Is Clickjacking a Serious Threat?
November 12, 2008
Technical news mags such as ZDnet report that clickjacking may be a serious threat that affects any Internet browser.
Clickjacking from the Layperson’s Perspective
In a nutshell, clickjacking is accomplished by a malicious page that hides behind a seemingly safe page. When you click on an item, your computer is “clickjacked” by the malicious code, which then hijacks various components of your computer. This occurs without your knowledge.
Generally, webcams are hijacked, but clickjacking is not limited to affecting a cam. For instance, your sound system or microphone can be exploited, or your PC can be taken over in other ways.
Adobe’s Flash Player was particularly vulnerable to clickjacking threats; however, Adobe has come out with a fix to address the issue.
Is This Only an Explorer or Firefox Problem?
Clickjacking is a malicious code that affects virtually all Internet browsers. Merely disabling javascript will not fix it.
A “No Script” add-on that works with Firefox is the only known solution.
Problems with the Clickjacking Fix
After using No Script for a week or so, I disabled it because it made web surfing a chore. Virtually every site I visited was partially blocked due to a YouTube video, javascript code or ad embedded on the page. For instance, the following were all blocked by No Script:
- Google Analytics
- Pepperjam network
- Peelaway Ads
- Voxant’s newsroom
- Chitika
- and many, many more (see the partial list of affiliate programs and other utilities blocked by No Script).
There’s a little bit of good news for Google publishers and advertisers. Adsense is automatically whitelisted by the No Script add-on. Most of the others need to be manually whitelisted and it is unlikely that the average Internet user is going to do so.
If clickjacking is truly the threat that some would say that it is, and if solutions such as No Script are the only way to fight back, I can see that this situation will kill online advertising. Adserver Plus, Doubleclick and other big ad networks were blocked by the No Script add-on.
Conclusion: Maybe the Threat is Overrated
My web browsing experience is back up to speed since I’ve disabled No Script and so far I haven’t been hit by any type of clickjacking activities. It is possible that the threat is not as bad as some would claim.
The NotGuru blog has posted some videos that show exactly how clickjacking works and how to install fixes.