Clickjuggler: Checking for incomplete defenses against clickjacking

Yusuke Takamatsu, Kenji Kono

研究成果: Conference contribution

6 被引用数 (Scopus)

抄録

Clickjacking is a new attack which exploits a vulnerability in web applications. It tricks victims into clicking on something different from what they perceive they are clicking on. The victims may reveal confidential information or start unintended online transactions. Clickjacking can be prevented if appropriate countermeasures such as frame busting are implemented in web applications. However, the correct implementation is not easy. A trivial mistake in the implementation leads to evasion of the countermeasures. For the correct implementation, web developers must have intimate knowledge on evasion techniques of the countermeasures. In this paper, we propose Clickjuggler, an automated tool for checking for defenses against clickjacking during the development. Clickjuggler generates clickjacking attacks, performs those attacks on web applications, and checks whether the attacks are successful or not. By automating the process of checking for the clickjacking vulnerabilities, web developers are released from the burden of checking the correctness of their implementation. Unskillful developers can benefit from Clickjuggler since no special knowledge on clickjacking is needed to use Clickjuggler. Our experimental results demonstrate that Clickjuggler can check for the clickjacking vulnerabilities in 4 real-world web applications.

本文言語English
ホスト出版物のタイトル2014 12th Annual Conference on Privacy, Security and Trust, PST 2014
編集者Ali Miri, Audun Josang, Joaquin Garcia-Alfaro, Urs Hengartner, Nen-Fu Huang
出版社Institute of Electrical and Electronics Engineers Inc.
ページ224-231
ページ数8
ISBN(電子版)9781479935031
DOI
出版ステータスPublished - 2014 1 1
イベント2014 12th Annual Conference on Privacy, Security and Trust, PST 2014 - Toronto, Canada
継続期間: 2014 7 232014 7 24

出版物シリーズ

名前2014 12th Annual Conference on Privacy, Security and Trust, PST 2014

Other

Other2014 12th Annual Conference on Privacy, Security and Trust, PST 2014
国/地域Canada
CityToronto
Period14/7/2314/7/24

ASJC Scopus subject areas

  • ソフトウェア
  • コンピュータ サイエンスの応用
  • 安全性、リスク、信頼性、品質管理

引用スタイル