Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

8/10/2015
02:35 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Kaminsky Creates Clickjacking-Killer

Famed white-hat hacker proposes a fix for longtime Web attack vector.

DEF CON 23 -- Las Vegas -- Renowned security expert Dan Kaminsky here this week unveiled his latest project: a solution to eradicate so-called clickjacking attacks that plague the Web.

Kaminsky hopes to have his IronFrame approach support the World Wide Web Consortium's (W3C) UI Security specification, and ultimately ensure that clicking on compromised ads and other outside content on a website doesn't silently redirect users to malicious websites in clickjacking attacks. Clickjacking is where concealed and malicious content and links on a website are layered atop legitimate ones, unbeknownst to the user and the website operator.

"We have this problem where, because of the Web security model, you don't actually know what's on your web page. You just pull resources in from around the Net," Kaminsky said in an interview prior to his DEF CON 23 presentation here. "This [content] might be good, bad; maybe … by someone modifying it. This entire class of attacks is called clickjacking."

With IronFrame, Kaminsky says he's using the browser's "graphics model to present the right stuff to the user" rather than the modified content injected by cyber criminals. A PayPal box saying "Want to spend $1000?" could be altered with an icon atop it that changes the link to say $1, for example, he says.

IronFrame operates like a Jenga building-block model, moving the bottom layer of graphics content to the top layer so the browser doesn't even see the phony and malicious layer. It’s a way to end clickjacking "by design," he says.

"It's never been clear how to efficiently validate what the user sees" on the page, he says. "What I'm showing is that if you move the obscured layer to the top of the stack -- after JavaScript but before the GPU -- you can know what the user sees."

The browser to date doesn't even necessarily know what content is being presented to the user, he says. "The browser says, 'hey, GPU: go render this and you figure it out,'" Kaminsky explains.

Kaminsky's solution basically ensures that the original content is rendered by the browser, not any content layered atop it by bad guys.

Kaminsky, who is chief scientist with WhiteOps Security, also built a JavaScript-based CPU monitor that illuminates how when web pages load slowly, it's often due to content hidden within a rogue iFrame.

"Hackers can fix things. We don't just break things," he says. "I like looking at how things actually work and taking that knowledge and using it to make things better.

"We're hackers: we're not afraid to get into how things work. Let's use that knowledge and fearlessness and make things work better," he says.

Kaminsky says his open-source project is in the early stages. "I don't have it perfectly"  yet, he says.

"My goal is to go to a Blink developer [for example] and say we need this, it's feasible, here's a string, a beginning" to build on, he says.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
8/11/2015 | 12:57:35 PM
Re: Clickjacking Killer
Thank you for sharing that insight and perspective, @carofer. It's great to hear from the dev side on this!
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/11/2015 | 12:51:53 PM
Clickjacking
Clickjacking is all too prevalent. It's good to see that we are analyzing methods of negating its detrimental effects. Most often this catches non-tech individuals off guard and sometimes even the occassional techie.
carofer
50%
50%
carofer,
User Rank: Apprentice
8/11/2015 | 12:46:15 PM
Clickjacking Killer
It has disturbed me, as a manager of developers, that heavy-handed security restrictions like CORS are invented to thwart exploits like clickjackings. The honest developer is left with the task of working around the restrictions in order to provide mash-ups or other multi-domain user experiences.  It has a very high cost for developers, and, when workarounds such as JSONP are used, the original goals of the restriction are completely defeated, making it all a huge exercise in futility.

The development of the Kaminsky solution is therefore of HUGE significance, and we practitioners welcome it.

Bring it on and maybe we can be done with the kabuki dance of (some) porous security standards!!!

Allan Rofer
10 Ways to Keep a Rogue RasPi From Wrecking Your Network
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/10/2019
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Jim, stop pretending you're drowning in tickets."
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-1575
PUBLISHED: 2019-07-16
Information disclosure in PAN-OS 7.1.23 and earlier, PAN-OS 8.0.18 and earlier, PAN-OS 8.1.8-h4 and earlier, and PAN-OS 9.0.2 and earlier may allow for an authenticated user with read-only privileges to extract the API key of the device and/or the username/password from the XML API (in PAN-OS) and p...
CVE-2019-1576
PUBLISHED: 2019-07-16
Command injection in PAN-0S 9.0.2 and earlier may allow an authenticated attacker to gain access to a remote shell in PAN-OS, and potentially run with the escalated user?s permissions.
CVE-2018-19629
PUBLISHED: 2019-07-16
A Denial of Service vulnerability in the ImageNow Server service in Hyland Perceptive Content Server before 7.1.5 allows an attacker to crash the service via a TCP connection.
CVE-2019-10100
PUBLISHED: 2019-07-16
Quake3e < 5ed740d is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: Argument string creation.
CVE-2019-10100
PUBLISHED: 2019-07-16
UPX 3.95 is affected by: Integer Overflow. The impact is: attacker can cause a denial of service. The component is: src/p_lx_elf.cpp PackLinuxElf32::PackLinuxElf32help1() Line 262. The attack vector is: the victim must open a specially crafted ELF file.