Clickjacking Revisited: A Perceptual View of UI Security

Warren He presented his work on new forms of clickjacking attacks; this was joint work with some of his fellow researchers at UC Berkeley. Their team frames clickjacking as fundamentally an attack on a user’s perception; all five of their new attacks work by manipulating or diverting a user’s attention from security UI events that would otherwise alert users of the clickjacking attack. He argued that their perceptual attacks defeat many existing clickjacking defenses, including the new W3C UI defense, which requires cross-origin elements to be visible for a short amount of time before a UI event can interact with the element. However, their attack model does not include breaking X-Frame-Options because X-Frame-Options cannot be used for third-party mashup applications, such as the Facebook Like Button, that are embedded on many popular Web sites.