Instructor: Clickjacking. 2 2
In this lesson, we are going to talk about 3 3
the dangers of clickjacking. 4 4
Clickjacking is a type of hijacking account 5 5
that forces a user to unintentionally click a link 6 6
that's embedded in or hidden by other webpage elements. 7 7
For instance, let's say I was playing a video game 8 8
and there's a big play button, and I don't see 9 9
that behind that, there's actually a pay button 10 10
and if I click that link for play, 11 11
I'm not actually clicking the play button. 12 12
I'm clicking this hidden layer that says pay 13 13
and that's going to charge me. 14 14
This is the idea of using clickjacking. 15 15
Clickjacking is used when a victim clicks the link, 16 16
they can be redirected to what appears 17 17
to be a legitimate page as well. 18 18
For instance, I click on something, 19 19
it takes me something that looks like a login page. 20 20
I enter my username and password, and low and behold, 21 21
I didn't really log into my site. 22 22
I just gave them my username and password. 23 23
This is another form of clickjacking 24 24
and another reason you have to be on the lookout for it. 25 25
Now, clickjacking is made possible 26 26
because of the use of iframes within HTML. 27 27
Essentially, because of these iframes that are allowed 28 28
within HTML, you can actually have 29 29
invisible iframes that's accepting the values 30 30
when you're inputting your credentials 31 31
even though you don't see it on the screen. 32 32
It's really, really tricky, 33 33
but it is something that can be done through clickjacking. 34 34
Now, one way to prevent clickjacking 35 35
is by using frame busting. 36 36
Now, frame busting is a technique that removes 37 37
the malicious iframe loaded on the site 38 38
by forcing your page to the top frame 39 39
'cause essentially, think about this like layers. 40 40
If they have a clickjacking on your site 41 41
and they have an invisible layer on top, 42 42
people are entering it on there 43 43
even though they think they're on your site. 44 44
By taking your site and forcing it to the top, 45 45
that's going to make sure they're always inputting data 46 46
in your site and not on the clickjack site. 47 47
Now, one of the ways to do this 48 48
is by using just a simple bit of JavaScript. 49 49
For instance, if top does not equal self, 50 50
then self location equals top location. 51 51
This takes your layer and puts it on the top 52 52
to prevent clickjacking. 53 53
Now, this will only work against 54 54
the most simple framing abuse, 55 55
but it is something good to put in there. 56 56
There are more advanced iframe attacks that could use 57 57
more advanced countermeasures using JavaScript as well. 58 58
For instance, you could use X-Frame-Options. 59 59
If you set your X-Frame-Options and set them to deny, 60 60
this is actually a better strategy 61 61
to protect against clickjacking. 62 62
Now, when you do this, you have to make sure 63 63
that this is in the header 64 64
and deploy to every page in your domain. 65 65
If you don't do that, then the clickjackers 66 66
still have a way in 67 67
and they can still take advantage of your customers.