CSS-Only Clickjacking

Re:CSS-Only Clickjacking by TazeTSchnitzel on Tuesday May 15, 2012 @08:06PM (#3979628)

There isn't a way of protecting against this attack, unless these buttons can't be embedded in web pages.

Well, that, or use Flash.

[ Parent | on HN ]

Re:CSS-Only Clickjacking by pacmon on Tuesday May 15, 2012 @09:54PM (#3979971)

@taze There is a way. It's called noscript. Does a terrific job of staying on top of issues like this.

Also because of this example I went one step further and used AdBlock to block any iframe with a facebook url.

@general The facebook button (at least in firefox) doesn't change to the hand icon when hovering over the link. So, fail. I wouldn't click a link where the cursor didn't change. Mostly, because when it doesn't change I immediately become suspicious.

[ Parent | on HN ]

Re:CSS-Only Clickjacking by darklajid on Wednesday May 16, 2012 @07:47AM (#3981603)

As someone who's lazy with AdBlock (subscribe, forget): Can you share that rule?

[ Parent | on HN ]

Re:CSS-Only Clickjacking by pacmon on Friday May 25, 2012 @08:54PM (#4026023)

Hey. Sorry for a majorly delayed response. Looks like I have two rules for this. They might be able to be optimized into one, but - I'm lazy too.

  com##IFRAME[src^="http://www.facebook.com/]

  ##IFRAME[src*="facebook.com"]

edit: Note - you need the 'Element Hiding Helper' that goes with Adblock Plus to do this. Then you can just use that to select the iframe on a site and add the rule through a nicer interface.

[ Parent | on HN ]

Re:CSS-Only Clickjacking by TazeTSchnitzel on Wednesday May 16, 2012 @11:33AM (#3982411)

I meant what Facebook could do, not you personally.

[ Parent | on HN ]

Re:CSS-Only Clickjacking by rabidsnail on Tuesday May 15, 2012 @08:23PM (#3979692)

Using flash will only work if you can control what window mode the embed is set to. If wmode is set to opaque or transparent compositing will be up to the browser.

[ Parent | on HN ]