Chrome and Firefox Face Clickjacking Exploit


Just remember that even though Firefox tends to be more secure than Internet Exploder – it’s not immune from vulnerabilities (although they do tend to get fixed much much faster).

The latest one that’s cropped up in both Firefox and Chrome is a clickjacking vulnerability. This is basically where a link is replaced by an attacker to lead to a site (which would usually be setup to deliver malware).

You can find the Proof of Concept (PoC) here.

Security researchers have discovered a flaw affecting Google’s Chrome browser that exposes it to “clickjacking”–in which an attacker hijacks a browser’s functions by substituting a legitimate link with one of the attacker’s choice.

Google has acknowledged the flaw and is working toward a patch for Chrome versions 1.0.154.43 and earlier when running within Windows XP SP2 systems, according to SecNiche security researcher Aditya Sood.

Sood disclosed the flaw on Tuesday and has since posted a proof of concept on the Bugtraq vulnerability disclosure forum.

“Attackers can trick users into performing actions which the users never intended to do and there is no way of tracing such actions later, as the user was genuinely authenticated on the other page,” Sood said within the disclosure.

While Google is working on a fix, a representative for the Australian arm of the company pointed out that clickjacking can affect all browsers, not just Chrome.

I’m pretty sure there has been an Internet Explorer Clickjacking bug going around recently too. There was something with IE8 and apparently the ‘fix’ didn’t even help much.

So as always be cautious with what you’re clicking, and if you are super Paranoid just turn off all Javascript.

If you are even more paranoid…just go back to using Lynx on the command line :)

Either way it’s a fairly new brand of vulnerability so I’m sure it will be developed into a more complex and perhaps damaging variation.

However, Nishad Herath, an independent security researcher and CEO of Australian security consultancy Novologica, told ZDNet.com.au that after running Sood’s proof of concept he found that Internet Explorer 8 (release candidate 1 and beta 2 versions) and Opera 9.63 (the latest version) were not exposed to the flaw. But, like Chrome, Firefox 3.0.5 was exposed.

Google’s security researchers had not found any attacks in the wild that exploited the specific vulnerability, said Google’s representative.

Clickjacking is a relatively new browser attack that security researchers Robert Hansen and Jeremiah Grossman gave a talk on it late last year at the Open Web Application Security Project security conference in New York. Such an attack broadly fits within the category of cross-site scripting forgery, where an attacker uses maliciously crafted HTML or JavaScript code to force a victim’s browser to send an HTTP request to a Web site of their choosing.

“Clickjacking means that any interaction you have with a Web site you’re on, for example like clicking on a link, may not do what you expect it to do,” explained Herath.

I’d except Firefox to come out with an updated version pretty soon patched against this vulnerability, I’m not so sure about the release cycle of Chrome but I’d be surprised if Google let this slide.

It’ll be interesting to watch how far this goes.

Source: Cnet (Thanks Navin)

Posted in: Exploits/Vulnerabilities, Web Hacking

, , , , , , ,


Latest Posts:


truffleHog - Search Git for High Entropy Strings with Commit History truffleHog – Search Git for High Entropy Strings with Commit History
truffleHog is a Python-based tool to search Git for high entropy strings, digging deep into commit history and branches. This is effective at finding secrets accidentally committed.
AIEngine - AI-driven Network Intrusion Detection System AIEngine – AI-driven Network Intrusion Detection System
AIEngine is a next-generation interactive/programmable Python/Ruby/Java/Lua and Go AI-driven Network Intrusion Detection System engine with many capabilities.
Sooty - SOC Analyst All-In-One CLI Tool Sooty – SOC Analyst All-In-One CLI Tool
Sooty is a tool developed with the task of aiding a SOC analyst to automate parts of their workflow and speed up their process.
UBoat - Proof Of Concept PoC HTTP Botnet Project UBoat – Proof Of Concept PoC HTTP Botnet Project
UBoat is a PoC HTTP Botnet designed to replicate a full weaponised commercial botnet like the famous large scale infectors Festi, Grum, Zeus and SpyEye.
LambdaGuard - AWS Lambda Serverless Security Scanner LambdaGuard – AWS Lambda Serverless Security Scanner
LambdaGuard is a tool which allows you to visualise and audit the security of your serverless assets, an open-source AWS Lambda Serverless Security Scanner.
exe2powershell - Convert EXE to BAT Files exe2powershell – Convert EXE to BAT Files
exe2powershell is used to convert EXE to BAT files, the previously well known tool for this was exe2bat, this is a version for modern Windows.


7 Responses to Chrome and Firefox Face Clickjacking Exploit

  1. LightOS February 2, 2009 at 7:17 pm #

    I.E. 7 is also affected, here’s a PoC for each browser.

    http://milw0rm.com/exploits/7912 – IE 7
    http://milw0rm.com/exploits/7903 – Chrome 1.0
    http://milw0rm.com/exploits/7842 – FF 3.0.5

    These attacks don’t always require JavaScript, they can also be accomplished with CSS.

  2. Morgan Storey February 2, 2009 at 11:11 pm #

    Oh noes clickjacking in firefox and Chrome… I really think these vulns were hyped by Microsofts IE8 department now that they have their rather badly implemented anti-clickjacking technology…

    FF with no scripts built in clikcjacking defence stops this no questions asked. IE7 and even IE8 are still vulnerable to a lot of clickjacking that is done. Chrome updates without user interaction so it is probably already updated by the time I hit submit.

  3. dblackshell February 3, 2009 at 3:05 am #

    @Morgan Storey: the clickjacking defense in NoScripts is called ClearClick ;)

    and IE8 (which even isn’t out yet) isn’t patched against ClickJacking, it only implements an additional HTTP reader, X-FRAME… (forgot the whole name of the header) =)

  4. navin February 3, 2009 at 4:09 pm #

    @ lightOS
    Thanks for the links!!

    @Dblackshell
    Thanks for Clearclick ….might sound very n00bish, but I din’t know abt it!!

    @All other n00bs like me:
    Read abt Clearclick @ http://hackademix.net/2008/10/08/hello-clearclick-goodbye-clickjacking/

    @ Darknet
    cheers!! :)

  5. Morgan Storey February 4, 2009 at 1:55 am #

    @dblackshell: I didn’t know what NoScripts clickjacking defence was called, hence my vagueness, but I know it is there. The dev build even implements IE8’s non-standard HTTP header, I think just for giggles.

    IE8 is out, as beta and they are heavily touting its security improvements, including the http header clickjacking defence. They actaully had the gall to say they where the first browser with clickjacking defence. I know IE8’s defence requires the website to have the additional header, hence why I mentioned it being a poor implementation. This same technique can be done with a framebusting header, the issue here is that IE doesn’t support this standard, hence why they decided to implement their own, cause they probably couldn’t get it to work.

  6. Rafal Los February 4, 2009 at 6:34 am #

    The solution is rather stupid. FireFox + NoScript. I can has basic security?

  7. Morgan Storey February 5, 2009 at 9:58 am #

    @Rafal Los: how is that a stupid solution. If security where easy we would have no compromises, no data loss, it will never be easy, things will get fixed and more issues will replace them. There is another solution, block it through the firewall, proxy and IDS, but this is only so good, and only one layer. FF + NoScript + not running programs as an admin is a good start on the client.