Comments on: Click Jacking – The new threat on the web?

By: web

web — Tue, 24 Feb 2009 14:24:34 +0000

It is all click jacking and we might see more such attacks in future.

The quickest fix for this attack is – DO NOT let your site be loaded in an iframe. Thats it!

if (window.parent.frames.length>0) {
//you are framed.
//Go to your site without frame
window.parent.location=location;
}

By: Security Monkey

Security Monkey — Sat, 10 Jan 2009 19:22:21 +0000

The “legit” site doesn’t need to be hacked. If you look at the example site, they are loading a frame of the real site (myspace) from their dodgy page, causing your clicks on their page to do things on the legit site.

By: johnb

johnb — Thu, 08 Jan 2009 13:05:33 +0000

in theory – but the website could have been purposely built with an exploit like this in place – we all know how the phishing scams take place and get people to give up their details, click on links etc.

By: Hari Karam Singh

Hari Karam Singh — Thu, 08 Jan 2009 11:27:06 +0000

But doesn’t it still require that you download a dodgy plugin or that the website gets hacked or allows dodgy scripts in it posting areas on the same page as its logins?

By: John Gag

John Gag — Wed, 05 Nov 2008 15:52:02 +0000

Pretty interesting stuff