Click-jacking has hit the news a few times recently with most browsers being susceptible to this kind of redirection attack.

This time it’s Twitter that’s being hit, as with anything gaining popularity it’s going to become the focus of more attacks and attempts to compromise its security.

It seems like click-jacking may well be here to stay and it might become a widespread problem, especially for sites with interactive content and especially for those based around ‘voting‘ systems.

Two weeks after the micro-blogging site immunized its users against a fast-moving worm that caused them to unintentionally broadcast messages when they clicked on an innocuous-looking button, hackers have found a new way to exploit the clickjacking vulnerability.

The latest attack comes from UK-based web developer Tom Graham, who discovered that the fix Twitter rolled out wasn’t applied to the mobile phone section of the site. By the time we stumbled on his findings, the exploit no longer worked. But security consultant Rafal Los sent us a minor modification that sufficiently pwned a dummy account we set up for testing purposes.

“The mobile site currently has no javascript on it at all, which is probably for a good reason as most mobile phones don’t support it,” Graham writes. “So it begs the question, how should Twitter prevent this click-jacking exploit?”

This problem was once again quickly fixed, but I’m sure it can be tweaked again to wreak havoc. Plus of course these vulnerabilities are being published in the open and blown up on mass-media sites so they get attention quickly.

I’m sure there’s plenty of people out there who aren’t quite so honourable and are more interested in gaming the system for their own benefit.

It’s an interesting way for spammers to infest Twitter with spam on legitimate accounts, all they have to do is get the user to click a button somewhere on a quiz or game and it’s a done deal.

The proof-of-concept page presents the user with the question “Do you have a tiny face?” along with buttons to answer “yes” or “no.” Choosing the affirmative while logged in to Twitter causes the account to publicly declare: “I have a tiny face, do you?” and then include a link to Graham’s post.

The exploit is the latest reason to believe that clickjacking, on Twitter and elsewhere, is here to stay, at least until HTML specifications are rewritten. No doubt web developers will continue to come up with work-arounds, but hackers can just as quickly find new ways to exploit the vulnerability, it seems.

That’s because clickjacking attacks a fundamental design of HTML itself. It’s pulled off by hiding the target URL within a specially designed iframe that’s concealed by a decoy page that contains submission buttons. Virtually every website and browser is susceptible to the technique.

It’ll be interesting to see how long this cat and mouse chase goes on and if a version of the exploit can be crafted that will still work whatever Twitter does (discounting a major rebuild of their architecture and technology).

I’m sure other sites are vulnerable too, perhaps we’ll see Facebook version soon which will post a Note or a message on your profile crafted by the site serving up the click-jacking exploit.

Source: The Register

Just remember that even though Firefox tends to be more secure than Internet Exploder – it’s not immune from vulnerabilities (although they do tend to get fixed much much faster).

The latest one that’s cropped up in both Firefox and Chrome is a clickjacking vulnerability. This is basically where a link is replaced by an attacker to lead to a site (which would usually be setup to deliver malware).

You can find the Proof of Concept (PoC) here.

Security researchers have discovered a flaw affecting Google’s Chrome browser that exposes it to “clickjacking”–in which an attacker hijacks a browser’s functions by substituting a legitimate link with one of the attacker’s choice.

Google has acknowledged the flaw and is working toward a patch for Chrome versions 1.0.154.43 and earlier when running within Windows XP SP2 systems, according to SecNiche security researcher Aditya Sood.

Sood disclosed the flaw on Tuesday and has since posted a proof of concept on the Bugtraq vulnerability disclosure forum.

“Attackers can trick users into performing actions which the users never intended to do and there is no way of tracing such actions later, as the user was genuinely authenticated on the other page,” Sood said within the disclosure.

While Google is working on a fix, a representative for the Australian arm of the company pointed out that clickjacking can affect all browsers, not just Chrome.

I’m pretty sure there has been an Internet Explorer Clickjacking bug going around recently too. There was something with IE8 and apparently the ‘fix’ didn’t even help much.

So as always be cautious with what you’re clicking, and if you are super Paranoid just turn off all Javascript.

If you are even more paranoid…just go back to using Lynx on the command line :)

Either way it’s a fairly new brand of vulnerability so I’m sure it will be developed into a more complex and perhaps damaging variation.

However, Nishad Herath, an independent security researcher and CEO of Australian security consultancy Novologica, told ZDNet.com.au that after running Sood’s proof of concept he found that Internet Explorer 8 (release candidate 1 and beta 2 versions) and Opera 9.63 (the latest version) were not exposed to the flaw. But, like Chrome, Firefox 3.0.5 was exposed.

Google’s security researchers had not found any attacks in the wild that exploited the specific vulnerability, said Google’s representative.

Clickjacking is a relatively new browser attack that security researchers Robert Hansen and Jeremiah Grossman gave a talk on it late last year at the Open Web Application Security Project security conference in New York. Such an attack broadly fits within the category of cross-site scripting forgery, where an attacker uses maliciously crafted HTML or JavaScript code to force a victim’s browser to send an HTTP request to a Web site of their choosing.

“Clickjacking means that any interaction you have with a Web site you’re on, for example like clicking on a link, may not do what you expect it to do,” explained Herath.

I’d except Firefox to come out with an updated version pretty soon patched against this vulnerability, I’m not so sure about the release cycle of Chrome but I’d be surprised if Google let this slide.

It’ll be interesting to watch how far this goes.

Source: Cnet (Thanks Navin)