Chrome and Firefox Face Clickjacking Exploit

Outsmart Malicious Hackers


Just remember that even though Firefox tends to be more secure than Internet Exploder – it’s not immune from vulnerabilities (although they do tend to get fixed much much faster).

The latest one that’s cropped up in both Firefox and Chrome is a clickjacking vulnerability. This is basically where a link is replaced by an attacker to lead to a site (which would usually be setup to deliver malware).

You can find the Proof of Concept (PoC) here.

Security researchers have discovered a flaw affecting Google’s Chrome browser that exposes it to “clickjacking”–in which an attacker hijacks a browser’s functions by substituting a legitimate link with one of the attacker’s choice.

Google has acknowledged the flaw and is working toward a patch for Chrome versions 1.0.154.43 and earlier when running within Windows XP SP2 systems, according to SecNiche security researcher Aditya Sood.

Sood disclosed the flaw on Tuesday and has since posted a proof of concept on the Bugtraq vulnerability disclosure forum.

“Attackers can trick users into performing actions which the users never intended to do and there is no way of tracing such actions later, as the user was genuinely authenticated on the other page,” Sood said within the disclosure.

While Google is working on a fix, a representative for the Australian arm of the company pointed out that clickjacking can affect all browsers, not just Chrome.

I’m pretty sure there has been an Internet Explorer Clickjacking bug going around recently too. There was something with IE8 and apparently the ‘fix’ didn’t even help much.

So as always be cautious with what you’re clicking, and if you are super Paranoid just turn off all Javascript.

If you are even more paranoid…just go back to using Lynx on the command line :)

Either way it’s a fairly new brand of vulnerability so I’m sure it will be developed into a more complex and perhaps damaging variation.

However, Nishad Herath, an independent security researcher and CEO of Australian security consultancy Novologica, told ZDNet.com.au that after running Sood’s proof of concept he found that Internet Explorer 8 (release candidate 1 and beta 2 versions) and Opera 9.63 (the latest version) were not exposed to the flaw. But, like Chrome, Firefox 3.0.5 was exposed.

Google’s security researchers had not found any attacks in the wild that exploited the specific vulnerability, said Google’s representative.

Clickjacking is a relatively new browser attack that security researchers Robert Hansen and Jeremiah Grossman gave a talk on it late last year at the Open Web Application Security Project security conference in New York. Such an attack broadly fits within the category of cross-site scripting forgery, where an attacker uses maliciously crafted HTML or JavaScript code to force a victim’s browser to send an HTTP request to a Web site of their choosing.

“Clickjacking means that any interaction you have with a Web site you’re on, for example like clicking on a link, may not do what you expect it to do,” explained Herath.

I’d except Firefox to come out with an updated version pretty soon patched against this vulnerability, I’m not so sure about the release cycle of Chrome but I’d be surprised if Google let this slide.

It’ll be interesting to watch how far this goes.

Source: Cnet (Thanks Navin)

Posted in: Exploits/Vulnerabilities, Web Hacking

, , , , , , ,


Latest Posts:


OWASP ZSC - Obfuscated Code Generator Tool OWASP ZSC – Obfuscated Code Generator Tool
OWASP ZSC is an open source obfuscated code generator tool in Python which lets you generate customized shellcodes and convert scripts to an obfuscated script.
A Look Back At 2017 – Tools & News Highlights A Look Back At 2017 – Tools & News Highlights
So here we are in 2018, taking a look back at 2017, quite a year it was. Here is a quick rundown of some of the best hacking/security tools released in 2017, the biggest news stories and the 10 most viewed posts on Darknet as a bonus.
Spectre & Meltdown Checker - Vulnerability Mitigation Tool For Linux Spectre & Meltdown Checker – Vulnerability Mitigation Tool For Linux
Spectre & Meltdown Checker is a simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs that were made public early 2018.
Hijacker - Reaver For Android Wifi Hacker App Hijacker – Reaver For Android Wifi Hacker App
Hijacker is a native GUI which provides Reaver for Android along with Aircrack-ng, Airodump-ng and MDK3 making it a powerful Wifi hacker app.
Sublist3r - Fast Python Subdomain Enumeration Tool Sublist3r – Fast Python Subdomain Enumeration Tool
Sublist3r is a Python-based tool designed to enumerate subdomains of websites using OSINT. It helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting.
coWPAtty Download - Audit Pre-shared WPA Keys coWPAtty Download – Audit Pre-shared WPA Keys
coWPAtty is a C-based tool for running a brute-force dictionary attack against WPA-PSK and audit pre-shared WPA keys.


7 Responses to Chrome and Firefox Face Clickjacking Exploit

  1. LightOS February 2, 2009 at 7:17 pm #

    I.E. 7 is also affected, here’s a PoC for each browser.

    http://milw0rm.com/exploits/7912 – IE 7
    http://milw0rm.com/exploits/7903 – Chrome 1.0
    http://milw0rm.com/exploits/7842 – FF 3.0.5

    These attacks don’t always require JavaScript, they can also be accomplished with CSS.

  2. Morgan Storey February 2, 2009 at 11:11 pm #

    Oh noes clickjacking in firefox and Chrome… I really think these vulns were hyped by Microsofts IE8 department now that they have their rather badly implemented anti-clickjacking technology…

    FF with no scripts built in clikcjacking defence stops this no questions asked. IE7 and even IE8 are still vulnerable to a lot of clickjacking that is done. Chrome updates without user interaction so it is probably already updated by the time I hit submit.

  3. dblackshell February 3, 2009 at 3:05 am #

    @Morgan Storey: the clickjacking defense in NoScripts is called ClearClick ;)

    and IE8 (which even isn’t out yet) isn’t patched against ClickJacking, it only implements an additional HTTP reader, X-FRAME… (forgot the whole name of the header) =)

  4. navin February 3, 2009 at 4:09 pm #

    @ lightOS
    Thanks for the links!!

    @Dblackshell
    Thanks for Clearclick ….might sound very n00bish, but I din’t know abt it!!

    @All other n00bs like me:
    Read abt Clearclick @ http://hackademix.net/2008/10/08/hello-clearclick-goodbye-clickjacking/

    @ Darknet
    cheers!! :)

  5. Morgan Storey February 4, 2009 at 1:55 am #

    @dblackshell: I didn’t know what NoScripts clickjacking defence was called, hence my vagueness, but I know it is there. The dev build even implements IE8’s non-standard HTTP header, I think just for giggles.

    IE8 is out, as beta and they are heavily touting its security improvements, including the http header clickjacking defence. They actaully had the gall to say they where the first browser with clickjacking defence. I know IE8’s defence requires the website to have the additional header, hence why I mentioned it being a poor implementation. This same technique can be done with a framebusting header, the issue here is that IE doesn’t support this standard, hence why they decided to implement their own, cause they probably couldn’t get it to work.

  6. Rafal Los February 4, 2009 at 6:34 am #

    The solution is rather stupid. FireFox + NoScript. I can has basic security?

  7. Morgan Storey February 5, 2009 at 9:58 am #

    @Rafal Los: how is that a stupid solution. If security where easy we would have no compromises, no data loss, it will never be easy, things will get fixed and more issues will replace them. There is another solution, block it through the firewall, proxy and IDS, but this is only so good, and only one layer. FF + NoScript + not running programs as an admin is a good start on the client.