish, but I din’t know abt it!!

    @All other n00bs like me:
    Read abt Clearclick @ http://hackademix.net/2008/10/08/hello-clearclick-goodbye-clickjacking/

    @ Darknet
    cheers!! :)

  5. Morgan Storey 4 February 2009 at 1:55 am Permalink

    @dblackshell: I didn’t know what NoScripts clickjacking defence was called, hence my vagueness, but I know it is there. The dev build even implements IE8′s non-standard HTTP header, I think just for giggles.

    IE8 is out, as beta and they are heavily touting its security improvements, including the http header clickjacking defence. They actaully had the gall to say they where the first browser with clickjacking defence. I know IE8′s defence requires the website to have the additional header, hence why I mentioned it being a poor implementation. This same technique can be done with a framebusting header, the issue here is that IE doesn’t support this standard, hence why they decided to implement their own, cause they probably couldn’t get it to work.

  6. Rafal Los 4 February 2009 at 6:34 am Permalink

    The solution is rather stupid. FireFox + NoScript. I can has basic security?

  7. Morgan Storey 5 February 2009 at 9:58 am Permalink

    @Rafal Los: how is that a stupid solution. If security where easy we would have no compromises, no data loss, it will never be easy, things will get fixed and more issues will replace them. There is another solution, block it through the firewall, proxy and IDS, but this is only so good, and only one layer. FF + NoScript + not running programs as an admin is a good start on the client.