Disclaimer

Any opinions expressed here are my own and not necessarily those of my employer (I'm self-employed).

Nov 12, 2010

Defeating Clickjacking

The clickjacking vulnerability is receiving an increasing amount of attention. There has been some interesting advances in exploitation techniques, as explained in this video: Next generation clickjacking by Paul Stone at the Blackhat Europe 2010 security conference.

Let's first summarize the basic properties of a clickjacking attack:
  1. The attacker can load a page from your website in an iframe
  2. The attacker can have the user perform mouse operations on your webpage, i.e. clicking buttons, dragging and dropping content etc.
If we can prevent a webpage from being embedded in an iFrame, the clickjacking vulnerability will be mitigated. Framebusting is the traditional approach to prevent clickjacking attacks — a javascript embedded in a webpage to detect framing and try to "bust out" of the frame.  However, a recent study by researchers at Stanford summarizes common framebusting efforts and concludes that framebusting fails to mitigate the risk.


Framebusting is by design a reactive measure, ineffective until the browser is already loading the page in an iframe. This gives the attacker the upper hand! You'll have to put your framebusting script out there on the web, giving an attacker plenty of time to figure out a way to detronize your script. This battle of clever scripts between the good guys and bad guys can probably go on forever.  That's why we want to thwart this attack by design, not through implementation.

Let's just win the battle
We need to deal with clickjacking challenge before the page is loaded in an iFrame. This means that if there's nothing to click, or drag n' drop in the iFrame, we have removed the cause of the clickjacking attacks as we know them today.  The script battle ends.

Fortunately, since the latest release of Firefox, all the major browsers (IE8, Safari, Opera, Firefox, Chrome) support a countermeasure specifically targeting clickjacking attempts:  The X-Frame-Options HTTP header. This header instructs the browser whether a page can be included in a frame or not and takes the following form:

X-Frame-Options: sameorigin | deny

The sameorigin setting will allow framing of pages on the same domain — the deny setting will completely disable framing of a page. The nifty property of this countermeasure is that the browser itself will refuse to even load the page that's being framed — the battle of clever scripts is completely avoided.

So, check out the X-Frame-Options header and enable it for your site ASAP. Read more about it here.

Note: If you are dependent on other sites loading your pages in frames, X-Frame-Options will only cause problems for you.

Why the battle's not won tomorrow
Unfortunately, not all users are running an up to date browser — in fact, many users cannot upgrade their browser, as their employers are calling the shots on which versions to run in their corporate network. I experienced this when we made breaking changes for older web browsers in a web application at my employer. The users that experienced the most problems where the one's who where forced to use IE6 at work. Many of them reported that everything worked as expected from their computer at home. As a sidenote, the change was introduced only months before IE6 was EOL, so the issues should not have come as a complete surprise for the corporations running IE6.

We should urge both organizations and users to keep their browsers updated. Many modern attacks target the browser, and security on the web is now pretty much a function of both server side and client side security measures.

Preparing to win
The HTTP header approach is the preferred clickjacking countermeasure because it solves the root cause of the vulnerability. In addition, it is much easier to deploy to both new/old/legacy systems as it can easily be "wrapped" around existing web applications through web server configuration.

To enable the X-Frame-options header in IIS, go to the HTTP Headers section of your site config:




**UPDATE**: If you run an ASP.NET application on IIS7, you can also do this in web.config.

In Apache you can achieve the same thing by adding the following to your config file (httpd.conf or .htaccess, whichever you have access to, it requires the mod_headers module):

Header set X-Frame-Options "sameorigin"

Enable the header and make the world a safer place!

80 comments:

  1. X-Frame-Options not X-Frames-Options

    ReplyDelete
    Replies
    1. Ugh, that was a horrible but consistent typo. Thanks for pointing that out.

      Delete
  2. كما تقدم المؤسسة خدمة تطهير عفش منزلك خدمة تطهير بيوت بأفضل الأجهزة كخدمات إضافية مع خدمة نقل الأثاث ليتم نقل عفش منزلك بحالة نظافة تامة وبأجود وأفضل ما ترغب في، تتواصل معنا لتبدأ نقل أثاث أثاث منزلك وبأفضل اختيارات النقل المتوفرة وبأقل أسعار مؤسسات النقل، نحاول طول الوقت لتقديم أرقى الخدمات لعملائنا الكرام.
    شركه نقل عفش من الرياض الى ابها
    شركه نقل اثاث من الرياض الى ابها
    شركه نقل عفش

    ReplyDelete
  3. Sample Assignment bestows over the college going students with online assignment help. It is a consultancy possessing academic experts providing a number of subject-specific assignment helps. Marketing assignment help, economics assignment help, MATLAB assignment Help, MySQL assignment help, management assignment help, etc. are a few to name. The assignment help packages that they supply the students with ensure the students receive an HD or a full money back. With their assignment consultation services, the students can learn by exposing themselves to out-of-the-box learning when it comes to module related studies. For the quality of the in-depth research that is conducted before the experts at Sample Assignment lay their hands on a specific assignment, the prices are kept very close to the ground while the company has its head touching the sky. They offer services in Essays, CDRs, Resumes, Thesis, Research Proposals, Research Papers, Dissertations, etc. Be it any of the above, they provide ready to study from assignment solutions to the students who work-save in order to pay for the service and the online assignment services provider works on the motive of giving out value for every coin a particular student pays for the online assignment help Australia. With their Partial Payment and the optional feature of Countless Revisions, they have earned themselves two consecutive years of recognition.

     

     

     

    ReplyDelete
  4. "Insightful" is the perfect word to describe this wonderful writing of yours. The artistic blend of this subject with your tone of writing made this a great read. Much love 😘.
    How to bottom

    ReplyDelete
  5. When we are providing Cheap Term Paper Service, we care about the career of all our clients. With any Custom Research Papers Services that student requests from us, we have to use all the relevant resources that we have to write a quality paper and one that demonstrates an excellent understanding of the topic.

    ReplyDelete
  6. it seems really amazing. i would really like to know more about it.

    ReplyDelete
  7. Here we provide the all latest exams results notifications and job alerts in our website. Its is a best platform for students and those who are searching for sarkari job notification directly visit our site to get job notification,admit card,syllabus,answer key, results at latest exam result site .

    ReplyDelete
  8. This article makes life happy, bright and gives good ideas.
    Sa gaming สมัคร

    ReplyDelete
  9. Online religion research paper writing services are very difficult to complete and many students are always searching for Religion Research Paper Services companies to help them complete their custom religion essay writing services.

    ReplyDelete
  10. There are many Online Coursework writing services and Help with Coursework Writing services to choose from for those stuck with their psychology coursework writing services and nursing coursework writing help services.

    ReplyDelete
  11. https://hmzapc.com/purevpn-torrent-downloass/
    This is so great I don’t need to make any revisions to it at all.

    ReplyDelete
  12. https://crackchkey.com/spyhunter-5-crack/
    You are so creative—I always love getting your perspective on things.

    ReplyDelete
  13. I think this is one of the great posts on this topic. This post is really great, very efficiently written information. Keep up the good work and keep us sharing these kinds of informative posts with us. I will also try to check out your other posts.
    Full-Stack Developer
    App development
    Front End Developer
    Virtual Employee

    ReplyDelete
  14. If you are looking for the Non-plagiarized Research Papers Online then get connected with Custom Research Writing Services and get your research done on time. You can also purchase Pre-written Research Papers that will leave an impression.

    ReplyDelete
  15. https://cracksray.com/quarkxpress-crack/

    QuarkXPress allows the user to deliver responsive web designs without the need for coding. Flex Layouts do not require any coding skills.

    ReplyDelete
  16. https://lpcrack.com/anno-1800-crack/

    Anno 1800 is a game of city building, economic simulation, and constructing the cities and temples according to your taste and considerations.

    ReplyDelete
  17. https://zsactivatorskey.com/alfa-ebooks-manager-pro-crack/

    Alfa eBooks Manager Pro delivers customized features with better color schemes and themes. Also, it performs the scanning of the system automatically.

    ReplyDelete
  18. https://cskeygen.com/wifi-password-hacker/

    WiFi Password Generator allows us to hack all networks with the latest technologies like WPA2. It is available as gadgets in different mobiles.

    ReplyDelete
  19. https://cracksad.com/cobra-driver-pack-crack/

    Cobra Driver Pack does not require any special hardware requirements. After downloading the setup, you can install it easily without any issue.

    ReplyDelete
  20. https://crackdad.com/final-cut-pro-x-crack/

    Final Cut Pro X provides you with all the basics features you need to create your movies along with a wide range of extra features that can make your movies even better.

    ReplyDelete
  21. https://zayanpc.com/reimage-pc-repair-crack/

    Reimage PC Repair has a robust malware cancellation mechanism. It makes sure that the User can repair any entity which is threatening the optimal functioning of the system. It cleans and replaces any erroneous files for the speed of the system to enhance.

    ReplyDelete
  22. Clickjacking is a technique of tricking a user into clicking on something different from what the user perceives, thus potentially revealing confidential information or allowing others to take control of their computer while clicking on seemingly innocuous objects, including web pages. This activity is negative, and we should avoid from such kind of activities. Dissertation writing services.

    ReplyDelete
  23. 3DMark Crack
    3DMark Crack is a custom software of benchmarking for a Mac system. Produce through the Future Mark company. It also looks at the appearance of 3D graphics processing of a Pc.

    ReplyDelete
  24. Unity Pro Crack
    Unity Pro Crack is the best game developing tool for android and other PC games. Therefore, this tool used for the developer to make 2D and 3D games.

    ReplyDelete
  25. Tableau Desktop Crack
    Tableau Desktop Crack is a popular source for news and updates in the world. And you can use to create a report of your data there also, this is a much useful tool that use this app to manage all kind of statistic there.

    ReplyDelete
  26. NordVPN Crack
    NordVPN Crack Is fulfills all online data-security software that has millions of downloads. While, for online stability functions, NordVPN may be the best option. Also, it includes improved rates and performance compared to the other players.

    ReplyDelete
  27. TeraCopy Pro Crack
    TeraCopy Pro Crack is a compact software tool that specially designed to copy and moves files. Therefore, this tool uses to skip the dangerous files and also copy the skipped files. In addition, this tool uses to work the crack files and free form in our software library.

    ReplyDelete
  28. VueScan Crack
    VueScan Crack is just one of the most wanted scanner tool that allows you to get a higher quality of the image with a lot of option. Therefore, this tool has a greater chance that use to enhance the option in the feature.

    ReplyDelete
  29. Adobe Fireworks Crack
    Adobe Fireworks Crack This software is wonderful to help you to design websites ad mobile apps in the snap. It uses to deliver and get the bitmap images in the mockup.

    ReplyDelete
  30. You Can Also Download Free Software & Mac
    https://tijacrack.com/quarkxpress-crack/

    ReplyDelete
  31. Is this a paid topic or do you change it yourself?
    However, stopping by with great quality writing, it's hard to see any good blog today.
    fullcrackedpc.com
    3DMark Crack
    Avira Antivirus Pro Crack
    Slate Digital VMR Complete Bundle Crack
    Advanced SystemCare Pro Crack
    3D Coat Crack

    ReplyDelete
  32. AVG Internet Security Crack is complete and ultimate protection for your PC and your online identity! This award-winning virus protection product gives you unbeatable internet security by protecting you from viruses, spyware, hackers, spam, and malicious websites. And it will even prevent you from accidentally visiting harmful sites, protect your identity while shopping and banking. AVG Internet Security is a reliable and easy-to-use solution for homes and small offices trusted by millions of users around the world. Developer AVG Technologies is a favorite among users looking for effective solutions to protect their computers against all popular forms of malware, including viruses, Trojans, worms, recruits, dialers, adware, and spyware.

    ReplyDelete
  33. I am very impressed with your post because this post is very beneficial for me and provide new knowledge to me

    Proxifier Crack

    ReplyDelete
  34. Interesting post. which i wondered about this issue so thanks for posting and very good article which is a really very nice and useful article. Thank you
    Data Science Course in Noida

    ReplyDelete
  35. Excellent post.
    I was checking constantly this blog and I am impressed!
    PS4 Save Wizard Crack allows you to play more than 1000 PS4 games. The software is available for free, but it is also available with an updated version.
    PS4 Save Wizard Crack has a modern interface. A USB device can be used to copy data from a Playstation 4. Your computer needs to be copied and pasted.
    Bitdefender Total Security Crack is among the most comprehensive antivirus programs to detect and eliminate malware. There is a myriad of powerful algorithms, with a myriad of options to safeguard your data from malicious ransomware, Trojans, malware, and other dangerous viruses.

    ReplyDelete
  36. Extremely helpful information particularly the last part.
    I care for such information much.
    PS4 Save Wizard Crack can be played games with this keygen. Because most games don’t have rules, cheat tools allow players to access predetermined rules in some games.
    PS4 Save Wizard Crack cheat makes playing PS4 games easier. Our entire focus is on PlayStation 4 games. An employee can quit a position by resigning.
    VorpX Crack Free Download to easily transfer 3D videos, photos, and games. This software allows you to play everything, it is easy to use even by a beginner.

    ReplyDelete
  37. Very great post which I really enjoy reading this and it is not everyday that I have the possibility to see something like this. Thank You.
    Best Online Data Science Courses

    ReplyDelete
  38. Very interesting blog and lot of the blogs we see these days don't provide anything that interests me but i am really interested in this one just thought I would post and let you know.
    Data Science Training Institute in Noida

    ReplyDelete
  39. Excellently written article and information was helpful. Please keep it up thank for sharing.
    Business Analytics Course in Lucknow

    ReplyDelete
  40. I like viewing this web page which comprehend the price of delivering the excellent useful resource free of charge and truly adored reading your posting. Thank you!
    Data Science Certification Course

    ReplyDelete
  41. Packers and Movers Hyderabad are ✔✔✔ Certified Service Providers for Affordable Household Shifting. ***Get Instant Quotes and Compare ###Save Time- @ Packers And Movers Hyderabad

    ReplyDelete
  42. The blog and data is excellent and informative as well your work is very good and I appreciate well hopping for some more informative posts.
    Business Analytics Course in Gurgaon

    ReplyDelete
  43. Nice Post thank you very much for sharing such a useful information and will definitely saved and revisit your site and i have bookmarked to check out new things frm your post.
    Data Science Course

    ReplyDelete
  44. I like to view your web site which is very useful and excellent resource and truly adored reading your posting. Thank you!
    Data Science Course in Gurgaon

    ReplyDelete
  45. I am hoping the same best effort from you in the future as well and in fact your creative writing skills has inspired me.
    Data Science Course near me

    ReplyDelete
  46. We are really grateful for your blog post. You will find a lot of approaches after visiting your post. Great work thank you.
    Data Analytics Course in Chandigarh

    ReplyDelete
  47. This is really nice which is really cool blog and you have really helped a lot of people who visit the blog and give them useful information.
    Data Science Training in Noida

    ReplyDelete
  48. Nice post. This is a great article and am pretty much pleased with your good work. Very helpful information. Thank you.
    Best Data Science Courses

    ReplyDelete
  49. I guess I am the only one who came here to share my very own experience. Guess what!? I am using my laptop for almost the past 2 years, but I had no idea of solving some basic issues. I do not know how to Download Crack PC Softwares But thankfully, I recently visited a website named Crackroom
    IDM Crack
    Autodesk Fusion Crack
    Unity Pro Crack

    ReplyDelete
  50. I am always searching online for articles that can help me and you made some good points in Features also. Keep working, great job
    Data Science Training

    ReplyDelete
  51. Really this article is truly one of the best in article history and am a collector of old "items" and sometimes read new items if i find them interesting which is one that I found quite fascinating and should be part of my collection. Very good work!
    Data Scientist Course in Gurgaon

    ReplyDelete
  52. Really Good Work Done By You...However, stopping by with great quality writing, it's hard to see any good blog today.
    PRCrack
    Slate Digital Complete Bundle CRACK
    Crack Softwares Free Download

    ReplyDelete
  53. Pleasant data. I've bookmarked your site, and I'm adding your RSS channels to my Google record to get refreshes right away.

    QuarkXPress Crack

    ReplyDelete
  54. Lovely information. I've bookmarked your site, and I'm adding your RSS channels to my Google record to move invigorates immediately.

    QuarkXPress Crack

    ReplyDelete

  55. I am very happy to read this article. Thanks for giving us Amazing info. Fantastic post.
    Thanks For Sharing such an informative article, Im taking your feed also, Thanks.unity pro crack

    ReplyDelete
  56. I guess I am the only one who came here to share my very own experience. Guess what!? I am using my laptop for almost the past 6 years, but I had no idea of solving some basic issues. I do not know how to Download All Crack Software's For Free Here But thankfully, I recently visited a website named Crackroom
    Slate Digital Complete VMR Bundle Crack
    SkinFiner Crack
    iTubeGo YouTube Downloader Crack
    Vector Magic Crack
    ReclaiMe Pro Crack

    ReplyDelete
  57. her latest blog this content my review here official site click this link now these details

    ReplyDelete
  58. 에볼루션게임 먹튀검증 안전노리터 go

    ReplyDelete

Copyright notice

© André N. Klingsheim and www.dotnetnoob.com, 2009-2018. Unauthorized use and/or duplication of this material without express and written permission from this blog’s author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to André N. Klingsheim and www.dotnetnoob.com with appropriate and specific direction to the original content.

Read other popular posts