Clickjacking is a type of attack that tricks a user into clicking a website element that is either invisible or disguised as another element. This hijacks a user\u2019s click meant for one thing but leads to another. <\/p>
For example: instead of clicking a button to reply, a clickjacking attack on a Twitter user can make them re-tweet a malicious domain to followers instead. This is typically seen as a browser security issue. However, such an attack can also take place in mobile applications.<\/p>
Clickjacking is\u00a0an attack that tricks users into thinking they are clicking on one thing when in fact, they are clicking on something else. Essentially, unsuspecting users believe they are using a web page\u2019s usual user interface when in reality, attackers have imposed a hidden user interface instead. <\/p>
When users click on buttons they think are safe, the hidden user interface performs a different action. This can cause users to inadvertently download\u00a0malware, provide credentials or sensitive information, visit malicious web pages, transfer money, or purchase products online.<\/p>
There are different variations of clickjacking attacks and because of that, the terms \u2018user interface (UI) redressing\u2019 or \u2018UI redress attacks\u2019 are often used to encompass different variations.<\/p>
Also known as a user redress interface attack, the term clickjacking was coined by Jeremiah Grossman and Robert Hansen in 2008.<\/p>
While clickjacking might seem like spoofing\u2014in which the cyber attacker recreates websites or landing pages to trick users into thinking the fake pages are the original, legitimate pages\u2014it is much more sophisticated. The website the victim is looking at in a clickjacking scheme is the real website of a known, trusted entity. <\/p>
However, the attacker has added an invisible overlay over its content using various HTML technologies, including custom cascading style sheets (CSS) and iframe, which allow for content from other websites to be ported onto another website.<\/p>
Clickjacking is possible because of HTML frames or iframes \u2013 i.e., the ability to display web pages within other web pages through frames. Essentially, an iframe is a frame within a frame. Iframes enable you to embed content from other sources onto your web pages. <\/p>
For example, when you visit a website that has an embedded YouTube video displayed, that video exists within an iframe. This creates a clickjacking e. If a web page can be displayed within a frame, attackers can cover the original web page with a hidden, transparent layer with its own JavaScript and UI elements. The outward appearance of the web page remains unchanged, which means users have no reason to suspect anything might be amiss.<\/p>
Users then navigate the web page, expecting links and buttons to work normally. But the hidden UI means the attacker\u2019s script works instead. The attacker\u2019s script can work behind the scenes to make it appear as though nothing is wrong. This makes a range of malicious actions possible, including:<\/p>
Also, remember that clickjacking isn\u2019t just about mouse clicks. Using a combination of stylesheets, text boxes, and iframes, an attacker could fool an unsuspecting user into thinking they are typing in their password on their online banking site, when in fact they are typing it into a site controlled by the attacker.<\/p>
As with other forms of cybercrime, clickjacking attacks often rely on some form of\u00a0social engineering\u00a0to direct the targets to the compromised or malicious site. This might be an email, a text message, a social media post, and so on.<\/p>
Perhaps the most common clickjacking strategy, this method overlays a legitimate webpage over a malicious page. The legitimate page is loaded into an invisible iframe, and the user has no idea that a malicious page is underneath. <\/p>
Cursorjacking changes the user\u2019s cursor position to a different place from where the user perceives it. A typical cursorjacking attack replaces the actual cursor with a fake one, using an image, and offsets it from the location of the real cursor. As a result, the user believes they are making a particular action while they are really making another one. <\/p>
When the victim clicks an intended element with the fake cursor, the actual cursor clicks a malicious element. The real cursor may remain visible in a cursorjacking attack, although efforts are made to focus the victim\u2019s attention on the fake one.<\/p>