Quick definition: Clickjacking is a malicious technique that tricks users into clicking invisible or disguised interface elements. By overlaying a transparent layer over a legitimate site, attackers hijack clicks to trigger unintended actions.
Explanation
Clickjacking, also known as a UI redress attack, is a malicious technique where an attacker uses transparent or opaque layers to trick a user into clicking on a button or link on another page when they intended to click on the top-level page. It works by embedding a legitimate, sensitive website into an invisible iframe overlaid on a decoy site. Using precise CSS positioning, the attacker aligns the target website’s actionable elements, such as a “Confirm Purchase” or “Delete Account” button, directly beneath harmless-looking content like a “Play Video” or “Claim Prize” button.
A common misconception is that clickjacking only affects social media “likes” or is just another form of phishing; however, it is a sophisticated interface-based vulnerability that can lead to unauthorized financial transfers, credential theft, or the activation of a device’s camera and microphone. Unlike phishing, which relies on fake replicas, clickjacking hijacks the user’s authenticated session on a real website. Protection typically involves implementing security headers like X-Frame-Options or Content Security Policy frame-ancestors to prevent unauthorized framing.
Why it matters
- – Helps you stay safe from hidden links that could trick you into making unauthorized financial transfers or accidental online purchases
- – Protects your personal accounts from being compromised by preventing attackers from hijaking your “Like” or “Follow” actions on social media
- – Ensures your privacy remains intact by stopping malicious sites from secretly activating your webcam or microphone through deceptive overlays
How to check or fix
- – Implement the Content Security Policy frame-ancestors directive in your HTTP response headers to specify which domains are permitted to embed your site in a frame
- – Configure the X-Frame-Options HTTP header to “DENY” or “SAMEORIGIN” to provide a secondary layer of protection for browsers that may not fully support modern security policies
- – Set the SameSite attribute for session cookies to “Strict” or “Lax” to prevent them from being sent during cross-site requests, making it harder for attackers to perform actions on a user’s behalf
- – Incorporate a frame-busting JavaScript script in the document header to detect if the page is being loaded within an unauthorized frame and force it to become the top-level window
- – Use a sandbox attribute for any intentional iframes to restrict capabilities such as forms, scripts, and pop-ups unless they are explicitly required for the site’s functionality
- – Conduct manual testing by creating a simple HTML file with an iframe targeting a sensitive page on your site to verify if it can be successfully embedded and viewed
Related terms
UI Redressing, Likejacking, Cursorjacking, MouseJacking, Phishing, Social Engineering
FAQ
Q: What is clickjacking and how does it work?
A: Clickjacking is a deceptive attack that uses transparent or opaque layers to trick users into clicking on a hidden element while they think they are clicking on the visible page. This “hijacks” the user’s click to perform unintended actions like transferring money or downloading malware.
Q: How can website owners prevent clickjacking attacks?
A: Developers can use server-side headers like Content Security Policy (CSP) with the frame-ancestors directive or X-Frame-Options to restrict or prevent their site from being embedded in an iframe. Implementing SameSite cookie attributes also helps by preventing authenticated actions from being triggered through a frame.
Q: Can users protect themselves from clickjacking on the client side?
A: Users can improve their security by using browser add-ons that block scripts, keeping their browsers updated, and avoiding clicking on suspicious pop-ups or links from unknown sources. Disabling JavaScript is also effective but may break the functionality of many legitimate websites.