127

Trick users and bypass warnings – Modern SVG Clickjacking attacks

I already keep SVG disabled for security reasons, but it's increasingly looking like I'll have to find some way to disable CSS too. It's too bad people couldn't leave CSS alone as a nice simple (sort of) way to format text because turning it into another programing langue is begging for it to be abused by hackers and other malicious actors (like advertisers) just like JS

5 hours agoautoexec

> It's too bad people couldn't leave CSS alone as a nice simple (sort of) way to format text

The base form of this attack goes back to the original CSS 1.

Honestly you are massively overreacting. This type of attack was much much easier to pull off in the late 2000s then it is now. Its basically impossible in practise now a days.

2 hours agobawolff

why not disable javascript once and for all.

Most site shouldn't run any js after content is loaded.

I hope there's something like <body onload="js.disable()">

I can only do it manually in DevTool.

3 hours agoest

Why on earth would you want to load JS before content is loaded but not after? If you are able to assemble the page based on data sources before loading the page, you can just server-render the damn thing and disable JS altogether?

JS is essential for polished UX when you have highly interactive components. Technically mapquest got server-rendered interactive maps working, but no one would choose that over the usability of Google Maps or OpenStreetMaps today

an hour agopcthrowaway

I've got noscript which at least keeps JS off by default and allows me to selectively enable scripts by domain. Now I just a similar tool for CSS. Something that whitelists a sane set of features that can't be used (at least as easily) for interactivity, ads, fingerprinting, and other malicious activity while letting me explicitly blacklist annoyances (like scrollbar styles or sticky headers). The way things are going I'll probably need something similar for HTML too.

2 hours agoautoexec

That's not relavent to the attack discussed in the article. These types of attacks do not involve javascript, nor could they due to the same origin policy.

2 hours agobawolff

Does JS protect against this particular attack? It seems like it's mostly implemented in CSS and SVG.

2 hours agokg

nah, that is overkill. the probability of falling for this is still tiny and it cannot break the sandbox, steal session cookies, or anything like that .

5 hours agopaulpauper

Sandbox escapes are discovered all the time (pretty sure I've read about a few just this past week) and there are a lot of other problems CSS can enable (ads, fingerprinting, etc)

2 hours agoautoexec

That's cool and all, but clickjacking is really overrated and its easy to address via x-frame-options. Most attack scenarios are very convoluted and impractical in real life (doubly so now that samesite cookies and cookie storage partitioning is now a thing).

Basically i dont think anyone should worry about this.

2 hours agobawolff

The SVG adder is art. Love it.

4 hours agozephraph

As someone who runs a site that uses inline SVG, this is unfortunate. Hopefully it won't be a problem for me.

5 hours agoscoofy

Maybe I'm missing something, but it looks like it requires an iframe attack or an XSS to work correctly, both of which have page/server settings that can be used to avoid them.

5 hours agopixl97

It's easy to prevent clickjacking attacks by not allowing your website to be embedded in an iframe.

You can do that by either adding a header to your network requests, o̶r̶ ̶b̶y̶ ̶a̶d̶d̶i̶n̶g̶ ̶t̶h̶e̶ ̶f̶o̶l̶l̶o̶w̶i̶n̶g̶ ̶m̶e̶t̶a̶ ̶t̶a̶g̶ ̶t̶o̶ ̶y̶o̶u̶r̶ ̶p̶a̶g̶e̶:̶

̶<̶m̶e̶t̶a̶ ̶h̶t̶t̶p̶-̶e̶q̶u̶i̶v̶=̶"̶X̶-̶F̶r̶a̶m̶e̶-̶O̶p̶t̶i̶o̶n̶s̶"̶ ̶c̶o̶n̶t̶e̶n̶t̶=̶"̶D̶E̶N̶Y̶"̶>̶

EDIT:

According to MDN, it will only work by adding it to your headers. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...

4 hours agospartanatreyu

A long time ago there was a facebook clickjacking method that could make someone inadvertently share a link or like a page. The former required clicking a combination of colored buttons and was quite clever. This was in 2010. But it could not do more, like steal sessions.