The Experts below are selected from a list of 135 Experts worldwide ranked by ideXlab platform
Hisham M Haddad - One of the best experts on this subject based on the ideXlab platform.
-
request and response analysis framework for mitigating Clickjacking attacks
International Journal of Secure Software Engineering, 2015Co-Authors: Hossain Shahriar, Hisham M Haddad, Vamshee Krishna DevendranAbstract:This paper addresses the detection of Clickjacking attacks, which is an emerging web application security issue. The authors propose a web application request and response page analysis framework to detect Clickjacking attacks. Their framework considers not only inspects visual features related to frame, JavaScript code pattern in details to match with known attack signatures. The proposed approach is able to detect advanced Clickjacking attacks such as cursorjacking, double click, and history object-based attacks. The authors evaluate the proposed approach with a set of legitimate and malicious websites. The results indicate that their approach has low false positive and false negative rates. The overhead imposed by the proposed approach is negligible.
-
security assessment of Clickjacking risks in web applications metrics based approach
ACM Symposium on Applied Computing, 2015Co-Authors: Hossain Shahriar, Hisham M HaddadAbstract:Clickjacking attacks steal user clicks through the generation of webpages overlaying legitimate webpages. These attacks redirect user clicks to attacker controlled webpages. Redirection of clicks can cause various unwanted activities and damages to users, such as liking a user profile not known to the victim on social networking websites, and changing of webcam setting revealing personal images and videos. There are little known systematic methodologies to compute the risk caused by Clickjacking attacks. This paper presents an approach to compute the risk level of Clickjacking attacks for deployed applications. In particular, our contribution is a proposed set of metrics to quantify the magnitude of attack prevalence through analysis of relevant code level features and defense mechanisms to prevent the attacks. The risk computation enables practitioners to understand whether more mitigation techniques are needed to prevent losses due to Clickjacking attacks. We validated the proposed metrics using open source PHP web applications. Our evaluation indicates that some popular web applications are still vulnerable to Clickjacking attacks and they require further protection at the implementation and environmental levels.
-
client side detection of Clickjacking attacks
International Journal of Information Security and Privacy, 2015Co-Authors: Hossain Shahriar, Hisham M HaddadAbstract:Clickjacking attacks are emerging threat for web application users where click operations performed by victims lead to security breaches such as compromising webcams and posting unintended messages. Effective client-side defense technique could prevent the possible victims. This paper presents a client side approach to detect Clickjacking attacks. The authors' approach examines web page requests and responses; the proposed approach is designed to detect advanced attack types such as cursorjacking, double click, and history object-based attacks. They evaluate the proposed approach with a set of legitimate and malicious websites. The results indicate that our approach has low false positive and false negative rates. The overhead imposed by the proposed approach is negligible.
-
proclick a framework for testing Clickjacking attacks in web applications
Security of Information and Networks, 2013Co-Authors: Hossain Shahriar, Vamshee Krishna Devendran, Hisham M HaddadAbstract:Clickjacking attacks are an emerging threat on the web. An attacker application presents a User Interface (UI) element of a target application out of context, such as hiding sensitive UI element by making it transparent to the end user. The user is tricked to click on the hidden element out of context. These attacks can cause severe damages such as compromising webcams and posting unintended messages. A large number of websites are still vulnerable to Clickjacking and have no minimal protection at the server side (e.g., frame busting, X-Frame-Options header). Further, client-side defense techniques have been ineffective to deal with sophisticated Clickjacking attack types and suffer from performance issues. This paper presents a proxy-level framework, ProClick, to detect Clickjacking attacks. ProClick examines the content of requests and response pages at the proxy level to detect Clickjacking attacks. We evaluate the proposed approach with a set of legitimate and malicious websites. The results indicate that our approach has low false positive and false negative rates. The overhead imposed by the proposed approach is also very negligible.
Collin Jackson - One of the best experts on this subject based on the ideXlab platform.
-
Clickjacking attacks and defenses
USENIX Security Symposium, 2012Co-Authors: Linshung Huang, Alexander Moshchuk, Helen J Wang, Stuart Schechter, Collin JacksonAbstract:Clickjacking attacks are an emerging threat on the web. In this paper, we design new Clickjacking attack variants using existing techniques and demonstrate that existing Clickjacking defenses are insufficient. Our attacks show that Clickjacking can cause severe damages, including compromising a user's private webcam, email or other private data, and web surfing anonymity. We observe the root cause of Clickjacking is that an attacker application presents a sensitive UI element of a target application out of context to a user (such as hiding the sensitive UI by making it transparent), and hence the user is tricked to act out of context. To address this root cause, we propose a new defense, InContext, in which web sites (or applications) mark UI elements that are sensitive, and browsers (or OSes) enforce context integrity of user actions on these sensitive UI elements, ensuring that a user sees everything she should see before her action and that the timing of the action corresponds to her intent. We have conducted user studies on Amazon Mechanical Turk with 2064 participants to evaluate the effectiveness of our attacks and our defense. We show that our attacks have success rates ranging from 43% to 98%, and our InContext defense can be very effective against the Clickjacking attacks in which the use of Clickjacking is more effective than social engineering.
-
busting frame busting a study of Clickjacking vulnerabilities on popular sites
Web 2.0 Security and Privacy, 2010Co-Authors: Gustav Rydstedt, Elie Bursztein, Dan Boneh, Collin JacksonAbstract:Web framing attacks such as Clickjacking use iframes to hijack a user’s web session. The most common defense, called frame busting, prevents a site from functioning when loaded inside a frame. We study frame busting practices for the Alexa Top-500 sites and show that all can be circumvented in one way or another. Some circumventions are browser-specific while others work across browsers. We conclude with recommendations for proper frame busting.
Hossain Shahriar - One of the best experts on this subject based on the ideXlab platform.
-
request and response analysis framework for mitigating Clickjacking attacks
International Journal of Secure Software Engineering, 2015Co-Authors: Hossain Shahriar, Hisham M Haddad, Vamshee Krishna DevendranAbstract:This paper addresses the detection of Clickjacking attacks, which is an emerging web application security issue. The authors propose a web application request and response page analysis framework to detect Clickjacking attacks. Their framework considers not only inspects visual features related to frame, JavaScript code pattern in details to match with known attack signatures. The proposed approach is able to detect advanced Clickjacking attacks such as cursorjacking, double click, and history object-based attacks. The authors evaluate the proposed approach with a set of legitimate and malicious websites. The results indicate that their approach has low false positive and false negative rates. The overhead imposed by the proposed approach is negligible.
-
security assessment of Clickjacking risks in web applications metrics based approach
ACM Symposium on Applied Computing, 2015Co-Authors: Hossain Shahriar, Hisham M HaddadAbstract:Clickjacking attacks steal user clicks through the generation of webpages overlaying legitimate webpages. These attacks redirect user clicks to attacker controlled webpages. Redirection of clicks can cause various unwanted activities and damages to users, such as liking a user profile not known to the victim on social networking websites, and changing of webcam setting revealing personal images and videos. There are little known systematic methodologies to compute the risk caused by Clickjacking attacks. This paper presents an approach to compute the risk level of Clickjacking attacks for deployed applications. In particular, our contribution is a proposed set of metrics to quantify the magnitude of attack prevalence through analysis of relevant code level features and defense mechanisms to prevent the attacks. The risk computation enables practitioners to understand whether more mitigation techniques are needed to prevent losses due to Clickjacking attacks. We validated the proposed metrics using open source PHP web applications. Our evaluation indicates that some popular web applications are still vulnerable to Clickjacking attacks and they require further protection at the implementation and environmental levels.
-
client side detection of Clickjacking attacks
International Journal of Information Security and Privacy, 2015Co-Authors: Hossain Shahriar, Hisham M HaddadAbstract:Clickjacking attacks are emerging threat for web application users where click operations performed by victims lead to security breaches such as compromising webcams and posting unintended messages. Effective client-side defense technique could prevent the possible victims. This paper presents a client side approach to detect Clickjacking attacks. The authors' approach examines web page requests and responses; the proposed approach is designed to detect advanced attack types such as cursorjacking, double click, and history object-based attacks. They evaluate the proposed approach with a set of legitimate and malicious websites. The results indicate that our approach has low false positive and false negative rates. The overhead imposed by the proposed approach is negligible.
-
classification of Clickjacking attacks and detection techniques
Information Security Journal: A Global Perspective, 2014Co-Authors: Hossain Shahriar, Vamshee Krishna DevendranAbstract:ABSTRACTAmong many existing security threats, Clickjacking attacks are the least understood and one of the common emerging security threats on the Web. A Clickjacking attack lures users to click on objects transparently placed in malicious Web pages that may lead to unwanted operations on the legitimate Websites without the knowledge of the users. In particular, victims can be tricked to click on objects from various Websites such as social networks (Facebook, Twitter), shopping (Amazon), and online banking. Therefore, Clickjacking attacks need to be addressed to mitigate these unwanted consequences. To combat the Clickjacking attacks, it is necessary to understand how Clickjacking attacks occur in the real world along with the comparative performance of the state-of-the art solutions.In this article, we discuss various basic and advanced Clickjacking attacks. We then discuss a number of client, server, and proxy-level approaches that can be employed to combat Clickjacking attacks. We also highlight the a...
-
proclick a framework for testing Clickjacking attacks in web applications
Security of Information and Networks, 2013Co-Authors: Hossain Shahriar, Vamshee Krishna Devendran, Hisham M HaddadAbstract:Clickjacking attacks are an emerging threat on the web. An attacker application presents a User Interface (UI) element of a target application out of context, such as hiding sensitive UI element by making it transparent to the end user. The user is tricked to click on the hidden element out of context. These attacks can cause severe damages such as compromising webcams and posting unintended messages. A large number of websites are still vulnerable to Clickjacking and have no minimal protection at the server side (e.g., frame busting, X-Frame-Options header). Further, client-side defense techniques have been ineffective to deal with sophisticated Clickjacking attack types and suffer from performance issues. This paper presents a proxy-level framework, ProClick, to detect Clickjacking attacks. ProClick examines the content of requests and response pages at the proxy level to detect Clickjacking attacks. We evaluate the proposed approach with a set of legitimate and malicious websites. The results indicate that our approach has low false positive and false negative rates. The overhead imposed by the proposed approach is also very negligible.
Atul Prakash - One of the best experts on this subject based on the ideXlab platform.
-
android ui deception revisited attacks and defenses
Financial Cryptography, 2016Co-Authors: Earlence Fernandes, Qi Alfred Chen, Justin Paupore, Georg Essl, Alex J Halderman, Morley Z Mao, Atul PrakashAbstract:App-based deception attacks are increasingly a problem on mobile devices and they are used to steal passwords, credit card numbers, text messages, etc. Current versions of Android are susceptible to these attacks. Recently, Bianchi et al. proposed a novel solution “What the App is That” that included a host-based system to identify apps to users via a security indicator and help assure them that their input goes to the identified apps [7]. Unfortunately, we found that the solution has a significant side channel vulnerability as well as susceptibility to Clickjacking that allow non-privileged malware to completely compromise the defenses, and successfully steal passwords or other keyboard input. We discuss the vulnerabilities found, propose possible defenses, and then evaluate the defenses against different types of UI deception attacks.
Nickolai Zeldovich - One of the best experts on this subject based on the ideXlab platform.
-
Intrusion recovery for database-backed web applications
Proceedings of the Twenty-Third ACM Symposium on Operating Systems Principles - SOSP '11, 2011Co-Authors: Ramesh Chandra, Meelap Shah, Neha Narula, Taesoo Kim, Nickolai ZeldovichAbstract:WARP is a system that helps users and administrators of web applications recover from intrusions such as SQL injection, cross-site scripting, and Clickjacking attacks, while preserving legitimate user changes. WARP repairs from an intrusion by rolling back parts of the database to a version before the attack, and replaying subsequent legitimate actions. WARP allows administrators to retroactively patch security vulnerabilities—i.e., apply new security patches to past executions—to recover from intrusions without requiring the administrator to track down or even detect attacks. WARP’s time-travel database allows fine-grained rollback of database rows, and enables repair to proceed concurrently with normal operation of a web application. Finally, WARP captures and replays user input at the level of a browser’s DOM, to recover from attacks that involve a user’s browser. For a web server running MediaWiki, WARP requires no application source code changes to recover from a range of common web application vulnerabilities with minimal user input at a cost of 24–27% in throughput and 2–3.2 GB/day in storage