OWASP AppSec EU 2013: Clickjacking Protection Under Non-trivial Circumstances
Channel: Christiaan008
Date: 2013-12-08

For more information and to download the video visit: http://bit.ly/appseceu13
Playlist OWASP AppSec EU 2013: http://bit.ly/plappseceu13

Speakers: Sebastian Lekies | Ben Stock

An important and timely attack technique on the Web is Clickjacking (also called UI redressing), in which an attacker tricks an unsuspicious victim into clicking on a specific element without the victim's explicit consent. Many web masters deployed different countermeasures to this kind of attack to protect their websites from being exploitable. Based on our paper [1], this talk gives an overview of the currently available countermeasures. Thereby, it demonstrates that these countermeasures are either not applicable to many of the possible use cases or are vulnerable to different kinds of attacks. Among other bypasses of state-of-the-art protection mechanisms we present a technique we call Nested Clickjacking that enables us to perform Clickjacking against the social network Google+ (despite of deployed countermeasures). Furthermore, we present the results of a large scale empirical study on the usage of current anti-clickjacking mechanisms on about 2 million web pages. The results of our analysis show that about 15 % of the analyzed web sites deploy countermeasures against Clickjacking. 

After exploring the shortcomings and limitations, we present a novel approach that is capable of defending a Web site against current attacks and that is applicable to many scenarios where traditional countermeasures cannot be used.