Security researcher warns of new clickjacking threat

By

Tool shown at Black Hat conference underlines increasing dangers.

A tool has been launched at the Black Hat security conference in Barcelona designed to highlight the increasing dangers of clickjacking, a hacking technique that fools users in to clicking on elements hidden in an iframe.

Security researcher warns of new clickjacking threat

The browser-based tool was developed by security consultancy Context to " experiment with click-jacking techniques", and was introduced at the Black Hat event by Context developer Paul Stone.

Clickjacking was first seen in 2008, but was considered of limited use to hackers compared to other browser-based attacks, such as cross-site scripting and cross-site request forgery. However, Stone believes that the clickjacking threat is now much more real.

"Today's click-jacking techniques can be extended to perform powerful new attacks that can affect any web application," he said.

The new tool demonstrates the text-field injection and content extraction techniques, has a hidden mode that simulates a real clickjacking attack and lets users visualise how it works.

Stone demonstrated some updated clickjacking techniques that highlighted vulnerabilities in Internet Explorer, Firefox, Safari and Chrome.

"The tool will highlight the need for improved clickjacking defences in browsers and web applications," warned Stone.

The tool is in early beta and works best on Firefox 3.6.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Victoria's Secret pulls down website amid security incident

Victoria's Secret pulls down website amid security incident

Log In

  |  Forgot your password?