Clickjacking Explained And How You Can Stop It
Clickjacking is perhaps one of the most annoying types of online fraudulent activity. These sneaky methods are used to trick us into clicking on things we don’t want to, and the consequences can be severe. Luckily, though, it can be avoided, and in this guide, we explain how.
We also look at how clickjacking works, some real-world examples, and look to the future to see what’s being done to protect us from these malicious links.
First, let’s look at the definition of clickjacking.
What is clickjacking?
Clickjacking is also known as a User Interface (UI) Redress Attack. It involves cybercriminals manipulating unwitting users into clicking on concealed parts of web pages.
For example, you may have clicked on a page to watch the video, and when you click the play button, you may carry out an action you did not intend to perform.
As we explore further below, the consequences of these seemingly innocuous actions can be significant. In the worst cases, you could end up sharing private information or making unauthorized purchases. In other cases, you may like random Facebook posts or share things on your social media platforms.
Clickjacking attacks can also lead to malware and other viruses being installed on your devices.
How does it work?
The way clickjacking works is quite simple. A transparent layer or invisible element is placed onto a legitimate-looking page. The user interacts with the page, clicking buttons, and then may get redirected to the hidden layer. The result is that the clickjacker gets you to do what they want. We look at some examples of what exactly below, but here’s an overview of how a clickjacking attack works:
- The attacker creates an innocent-looking page with content that entices you to click it.
- Hidden within the content is a button or link that may be connected to a malicious action.
- The user clicks on the element, triggering the hidden layer.
You may click on something several times, not realising what you’re doing. And if you don’t have proper protections in place, you may be getting yourself into trouble on each occasion.
A case study of clickjacking attacks: Facebook likes
Clickjacking is a common form of cybercrime and, as the digital world has expanded, attackers have devised new ways to leverage what they want.
One of the most common examples of clickjacking attacks can be seen with Facebook Likes. This has led to the phrase “Likejacking” being developed. The practice often involves third-party websites which use the Facebook’s “Like” button to promote advertising scams.
Facebook has also been known to have allowed iFrame clickjacking accounts too. Sometimes these attacks can be sophisticated and involve some form of CAPTCHA. For example, you may be asked to click buttons to complete the CAPTCHA when in reality you’re liking a page or sharing its posts. This all has the aim of unwittingly promoting a page on Facebook and may also be generating click-thru ad revenue from those false interactions.
What impact can clickjacking have?
While being tricked into liking and sharing a Facebook post may not seem like much of a negative impact, in other cases, clickjacking has the potential to cause much more damage. Here’s a breakdown of the potential repercussions:
- 🫰 Financial Loss - in some cases of severe clickjacking, you may be tricked int
authorizing fraudulent payments or funding transfers. You could also be duped into sharing financial information.
- ❌ Compromised Privacy - as well as your banking information being exposed, you
personal and sensitive information may also become liable. Login information, for example, may allow access to email inboxes and other confidential areas of your life.
- 🤬 Reputational Damage - if you’re caught out by a clickjacking attack, you or you company may share content that damages your name and reputation.
- 🖱️ Malware Infections - on some clickable items, you may end up downloading malware onto your devices, which can lead to the likes of click fraud.
As you can see, the results of clickjacking aren’t pleasant, and that’s why it’s important to prevent and avoid it. Let’s take a look at how you can do just that.
How to prevent clickjacking
You’ll be pleased to hear that there are lots of different options to help you prevent clickjacking attacks, and below, we explain them all. Let’s start with one of the simplest and most effective methods.
Explore X-Frame-options
Within the HTTP header of your website, it’s possible to utilize X-Frame-Options to bolster your site security. Specifically, it allows you to stop your content from being embedded into frames by other websites. Without having this in place, an attacker could embed your legitimate webpage into an invisible frame on their malicious website, tricking users into interacting with it.
There are three main configurations within X-Frame-Options, and they allow you to set different security rules:
- ⛔ Deny - this option prevents all attempts to load the page in a frame. It provides the highest level of protection against clickjacking.
- SameOrigin - this option is handy for internal applications that need framing within trusted domains. It allows the page to be framed, but only by another page from the same domain.
- ✅ Allow-From - this allows framing only from specific, trusted domains.
It’s important to remember that fixing your X-Frame-Options only guards against iFrame clickjacking. More needs to be done to provide complete protection.
Use a Content Security Policy (CSP)
If you’re looking for a more robust solution, it’s possible to implement a Content Security Policy (CSP) on your site. Unlike X-Frame-Options, this method allows you to define which sources of content are allowed on your site, including scripts, styles and frames.
Look out for the CSP direction “frame-ancestors”, which is particularly helpful for preventing clickjacking. You can use it to specify which domains are permitted to embed your content.
While it requires a little more effort to implement, CSP does provide more protection, guarding against the likes of cross-site scripting (XSS) too.
Use browser extensions
Another option you can try to help you prevent clickjacking attacks is to use browser extensions. Some popular pieces of software, like NoScript and uBlock Origin allow you to block malicious content from loading on webpages.
NoScript, for example, blocks all scripts and frames by default. If you want a site to run these, you have to whitelist them. uBlock Origin is another tool that can block scripts, as well as trackers and ads.
How to identify vulnerabilities
Now that you know how to prevent clickjacking attacks, another important step to take is to identify potential vulnerabilities.
One of the best methods of doing this is to use security testing tools like OWASP ZAP and Burp Suite. These tools simulate clickjacking attacks to measure how robust your website’s defenses are. So if you’re serious about keeping out clickjackers, this is a good option to explore.
Another option and one that’s more budget-friendly is to conduct more manual testing. You can do this by embedding your website within an iFrame on an external website. If the test works, you can look to implement the recommended security headers to ensure nothing gets through.
What does the future hold?
As technology evolves, so too do the methods employed by cybercriminals. The rise of social media has spawned new opportunities for attackers to develop methods, and as we’ve seen with the Facebook Like fiasco, it has the potential to cause a significant amount of problems.
The likes of artificial intelligence (AI) provide attackers with a wealth of new options to try and exploit. Speculation has also circulated about the potential for clickjacking within virtual reality (VR) and augmented reality (AR) environments.
The saving grace is that as criminals implement new methods, countermeasures are forever being developed to match them. Advancements in browser security, for example, offer users more protection. Anti-virus software is also utilizing AI to learn about new threats and teach itself to defend against them.
And greater education within organizations and in schools and colleges about online threats has helped more people spot the risks.
Get help avoiding clickjacking
If you’d like help and support with clickjacking and safeguarding your ad campaigns, then we can help you here at Hitprobe.
Our cutting-edge software protects you from click fraud so that your campaigns don’t get sabotaged and your ad budgets don’t get rapidly depleted. Our technology analyses and tracks clicks and calculates what’s fraudulent so that you can claim this money back at the end of each month.
We offer a free package and it couldn’t be easier to integrate with your existing campaigns. To learn more, just head here.
Key takeaways
- Keep a sharp eye out for anything suspicious that could be a fake embed. If in doubt, avoid interacting with these pages.
- Where possible, employ security measures like X-Frame-Options and a Consent Security Policy. If you don’t need iFrames, consider disabling them.
- For extra protection, try using browser extensions which can prevent clickjacking attacks and threats in the first place.
About your author
