hacks

There has been quite a bit of talk going on over the past couple weeks which looks like a scary new browser exploit affecting all the major desktop platforms — Microsoft Internet Explorer, Mozilla Firefox, Apple Safari, Opera and Adobe Flash.

The threat, called Clickjacking, was to be discussed at the OWASP NYC AppSec 2008 Conference but, at the request of Adobe and other affected vendors, the talk was nixed until a comprehensive fix is ready.

The two researchers behind the discovery — Robert Hansen and Jeremiah Grossman — have released some  information to highlight the severity of this issue.

So, what exactly is Clickjacking?

According to reports from the conference, the issue is indeed zero-day, affects all the major browsers and has nothing to do with JavaScript:

“In a nutshell, it’s when you visit a malicious website and the attacker is able to take control of the links that your browser visits.  The problem affects all of the different browsers except something like lynx.  The issue has nothing to do with JavaScript so turning JavaScript off in your browser will not help you.  It’s a fundamental flaw with the way your browser works and cannot be fixed with a simple patch.  With this exploit, once you’re on the malicious web page, the bad guy can make you click on any link, any button, or anything on the page without you even seeing it happening.  “A normal user wouldn’t have any idea of what is going on.  People in this audience may see something a little different from what they would expect and you would definitely see the results in the page’s source code.”  Ebay, for example, would be vulnerable to this since you could embed javascript into the web page, although, javascript is not required to exploit this.  “It makes it easier in many ways, but you do not need it.”  Use lynx to protect yourself and don’t do dynamic anything.  You can “sort of” fill out forms and things like that.  The exploit requires DHTML.  Not letting yourself be framed (framebusting code) will prevent cross-domain clickjacking, but an attacker can still force you to click any links on their page.  Each click by the user equals a clickjacking click so something like a flash game is perfect bait. The issue and fix will probably be originally released on http://ihackcharities.org”.

What makes this even scarier is that an average user would have no idea that a clickjack attack was happening.
Apparently the threat scenario has been discussed with both Microsoft and Mozilla and they agreed independently that this is a tough problem with no easy solution at the moment.