Security researcher warns of new clickjacking threat

A tool has been launched at the Black Hat security conference in Barcelona designed to highlight the increasing dangers of clickjacking, a hacking technique that fools users in to clicking on elements hidden in an iframe.

The browser-based tool was developed by security consultancy Context to " experiment with click-jacking techniques", and was introduced at the Black Hat event by Context developer Paul Stone.

Clickjacking was first seen in 2008, but was considered of limited use to hackers compared to other browser-based attacks, such as cross-site scripting and cross-site request forgery. However, Stone believes that the clickjacking threat is now much more real.

"Today's click-jacking techniques can be extended to perform powerful new attacks that can affect any web application," he said.

The new tool demonstrates the text-field injection and content extraction techniques, has a hidden mode that simulates a real clickjacking attack and lets users visualise how it works.

Stone demonstrated some updated clickjacking techniques that highlighted vulnerabilities in Internet Explorer, Firefox, Safari and Chrome.

"The tool will highlight the need for improved clickjacking defences in browsers and web applications," warned Stone.

The tool is in early beta and works best on Firefox 3.6.