Hiiiiii friends…..
Good morning to all…
Today I am here to tell you about clickjacking. Clickjacking is not a name of virus or malware. Its like a spam on websites which can change your activity. Clickjacking (also known as user-interface or UI redressing and IFRAMEoverlay) is an exploit in which malicious coding is hidden beneath apparently legitimate buttons or other clickable content on a website.
Good morning to all…
Today I am here to tell you about clickjacking. Clickjacking is not a name of virus or malware. Its like a spam on websites which can change your activity. Clickjacking (also known as user-interface or UI redressing and IFRAMEoverlay) is an exploit in which malicious coding is hidden beneath apparently legitimate buttons or other clickable content on a website.
Clickjacking, or clickjack attack, is a vulnerability used by an attacker to collect an infected user’s clicks. The attacker can force the user to do all sort of things from adjusting the user’s computer settings to unwittingly sending the user toWeb sites that might have malicious code. Also, by taking advantage of Adobe Flash or JavaScript, an attacker could even place a button under or over a legitimate button, making it difficult for users to detect.
In other words we can say Clickjacking is a malicious software form that can seemingly take control of the links that an Internet browser displays for various Web pages. Once that takes place, and once a user tries to lick on that link, the user is taken to a site that is unintended. In some cases, the user may be able to recognize this immediately; in other cases, the user may be totally unaware of what took place.
Clickjacking occurs when a malicious program is embedded into a Web site. This program hovers under the user’s mouse, according to Jeremiah Grossman, a security researcher dealing with Internet issues. Once the user clicks, usually on a link but it can be anywhere on the page, a new Web site may appear or software may be downloaded and clickjacking has occurred.
Here’s one example, among many possible scenarios: A visitor to a site thinks he is clicking on a button to close a window; instead, the action of clicking the “X” button prompts the computer to download a Trojan horse, transfer money from a bank account or turn on the computer’s built-in microphone. The host website may be a legitimate site that’s been hacked or a spoofed version of some well-known site. The attacker tricks users into visiting the site through links online or in email messages.
How clickjacking work ?
A specially crafted Web page can contain hidden content that is activated when a user clicks on something that appears to be innocuous: a fake video, an enticing picture, a message to ‘click here to continue’, or the promise of a free gift, for instance. To illustrate how this works, take a look at the following images. The first shows a page that is designed to entice the user into clicking:
The next image shows the same page but with a malicious link included. This link could post malicious or embarrassing content to your profile on social networking sites, perform actions on other sites you’re logged in to, or any other nasty behavior of the attacker’s choosing:
Now, no one but the foolhardy or curious would click the bottom link—and we all know what curiosity did to the poor cat—so let’s make it a bit more difficult for the user to tell what they’re clicking on by including the following HTML snippets in the page (some content removed):
The page now looks like it did in the first screenshot—totally innocuous, with no visible sign of any nastiness—but in the following animated image you can see what’s really going on:
The malicious link is floating ‘above’ the page and is set to follow the mouse pointer. This means that wherever on the page the user clicks, he or she is actually clicking on the booby-trapped invisible link.
How to prevent from clickjacking?
To prevent these kinds of attacks it’s important to use caution when browsing the Web, but unfortunately this can only go so far, and it’s not really feasible to disable JavaScript altogether because of the key role it plays in today’s Web. Most modern browsers include some form of protection against clickjacking, but attackers are always seeking ways to circumvent these defenses. So, what to do? An excellent strategy is to use a browser add-on such as NoScript, which prevents scripts from running on non-whitelisted sites. Many such add-ons also include features that specifically seek to prevent clickjacking attempts, and can be regularly updated to smack clickjack hack attacks—stat.
I hope you enjoyed this post.
Enjoy…………….!!!!!!!
Welcome your comments and suggestions…….!!!!!
Clickjacking occurs when a malicious program is embedded into a Web site. This program hovers under the user’s mouse, according to Jeremiah Grossman, a security researcher dealing with Internet issues. Once the user clicks, usually on a link but it can be anywhere on the page, a new Web site may appear or software may be downloaded and clickjacking has occurred.
Here’s one example, among many possible scenarios: A visitor to a site thinks he is clicking on a button to close a window; instead, the action of clicking the “X” button prompts the computer to download a Trojan horse, transfer money from a bank account or turn on the computer’s built-in microphone. The host website may be a legitimate site that’s been hacked or a spoofed version of some well-known site. The attacker tricks users into visiting the site through links online or in email messages.
How clickjacking work ?
A specially crafted Web page can contain hidden content that is activated when a user clicks on something that appears to be innocuous: a fake video, an enticing picture, a message to ‘click here to continue’, or the promise of a free gift, for instance. To illustrate how this works, take a look at the following images. The first shows a page that is designed to entice the user into clicking:
The next image shows the same page but with a malicious link included. This link could post malicious or embarrassing content to your profile on social networking sites, perform actions on other sites you’re logged in to, or any other nasty behavior of the attacker’s choosing:
Now, no one but the foolhardy or curious would click the bottom link—and we all know what curiosity did to the poor cat—so let’s make it a bit more difficult for the user to tell what they’re clicking on by including the following HTML snippets in the page (some content removed):
The page now looks like it did in the first screenshot—totally innocuous, with no visible sign of any nastiness—but in the following animated image you can see what’s really going on:
The malicious link is floating ‘above’ the page and is set to follow the mouse pointer. This means that wherever on the page the user clicks, he or she is actually clicking on the booby-trapped invisible link.
How to prevent from clickjacking?
To prevent these kinds of attacks it’s important to use caution when browsing the Web, but unfortunately this can only go so far, and it’s not really feasible to disable JavaScript altogether because of the key role it plays in today’s Web. Most modern browsers include some form of protection against clickjacking, but attackers are always seeking ways to circumvent these defenses. So, what to do? An excellent strategy is to use a browser add-on such as NoScript, which prevents scripts from running on non-whitelisted sites. Many such add-ons also include features that specifically seek to prevent clickjacking attempts, and can be regularly updated to smack clickjack hack attacks—stat.
I hope you enjoyed this post.
Enjoy…………….!!!!!!!Welcome your comments and suggestions…….!!!!!
Comments
Post a Comment