Can hackers hijack your clicks? — Clickjacking Attacks!
Tags: Technology, Information Technology, Information Security, Cybersecurity, Awareness

Not just flights but all your clicks could be hijacked too. The threat that’s hidden right in front of you!

The internet and technology have transformed not just our lives but those of cyber-criminals as well. With the advancement of technology, cybercriminals are totally into developing new techniques to trick victims for their benefits.

Clickjacking, made up from two words, “click” and “hijacking” is a similar method as to flight hijacking where attackers trick the user into clicking content on a hidden website. This was initially discovered by the amazing Robert Hansen and Jeremiah Grossman

We often see in the movies, how hijacking is done. Usually, it is shown how armed attackers take over or hijack the flight to accomplish their objectives by using the innocent co-passengers their victims.

How does Clickjacking function?

This is also known as UI redress attack. Kind of attack which is conducted by utilizing UI vulnerabilities to edit, add multiple transparent layers over it in such a manner that it looks like a legitimate website. And when the user clicks on specific links their clicks get hijacked and will be routed to, interacting with a completely different malicious website.

The basic idea behind how it’s implemented

Attackers lure users with an attractive looking page with amazing offers.

In the background, the attacker checks if the user is logged into any crucial sites such as banking applications.

The bank fund transfer page will be displayed in an invisible iframe above luring buttons.

The victim visits the page and clicks the button or the link.

But reality stays far beyond the user clicks on the invisible iframe and has clicked the “Confirm Transfer” button instead of an attractive link or button with offers.

By conducting such attacks, attackers most often target passwords, credit card numbers, valuable data they can exploit. And sometimes also used to download malware into the victim’s device.

Where has the clickjacking attack been used?

Clickjacking has also been used for various purposes in the past. Some of the most common fields include:

By rendering invisible elements over the Adobe Flash settings page, victims were tricked into turning on their webcam or microphone.

Worms were spread on very famous social media sites like Twitter.

like Twitter. Diverting victims to malicious download links.

How to mitigate such an attack?

One of the best ways could be the usage of HTTP security header that tells websites on how to behave help add one layer of security to mitigate attacks like clickjacking.

1. X-Frame Option

This is an HTTP response header, also referred to as an HTTP security header that tells the browser how to behave when handling the site’s content. This also provided clickjacking protection by not allowing the rendering of a page in a frame. There are three values allowed for the X-Frame-Options header which are as follows:

DENY — does not allow any domain to display this page within a frame. Some of the famous sites using this header are Facebook and Github.

— does not allow any domain to display this page within a frame. Some of the famous sites using this header are Facebook and Github. SAMEORIGIN — allows the current page to be displayed in a frame on another page, but only within the current domain. Some of the most famous sites using this header are Twitter, Amazon, and eBay.

— allows the current page to be displayed in a frame on another page, but only within the current domain. Some of the most famous sites using this header are Twitter, Amazon, and eBay. ALLOW-FROM URI — allows the current page to be displayed in a frame, but only in a specific URI

How to check for X-Frame Header

You can check if the X-Frame header by simple steps

Go to your site

Open up the Network panel in Chrome DevTools

And search for X-Frame in the header tab

i. Enable on Nginx

You can enable in Nginx by simply adding the command in server block config.

add_header X-Frame-Options "sameorigin" always;

ii. Enable on Apache

You can enable in Apache by simply adding the command in server block config.

header always set X-Frame-Options "sameorigin"

iii. Enable in IIS

You can enable in IIS by adding the command in the site’s Web.config file:

<system.webServer>

...

<httpProtocol>

<customHeaders>

<add name="X-Frame-Options" value="SAMEORIGIN" />

</customHeaders>

</httpProtocol>

...

</system.webServer>

2. Maintaining Content Security Policy

HTTP Header also allows one another layer of security also known as Content Security Policy which allows developers to whitelist domains that are allowed to embed pages and domains from which resources such as scripts and fonts could be loaded.

3. Frame killing

Frame Killing is the process of inserting frame killing Javascript into pages that you don’t want to be included in foreign iframes. These are mostly used for old browsers.