Clickjacking
Web Security
Clickjacking, also known as UI redressing, is an attack that tricks users into clicking on hidden or disguised page elements by overlaying transparent layers on top of legitimate web content. The user sees and interacts with a trusted page, but their clicks are actually captured by an invisible malicious layer, triggering unintended actions such as enabling a webcam, transferring funds, changing account settings, or granting permissions.
The most common implementation of clickjacking involves embedding the target website in a transparent iframe positioned over a decoy page with enticing content. When the user clicks on what they believe is the decoy page's button, they are actually clicking on a button in the invisible iframe from the legitimate site. More advanced variants include cursorjacking (manipulating cursor position), likejacking (hijacking social media likes), and drag-and-drop clickjacking that can extract data from one page into another.
Clickjacking can be combined with other attack techniques for amplified impact. An attacker might use clickjacking to disable a security setting, then follow up with a separate attack that exploits the lowered defenses. Social media platforms are frequent targets, where clickjacking is used to spread viral content, inflate engagement metrics, or trick users into following malicious accounts.
The most common implementation of clickjacking involves embedding the target website in a transparent iframe positioned over a decoy page with enticing content. When the user clicks on what they believe is the decoy page's button, they are actually clicking on a button in the invisible iframe from the legitimate site. More advanced variants include cursorjacking (manipulating cursor position), likejacking (hijacking social media likes), and drag-and-drop clickjacking that can extract data from one page into another.
Clickjacking can be combined with other attack techniques for amplified impact. An attacker might use clickjacking to disable a security setting, then follow up with a separate attack that exploits the lowered defenses. Social media platforms are frequent targets, where clickjacking is used to spread viral content, inflate engagement metrics, or trick users into following malicious accounts.
Key Statistics
- Approximately 90% of the top 500 websites use X-Frame-Options or CSP frame-ancestors to defend against clickjacking.
- OWASP includes clickjacking as a notable client-side attack in its testing methodology and prevention guidelines.
- A Stanford University study found that clickjacking attacks succeed against approximately 40% of users who encounter them.
- Likejacking campaigns on social media have reached millions of users in single incidents according to Sophos research.
Prevention Strategies
- Implement X-Frame-Options headers set to DENY or SAMEORIGIN to prevent your pages from being embedded in frames on other sites.
- Deploy Content Security Policy with the frame-ancestors directive for more granular control over which domains can embed your content.
- Use JavaScript frame-busting techniques as a supplementary defense for browsers that may not fully support header-based protections.
- Implement user interaction confirmation dialogs for sensitive actions that require explicit, context-aware user consent.
- Test your application regularly for clickjacking vulnerabilities using automated security scanning tools.
How Beacky Helps
Beacky's beacons can detect when your pages are being embedded in unauthorized iframes on attacker-controlled domains, a key component of clickjacking attacks. When an attacker frames your content to exploit your users through clickjacking, the beacon reports the embedding domain, allowing your team to identify the attack and verify that your frame protection headers are properly deployed.