Clickjacking

Attacks and Defenses

Abhishek Hajare
Department of Information Technology
Rutgers University, Newark and New Brunswick
[email protected]
Abstract

page tricks users into clicking on a Facebook Like

Clickjacking attacks are an emerging threat on the

button by transparently overlaying it on top of an

web. In this paper, we study new clickjacking attack

innocuous UI element, such as a claim your free

variants using existing techniques and demonstrate

iPad button. Hence, when the user claims a free

that existing clickjacking defenses are insufficient.

iPad, a story appears in the users Facebook friends

These new attacks show that clickjacking can cause

news feed stating that she likes the attacker web

severe damages, including compromising a users

site.

private webcam, email or other private data, and

web surfing anonymity. It is observed that the root

Several clickjacking defenses have been proposed

cause of clickjacking is that an attacker application

and deployed for web browsers, but all have

presents a sensitive UI element of a target

shortcomings. Todays most widely deployed

application out of context to a user (such as hiding

defenses rely on framebusting [21, 37], which

the sensitive UI by making it transparent), and

disallow a sensitive page from being framed (i.e.,

hence the user is tricked to act out of context

embedded within another web page).

Unfortunately,

1. Introduction
When multiple applications or web sites (or OS

framebusting

is

fundamentally

incompatible with embeddable third-party widgets,

such as Facebook

principals in general) share a graphical display, they

are subject to clickjacking (also known as UI

Like buttons. Other existing defenses (discussed in

redressing) attacks: one principal may trick the user

Section

into interacting with (e.g., clicking, touching, or

incompatibility with existing web sites, or failure to

voice controlling) UI elements of another principal,

defend against significant attack vectors. To

triggering actions not intended by the user. For

demonstrate the insufficiency of state-of-the-art

example, in Likejacking attacks, an attacker web

defenses, we construct three new attack variants

3.2)

suffer

from

poor

usability,

using existing clickjacking techniques. We designed

and achieve the above goals, InContext defense, lets

the new attack scenarios to be more damaging than

web sites mark their sensitive UI elements and then

the existing clickjacking attacks in the face of

lets browsers enforce the context integrity of user

current defenses. In one scenario, the often-assumed

actions on the sensitive UI elements. The context of

web-surfing-anonymity can be compromised. In

a users action consists of its visual context and

another, a users private data and emails can be

temporal context.

stolen. Lastly, an attacker can spy on a user through

Visual context is what a user should see

her webcam.

right before her sensitive action. To ensure

Learning from the lessons of existing defenses, the

visual context integrity, both the sensitive UI

following design goals are set for clickjacking

element and the pointer feedback (such as

defense:

cursors, touch feedback, or NUI input

Widget

compatibility:

protection

should

support

clickjacking

feedback) need to be fully visible to a user.

third-party

The former type is referred as target display

widgets.

Usability: users should not be prompted for

their actions.

integrity and the latter as pointer integrity.

Temporal context refers to the timing of a

Backward compatibility: the defense should

user action Temporal integrity ensures that a

not break existing web sites (e.g., by

user action at a particular time is intended by

disallowing existing functionality).

the user. For example, an attack page can

Resiliency: our defense should address the

compromise temporal integrity by launching

root cause of clickjacking and be resilient to

a bait-and-switch attack by first baiting the

new attack vectors.

user with a claim your free I Pad

button

and then switching in a sensitive UI element

The root cause of clickjacking is that an attacker

right before the anticipated time of user

application presents a sensitive UI element of a

click.

target application out of context to a user and hence

the user gets tricked to act out of context. For

2. BACKGROUND AND RELATED WORK

example, already mentioned Likejacking attack

This section describes the known attacks and

scenario, an attacker web page presents a false

defenses for clickjacking, and compare them to the

visual context to the user by hiding the sensitive

most recent variants of the defenses. For the

Like button transparently on top of the claim

following attacks, let us assume that the victim user

your free iPad button. To address the root cause

is visiting a clickjacking attackers page, which

embeds and manipulates the target element residing

the (invisible) target element. Sometimes, it is

on a different domain, such as Facebooks Like

possible to visually confuse a victim by concealing

button or PayPals checkout dialog.

only a part of the target element. For example,

attackers could overlay their own information on

2.1Existing clickjacking attacks

Existing attacks are classified according to three

top of a PayPal checkout iframe to cover the

ways of forcing the user into issuing input

recipient and amount fields while leaving the Pay

commands out of context:

button intact; the victim will thus have incorrect

(1) compromising target display integrity, the

context when clicking on Pay. This overlaying

guarantee that users can fully see and recognize the

can be done using CSS z-index or using Flash

target element before an input action;

Player objects that are made topmost withWindow

(2) compromising pointer integrity, the guarantee

Mode property set to wmode=direct. Furthermore, a

that users can rely on cursor feedback to select

target element could be partially overlaid by an

locations for their input events; and

attackers popup window. Alternatively, the attacker

(3) compromising temporal integrity, the guarantee

may crop the target element to only show a piece of

that users have enough time to comprehend where

the target element, such as the Pay button, by

they are clicking

wrapping the target element in a new iframe that

uses carefully chosen negative CSS position offsets

2.1.1 Compromising

target

display

integrity
Modern browsers support HTML/CSS styling
features that allow attackers to visually hide the
target element but still route mouse events to it.
For example, an attacker can make the target
element transparent by wrapping it in a div
container with a CSS opacity value of zero; to
entice a victim to click on it, the attacker can draw a
decoy under the target element by using a lower
CSS z-index. Alternatively, the attacker may
completely cover the target element with an opaque
decoy, but make the decoy unclickable by setting
the CSS property pointer-events:none. A victims
click would then fall through the decoy and land on

and the Pay buttons width and height . An extreme

variant of cropping is to create multiple 1x1 pixel
containers of the target element and using single
pixels to draw arbitrary clickable art.

2.1.2 Compromising pointer integrity

Proper visual context requires not only the target
element, but also all pointer feedback to be fully
visible and authentic. Unfortunately, an attacker
may violate pointer integrity by displaying a fake
cursor icon away from the pointer, known as
cursorjacking. This leads victims to misinterpret a
clicks target, since they will have the wrong
perception about the current cursor location. Using
the CSS cursor property, an attacker can easily hide

the default cursor and programmatically draw a fake

after the victim hovers the cursor over the decoy, in

cursor elsewhere, or alternatively set a custom

anticipation of the click. To predict clicks more

mouse cursor icon to a deceptive image that has a

effectively, the attacker could ask the victim to

cursor icon shifted several pixels off the original

repetitively click objects in a malicious game or to

position. Another variant of cursor manipulation

double-click on a decoy button, moving the target

involves the blinking cursor which indicates

element over the decoy immediately after the first

keyboard focus (e.g., when typing text into an input

click.

field). Vulnerabilities in major browsers have

allowed attackers to manipulate keyboard focus

2.2 Consequences

using strokejacking attacks [50, 52]. For example,

To date, there have been two kinds of widespread

an attacker can embed the target element in a

clickjacking attacks in the wild: Tweetbomb and

hidden frame, while asking users to type some text

Likejacking. In both attacks, an attacker tricks

into a fake attacker-controlled input field. As the

victims to click on Twitter Tweet or Facebook Like

victim is typing, the attacker can momentarily

buttons using hiding techniques, causing a link to

switch keyboard focus to the target element. The

the attackers site to be reposted to the victims

blinking cursor confuses victims into thinking that

friends and thus propagating the link virally. These

they are typing text into the attackers input field,

attacks increase traffic to the attackers site and

whereas they are actually interacting with the target

harvest a large number of unwitting friends or

element.

followers.

2.1.3 Compromising temporal integrity

Many proof-of-concept clickjacking techniques

Attacks in the previous two sections manipulated

have also been published. Although the impact of

visual context to trick the user into sending input to

these attacks in the wild is unclear, they do

the wrong UI element. An orthogonal way of

demonstrate more serious damages and motivate

achieving the same goal is to manipulate UI

effective defenses. In one case, attackers steal users

elements after the user has decided to click, but

private data by and a confirmation popup. UI

before the actual click occurs. Humans typically

Randomization- Another technique to protect the

require a few hundred milliseconds to react to visual

target element is to randomize its UI layout.

changes, and attackers can take advantage of our

slow reaction to launch timing attacks. For example,

Opaque Overlay Policy. The Gazelle web browser

an attacker could move the target element (via CSS

forces all cross-origin frames to be rendered

position properties) on top of a decoy button shortly

opaquely. However, this approach removes all

transparency

from

all

cross-origin

elements,

buttons, and it is also vulnerable to double-click

breaking gentle sites. A button on the approval

timing attacks which could trick the victim to click

pages of the OAuth protocol, which lets users share

through both the target element

private resources such as photos or contacts across

web sites without handing out credentials. Several

3.2 Protecting temporal context

attacks target the Flash Player webcam settings

Although were not aware of any timing attacks

dialogs, allowing rogue sites to access the victims

used in the wild, browser vendors have started to

webcam and spy on the user. Other possible attacks

tackle these issues, particularly to protect browser

have forged votes in online polls, committed click

security dialogs (e.g., for file downloads and

fraud, uploaded private files via the HTML5 File

extension installations). One common way to give

API [19], stolen victims location information, and

users enough time to comprehend any UI changes is

injected content across domains (in an XSS spirit)

to impose a delay after displaying a dialog, so that

by tricking the victim to perform a drag and- drop

users cannot interact with the dialog until the delay

action .

expires. This approach has been deployed in Flash

Players webcam access dialog and also proposed in

3. Existing anti-clickjacking defenses

the Gazelle web browser.

Although the same-origin policy is supposed to

protect distrusting web sites from interfering with

Unresponsive buttons during the UI delay

one another, it fails to stop any of the clickjacking

annoys many users. The length of the UI delay

attacks described above. As a result, several anti-

is clearly a tradeoff between the user experience

clickjacking defenses have been proposed and some

penalty and protection from timing attacks.

have been deployed by browsers.

Regardless, UI delay is not a complete answer

to protecting temporal integrity, and we

3.1 Protecting visual context

User Confirmation. One straightforward mitigation

construct an attack that successfully defeats a UI

delay defense.

for preventing out-of-context clicks is to present a

confirmation prompt to users when the target

3.3 Framebusting

element has been clicked. Facebook currently

Frame busting refers to code or annotation

deploys this approach for the Like button, asking

provided by a web page intended to prevent the web

for confirmation whenever requests come from

page from being loaded in a sub-frame. Frame

blacklisted domains. Unfortunately, this approach

busting is the recommended defense against

degrades user experience, especially on single-click

clickjacking

The target Flash Player webcam settings dialog is at

the bottom right of the page, with a skip this ad
bait link remotely above it. Note there are two
cursors displayed on the page: a fake cursor is
drawn over the skip this ad link while the actual
pointer hovers over the webcam access Allow
Figure 1: Visualization of a clickjacking attack on

button.

Twitters account deletion page.

3.3.1 Double framing

Figure 1 illustrates a clickjacking attack: the victim

There are cases where if the attacker encloses the

site is framed in a transparent iframe that is put on

victim

top of what appears to be a normal page. When

parent.location becomes a security violation in all

users interact with the normal page, they are

popular browsers, due to the descendant frame

unwittingly interacting with the victim site. To

navigation policy. This security violation disables

defend against clickjacking attacks, the following

the counter-action navigation. Example. Victim

simple frame busting code is a commonly used by

frame busting code:

by

two

frames,

then

accessing

web sites:
if (top . location != location )

if (top . location !=

s e l f . location ) {

top . location = s e l f . location ;

parent . location = s e l f . location ;

}

Frame busting code typically consists of a

Attacker top frame: <iframe src=attacker2 . html>

conditional statement and a counter-action that

Attacker

navigates the top page to the correct place.

victim .com>

Fake cursor

Real cursor

Figure 2: Cursor spoofing attack page.

sub-frame:<iframe

src=http://www.

on the Adobe Flash Player webcam settings dialog

that grants the site permission to access the users
webcam. The cursor hiding is achieved by setting
the CSS cursor property to none, or a custom cursor
icon that is completely transparent, depending on
browser support.

4.2 Double-click attack to steal user private

data
Todays browsers do not protect temporal integrity
for web sites. We show in our second attack that

Figure 3: Double Framing Attack

even if a security-critical web page (such as an

OAuth

4. New Attack Variants

To demonstrate the insufficiency of state-of-the-art
defenses described above, three attack variants
using

known

clickjacking

techniques.

These

designed new attack scenarios are potentially more

dialog

page)

successfully

employs

framebusting (refusing to be embedded by other

sites), our attack can still successfully clickjack
such a page by compromising temporal integrity for
popup windows.

damaging than existing clickjacking attacks in the

face of current defenses. We describe each in turn.

The target OAuth dialog popup window appears

underneath the pointer immediately after the first

4.1 Cursor spoofing attack to steal webcam

access
In this attack, the user is presented with an attack
page where a fake cursor is programmatically
rendered to provide false feedback of pointer
location to the user, in which the fake cursor
gradually shifts away from the hidden real cursor
while the pointer is moving. A loud video ad plays
automatically, leading the user to click on a skip
this ad link. If the user moves the fake cursor to
click on the skip link, the real click actually lands

click on the decoy button. second click (the second

half of the double-click). This attack can steal a
users emails and other private data from the users
Google account.

later point in the game, a switch in at Facebook

Like button at the real cursors location, tricking the
user to browsing history leaks. Fortunately, the
history sniffing technique required in their attack is
no longer feasible in major browsers after updates
and patches. However, we find that our whack-amole attack above, and Likejacking attacks in
general, can still easily reveal the victims real
identity at the time of visit and compromise user
anonymity in web surfing as follows.
Consider an attacker who is an admin for a
Facebook page; the attacker crafts a separate
malicious page which tricks users to click on his
Like button. That page is notified when a victim
clicks on the Like button via FB.Event.subscribe(),
triggering the attackers server to pull his fan list
from Facebook and instantly identify the newly
Figure 4: Double-click attack page. The target OAuth
dialog popup window appears underneath the pointer
immediately after the first click on the decoy button

4.2 Whack-a-mole attack to compromise

web surfing anonymity
In this attack, the approaches from the previous two
attacks are combined, cursor spoofing and bait-and
switch, to launch a more sophisticated whack-amole attack. In this attack, the user is asked to play
a whack-a-mole game and encourage her to score
high and earn rewards by clicking on buttons shown
at random screen locations as fast as possible.
Throughout the game, a fake cursor is used to
control where the users attention should be. At a

added fan. The attackers server could then query

the victims profile via Facebook Graph API (and
remove the victim fan to avoid suspicion). While
we implemented this logic as a proof-of-concept
and verified its effectiveness, we did not test it on
real users.

temporal integrity ensures that the user has enough

time to comprehend what UI element they are
interacting with. We describe our design for each in
turn.

5.1 Ensuring Visual Integrity

To ensure visual integrity at the time of a sensitive
user action, the system needs to make the display of
both the sensitive UI elements and the pointer
feedback (such as cursors, touch feedback, or NUI
input feedback) fully visible to the user. Only when
both the former (target display integrity) and the
latter (pointer integrity) are satisfied, the system
activates sensitive UI elements and delivers user

5 InContext Defense

input to them.

As described earlier, the root cause of clickjacking

is that an attacker application presents a sensitive UI

5.1.1 Guaranteeing Target Display Integrity

element of a target application out of context to the

Although it is possible to enforce the display

user, and hence the user gets tricked to act out of

integrity of all the UI elements of an application,

context.

doing so would make all the UI elements

Enforcing context integrity for an application is

inactivated if any part of the UI is invisible. This

essentially one aspect of application isolation, in

would burden users to make the entire application

addition to memory and other resource access.

UI unobstructed to carry out any interactions with

Namely, the context for a users action in the

the application. Such whole-application display

application should be protected from manipulation

integrity is often not necessary. For example, not all

by other applications. It is an OSs (or a browsers)

web pages of a web site contain sensitive operations

role to provide such cross application (or cross-

and are susceptible to clickjacking. Since only

web-site) protection.

applications know which UI elements require

We already introduced two dimensions of context

protection, we let web sites indicate which UI

integrity: visual and temporal. Enforcing visual

elements or web pages are sensitive. This is

integrity ensures that the user is presented with what

analogous to how HTML5 and some browsers (as

she should see before an input action. Enforcing

well as earlier research on MashupOS) allow web

sites to label certain content as sandboxed. The

5.1.2 Guaranteeing Pointer Integrity

sandboxed content is isolated so that it cannot attack

Without pointer integrity support, an attacker could

the embedding page. In contrast, the sensitive

spoof the real pointer. For example, an attack page

content is protected with context integrity for user

may show a fake cursor to shift the users attention

actions, so that the embedding page cannot

from the real cursor and cause the user to act out of

clickjack the sensitive content.

context by not looking at the destination of her

Several design alternatives were considered for

action. To mitigate this, we must ensure that users

providing target display integrity, as follows.

see

Strawman 1: CSS Checking. A naive approach is to

simulated) cursors and pay attention to the right

let the browser check the computed CSS styles of

place before interacting with a sensitive element.

elements, such as the position, size, opacity and z-

For the design, we consider the following

index, and make sure the sensitive element is not

techniques,

overlaid by crossorigin elements. However, various

combinations, to understand the tradeoff between

techniques exist to bypass CSS and steal topmost

their effectiveness of stopping pointer-spoofing

display, such as using IEs createPopup() method or

attacks and intrusiveness to users. Some of the

Flash Players Window

techniques limit the attackers ability to carry out

system-provided

(rather

individually

and

than

in

attacker-

various

pointer-spoofing attacks; others draw attention to a

particular place on the screen.
No cursor customization. Current browsers disallow
cross-origin cursor customization. We further
Reference bitmap:

OS screenshot:

Figure 4: Ensuring target element display integrity.

Here, the attacker violates visual context of the
Twitter Follow button by changing its opacity and
obstructing it with two DIVs. InContext detects this
during its bitmap comparison. Obstructions from
other windows are also detected (e.g., the
nonbrowser Vi window on the right).

restrict this policy: when a sensitive element is

present, InContext disables cursor customization on
the host page (which embeds the sensitive element)
and on all of the hosts ancestors, so that a user will
always see the system cursor in the areas
surrounding the sensitive element.
Our opt-in design is better than completely
disallowing cursor customization, because a web
site may want to customize the pointer for its own
UIs (i.e., same-origin customization). For example,
a text editor may want to show different cursors

depending on whether the user is editing text or

changes. To stop strokejacking attacks that steal

selecting a menu item.

keyboard focus once the sensitive UI element

Screen freezing around sensitive element. Since

acquires keyboard focus (e.g., for typing text in an

humans typically pay more attention to animated

input field), we disallow programmatic changes of

objects than static ones, attackers could try to

keyboard focus by other origins. This list of

distract a user away from her actions with

techniques is by no means exhaustive. For example,

animations. To counter this, InContext freezes the

sensitive elements could also draw the users

screen (i.e., ignores rendering updates) around a

attention with splash animation effects on the cursor

sensitive UI element when the cursor enters the

or the element.

element.
Muting. Sound could also draw a users attention
away from her actions. For example, a voice may
instruct the user to perform certain tasks, and loud
noise could trigger a user to quickly look for a way
to stop the noise. To stop sound distractions, we
mute the speakers when a user interacts with
sensitive elements.
Lightbox around sensitive element. Greyout (also
called Lightbox) effects are commonly used for
focusing the users attention on a particular part of
the screen (such as a popup dialog). In our system,
we apply this effect by overlaying a dark mask on
all rendered content around the sensitive UI element
whenever the cursor is within that elements area.
This causes the sensitive element to stand out
visually.
The mask cannot be a static one. Otherwise, an
attacker could use the same static mask in its
application to dilute the attention-drawing effect of
the mask. Instead, we use a randomly generated
mask which consists of a random gray value at each
pixel. No programmatic cross-origin keyboard focus

5.1.3

Ensuring Temporal Integrity

Even with visual integrity, an attacker can still take

a users action out of context by compromising its
temporal

integrity, as

described

earlier. For

example, a timing attack could bait the user with a

claim your free iPad button and then switch in a
sensitive UI element (with visual integrity) at the
expected time of user click. The bait-and-switch
attack is similar to time-of-checkto-time-of-use
(TOCTTOU) race conditions in software programs.
The only difference is that the race condition
happens to a human rather than a program. To
mitigate such TOCTTOU race conditions on users,
we impose the following constraints for a user
action on a sensitive UI element: UI delay. This
technique is applied to only deliver user actions to
the sensitive element if the visual context has been
the same for a minimal time period. For example, in
the earlier baitand-switch attack, the click on the
sensitive UI element will not be delivered unless the
sensitive element (together with the pointer integrity
protection such as grey out mask around the

sensitive element) has been fully visible and

stationary long enough.
UI delay after pointer entry. The UI delay technique
above is vulnerable to the whack-a-mole attack that
combines pointer spoofing with rapid object
clicking. A stronger variant on the UI delay is to
impose the delay not after changes to visual context,
but each time the pointer enters the sensitive
element. Note that the plain UI delay may still be
necessary, e.g., on touch devices which have no

Like
Twitter

200x20 px

13.54 ms

8.60 MB

Follow
Animated

468x60 px

14.92 ms

7.90 MB

fps)
Google

450x275 px

24.78 ms

12.95 MB

OAuth
PayPal

385x550 px

30.88 ms

15.74 MB

GIF

(1.5

Checkout
Table 1: Performance of InContext. For each sensitive
element, this table shows extra latency imposed on each
click, as well as extra memory used.

pointer. Pointer re-entry on a newly visible sensitive

element. In this novel technique, when a sensitive

embedded sensitive element) needs to be thick

UI element first appears or is moved to a location

enough so that a user can clearly decide whether the

where it will overlap with the current location of the

pointer is on the sensitive element or on its

pointer, an InContext capable browser invalidates

embedding page. As well, this ensures that during

input events until the user explicitly moves the

rapid cursor movements, such as those in the

pointer from the outside of the sensitive element to

whack-amole attack, the pointer integrity defenses

the inside. Note that an alternate design of

such as screen freezing are activated early enough.

automatically moving the pointer outside the

The padding could be either enforced by the

sensitive element could be misused by attackers to

browser or implemented by the developer of the

programmatically move the pointer, and thus we do

sensitive element; considering this, it would be

not use it. Obviously, this defense only applies to

more appropriate to keep developers in control of

devices and OSes that provide pointer feedback.

their page layout.

Padding area around sensitive element. The

sensitive UI elements padding area (i.e., extra
whitespace separating the host page from the
Sensitive

Dimensions

Click

Element

Delay

Facebook

Overhead
12.04 ms

90x20 px

Memory

Conclusion

The newly devised clickjacking attack variants,

bypass existing defenses and cause more severe
harm than previously known, such as compromising
webcams, user data, and web surfing anonymity.

5.11 MB

To defend against clickjacking in a fundamental

way, use of InContext, a web browser or OS

mechanism to ensure that a users action on a

2. Marco Balduzzi et al, (2010). A Solution for

sensitive UI element is in context, having visual

the Automated Detection of Clickjacking

integrity and temporal integrity.

Attacks.

InContext defense can be very effective for

https://iseclab.org/papers/asiaccs122-

clickjacking attacks in which the use of clickjacking

balduzzi.pdf

improves the attack effectiveness.

3. Robert Hansen, Jeremiah Grossman (2008).

Clickjacking.

This paper addresses the following:

http://www.sectheory.com/clickjacking.htm

Provide a survey of existing clickjacking

4. Marcus Niemietz, 2011 .UI Redressing:

attacks and defenses.

Attacks and Countermeasures Revisited.

Conducted the study on the effectiveness of

http://uiredressing.mniemietz.de/uiRedressin

clickjacking attacks.

g.pdf

Introduced the concept of context integrity

5. Gustav Rydstedt et al, 2010. Busting Frame

and used it to define and characterize

Busting:

clickjacking attacks and their root causes.

Vulnerabilities

Evaluated InContext techniques to maintain

context integrity and defeat clickjacking.

Study
on

of

Clickjacking

Popular

Sites.

http://w2spconf.com/2010/papers/p27.pdf
6. G. Rydstedt et al, 2010. Framing attacks on
smart phones and dumb routers: Tap-jacking

With all these results, we advocate browser vendors

and client OS vendors to consider adopting
InContext to provide the users a certain defense

and geolocalization.
7. Paul

Stone,

2010.

Next

Generation

Clickjacking.
http://www.contextis.com/documents/5/Cont

from Clickjacking

ext-Clickjacking_white_paper.pdf
8. http://research.zscaler.com/2008/10/clickjac

References:
1. Devdatta Akhawe,2011. A perpetual View of
UI

Security.

http://www.cs.berkeley.edu/~dawnsong/pape
rs/woot14-akhawe.pdf

king-defenses.html
9. http://www.cert.org/informationfor/securing-web-browser-index.cfm
10. http://www.troyhunt.com/2013/05/clickjackattack-hidden-threat-right-in.html