Clickjacking

Glossary

What is Clickjacking?

Attackers can deceive users into clicking on something that is not what they initially see by using a harmful technique called clickjacking. Often, it involves overlaying legitimate buttons or links with hidden or invisible features, leading the user to click on inappropriate content unintentionally. This type of attack takes advantage of trust by tricking the target by manipulating the user interface.

Common Methods of Clickjacking

  1. Hidden Frames: Attackers overlay a transparent frame over legitimate web content. Users think they are interacting with the visible page but are actually clicking on the hidden frame that performs a different action.
  2. Disguised Links: A seemingly harmless link, such as a ‘Play’ or ‘Download’ button, may actually perform a malicious action like installing malware or subscribing to paid services without the user’s consent.
  3. Social Media Clickjacking: Attackers trick users into liking, sharing, or following content on social media, which can promote malicious sites or spread disinformation without the user’s knowledge.
  4. Invisible Buttons: Invisible or off-screen buttons are placed over legitimate content, leading to unintended actions when the user clicks on the page.
  5. Keyboard-Based Clickjacking: Rather than capturing clicks, this approach records keyboard input. Attackers deceive users into inputting sensitive data, such as credit card numbers or passwords, by using hidden features.

How to Protect Against Clickjacking

  1. Frame-Busting Techniques: Websites can implement code that prevents their pages from being embedded within iframes, reducing the risk of invisible overlays.
  2. X-Frame-Options Header: By setting the X-Frame-Options header, a website can prevent clickjacking by ensuring that other sites cannot frame its pages.
  3. Regular Updates: Keeping browsers and plugins up to date helps reduce vulnerabilities that may be exploited by clickjacking.
  4. User Awareness: Users can lessen their susceptibility to clickjacking attacks by being informed about the dangers of the technique and being encouraged to click things on the internet carefully.
  5. Browser Security Settings: Enabling security features in browsers, such as content blocking or browser extensions designed to detect and block clickjacking attempts, provides an additional layer of protection.

Clickjacking is a stealthy and dangerous attack technique that needs to be avoided at all costs by users and website administrators by being alert at all times, especially when browsing online.

How can iZOOlogic help my Company or Organisation?

Find out how iZOOlogic can protect you against the threats of Clickjacking with our advanced ‘Web App Threat Protection’ solutions.

To learn more about how iZOOlogic can enhance your company’s cyber security, schedule a demo today.