[Security Brief] - P16 - DoubleClickjacking: A New Clickjacking Attack

A. Clickjacking

Clickjacking, also known as UI redressing [2], is an attack that tricks a user into clicking a webpage element that is invisible or disguised as another element [4]. This can cause users to unwittingly download malware, visit malicious web pages, provide credentials or sensitive information, transfer money, or purchase products online.

How Clickjacking Works

1. Creation of a Decoy Page:

   • The attacker sets up an attractive webpage with enticing content, such as offering a free gift, reward, or discount.
   • This page appears legitimate and is designed to encourage user interaction, such as clicking on a button labeled "Receive Gift."

2. Loading the Target Website in an Invisible Iframe:

   • In the background, the attacker loads the user's banking site (or another sensitive target) within an invisible iframe. An iframe is an HTML element that allows one webpage to embed another webpage inside it.
   • To ensure the user is logged into the target site, the attacker may rely on session cookies or perform a preliminary check (e.g., detecting if the user is authenticated by observing cookie states).

3. Dynamic Injection of Malicious Parameters:

   • The attacker crafts a URL for the banking site that includes query parameters to autofill certain fields. For instance, the URL might prepopulate the bank transfer form with the attacker's account details as the recipient.
   • This ensures that the user's click on the decoy site will directly complete a malicious transaction.

4. Precise Alignment Using CSS:

   • The iframe containing the banking site’s transfer page is styled using CSS to make it invisible (e.g., setting opacity: 0 or visibility: hidden) but still interactive.
   • The attacker aligns the invisible "Confirm Transfer" button within the iframe directly over the visible "Receive Gift" button on the decoy site.

5. User Interaction:

   • When the user clicks on the visible "Receive Gift" button, they are unknowingly clicking on the "Confirm Transfer" button within the invisible iframe.
   • The banking site processes the transfer, sending funds from the user’s account to the attacker’s account.

6. Post-Attack Redirection:

   • After the user clicks, the decoy page displays information about the free gift or reward, giving the impression that the interaction was legitimate.
   • Meanwhile, the malicious action (e.g., fund transfer) has already been executed on the invisible banking site.

Some Types of Clickjacking

       1. Likejacking

• Definition: Likejacking is a type of clickjacking that targets social media platforms, particularly Facebook. The attack manipulates the "Like" button to trick users into liking a page or post without their consent or awareness.
• How It Works:
  • The attacker creates a webpage with enticing content, such as a "funny video" or "shocking news."
  • An invisible iframe containing the Facebook "Like" button is overlaid on a visible element, such as a play button or image.
  • When the user clicks on the visible element, they are unknowingly interacting with the hidden iframe, causing them to "like" a post or page.
• Impact:
  • Can be used to promote malicious or spam content, making it appear popular and credible.
  • Spreads misinformation or scams by artificially inflating engagement on social media.

       2. Cursorjacking

• Definition: Cursorjacking involves manipulating the position of the user's cursor, making it appear in a different location than where it actually is. This causes the user to click unintended elements.
• How It Works:
  • The attacker uses technologies like Flash or JavaScript to offset the cursor's appearance.
  • The visual cursor shown on the screen is disconnected from the actual interactive point.
  • When the user attempts to click a specific element (e.g., a link or button), they are actually clicking a different, hidden element.
• Example:
  • The user sees the cursor over a "Cancel" button but is actually clicking on a "Submit" or "Approve" button.
• Impact:
  • Leads to unauthorized actions like granting permissions, approving payments, or installing malware.
  • Confuses users and exploits their trust in the visible UI.

       3. Form Hijacking

• Definition: Form hijacking involves overlaying an invisible form on top of a legitimate web page, stealing the user's input data without their knowledge.
• How It Works:
  • An attacker creates an invisible form, such as a login or credit card input form, and places it over a visible web element like a survey or subscription box.
  • As the user interacts with the visible web element, their input is captured by the hidden form.
  • The attacker uses the stolen data for fraudulent purposes, such as account takeovers or financial theft.
• Example:
  • A fake login form is overlaid on a legitimate website's homepage. Users attempting to log in inadvertently send their credentials to the attacker.
• Impact:
  • Steals sensitive information, including usernames, passwords, and payment details.
  • Facilitates phishing attacks and large-scale data breaches.

Broader Implications

Clickjacking attacks like the ones described leverage user trust, invisibility techniques, and psychological manipulation. They exploit the gap between what users see and what they actually interact with, leading to:

• Data breaches.
• Unauthorized actions (e.g., fund transfers, malware downloads).
• Reputational damage to websites targeted in these attacks.

B. DoubleClickjacking

DoubleClickjacking is a new "widespread timing-based vulnerability class" that leverages a double-click sequence to facilitate clickjacking attacks and account takeovers on almost all major websites [3]. The technique has been codenamed DoubleClickjacking by security researcher Paulos Yibelo [1]. Instead of relying on a single click to activate malware or steal data, the attacker can trick the user into double-clicking a seemingly innocuous web page element [1]. This can lead to the deployment of malware or exfiltration of sensitive data.

DoubleClickjacking is a variation of clickjacking [2] that exploits the gap between the start of a click and the end of the second click to bypass security controls and take over accounts with minimal interaction from the user [1]. By using this timing window, the attackers can swap out benign UI elements for malicious ones very quickly. This key insight highlights that this attack exploits the timing gap between two clicks, which is a novel approach not addressed by current security measures like X-Frame-Options [4].

How DoubleClickjacking Works

DoubleClickjacking involves the following steps:

• Step-by-Step Execution:

  • Initial Setup: The attacker sets up a malicious website or a compromised legitimate site that serves as the entry point.
  • Trigger Event: The site prompts the user to perform a seemingly harmless double-click action, like verifying their identity with a CAPTCHA or interacting with a button.
  • Real-Time Swap: During the milliseconds between the two clicks, JavaScript dynamically swaps the content under the cursor. This can replace a benign element with a sensitive control, such as an "Approve" button for an OAuth request.
  • Completion: The second click executes the malicious action, such as granting permissions, transferring funds, or downloading malware.

• Core Exploit:

  • The attack takes advantage of the temporal gap between clicks in a double-click sequence. By rapidly changing the underlying UI elements, the attack bypasses visual cues and user awareness, making it highly deceptive.

Characteristics of DoubleClickjacking

1. Exploitation of Human Behavior:

   • The double-click sequence is natural to users and is often used in daily interactions, making this attack blend seamlessly with legitimate operations.

2. Bypassing Existing Protections:

   • X-Frame-Options Header: Designed to prevent framing attacks, this is ineffective against DoubleClickjacking as the exploit occurs within the legitimate browser rendering context.
   • Content Security Policies (CSP): CSPs are circumvented since the attack relies on legitimate JavaScript execution within an allowed domain.

3. Minimal User Interaction:

   • Only two clicks are required, making the attack fast and efficient, with little opportunity for the user to recognize or interrupt it.

4. Targeting OAuth and Permissions:

   • Platforms like Slack, Salesforce, and Shopify [3], which rely on OAuth for third-party integrations, are particularly vulnerable. The attacker can stealthily gain account access or permission to sensitive resources.

Here's a comparison of Clickjacking and DoubleClickjacking:

Conclusion

Clickjacking and DoubleClickjacking are serious threats to online security. It is important to stay informed about new attack techniques, such as DoubleClickjacking, and to implement appropriate security measures to protect your website and your users. Here are some specific recommendations for users and website owners:

• Be cautious about clicking on links or buttons on unfamiliar websites.
• Keep your browser and plugins up to date.
• Use a strong password and enable two-factor authentication for all your online accounts.
• If you are a website owner, implement the server-side and client-side mitigation techniques.
• Consider using a security tool that can help detect and prevent clickjacking attacks.

References

1. New "DoubleClickjacking" Exploit Bypasses Clickjacking Protections on Major Websites
2. Clickjacking (UI redressing)  
3. DoubleClickjacking: The New “Double-Click” Attack to Hack Websites and Take Over Accounts - Technijian
4. Clickjacking
5. What Is Clickjacking? How Does It Work? - Perception Point

Some related statistics

In 2023, new account creations on desktop devices had an attack rate of 11.6%, while payments on desktop devices had a 4% attack rate [6]. Password resets on desktop devices were particularly vulnerable, with a 23.1% attack rate [7]. These high-risk touchpoints could potentially be exploited through clickjacking techniques. The consequences of successful phishing attacks, which may involve clickjacking, have decreased but remain significant. In 2023, 29% of organizations experienced a breach of customer or client data, 32% faced ransomware infections via email, and 27% encountered credential or account compromise [8]. Spear-phishing attacks in 2022 resulted in malware infections for 55% of surveyed organizations and data theft for 49% [9]. These impacts highlight the potential severity of clickjacking and similar attack methods on businesses and users.

Sources:

6. Statistic: Attack rate at core touchpoints across the online customer journey as of December 2023
7. Statistic: Attack rate at additional high-risk touchpoints across the online customer journey worldwide in 2023
8. Statistic: Consequences of successful phishing attacks on organizations worldwide in 2021 and 2023
9. Statistic: Consequences of spear-phishing attacks in organizations worldwide in 2022

------------------------------------------------------------------ 
[Security Brief] - P15 - VLAN Hopping Attacks
[Security Brief] - P14 - Hardware Security Module