Server Side Approaches to Clickjacking Detection.pdf

(579 KB) Pobierz
Server-side approaches to
clickjacking detection
Brad Hill, PayPal
WebAppSec WG F2F, 3 April 2012
Drawbacks of X-Frame-Options
•
IFRAMES desirable for many key clickjacking
attack cases. (Like, Pay, Follow, +1) Users
want in-context information without
disclosure to embedding origin
•
Allow-From doesn’t help – adversary is
potentially the same as the “legitimate” origin
•
Also doesn’t stop pop-under-and-close attacks
Drawbacks of client-enforced
screenshot approach
•
Incomplete coverage of attack scenarios
–
Fake mouse cursor, attention stealing attacks
•
False positives
•
User-interaction to resolve false positives
•
Low deployment rates
Server side approaches?
•
What can we do today without user-agent
support?
•
Can we profitably combine these techniques
with user-agent mechanisms?
Adaptive UI Randomization
•
Clickjacking attacks are still subject to the read
restrictions of the same-origin policy
•
Attack setup relies on a consistent layout of
the victim page
•
What if we randomize the location of the
button?

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin