Well here is an old Nokia browser bug (for Symbian) which was declared as won't fix by Nokia.
Test device :- nokia 5233
vulnerable application :- Nokia browser 7.3.1.33
Everyone is quite well aware of clickjacking bugs.
If you don't, then read it out.
https://www.owasp.org/index.php/Clickjacking
Most of the website owners use the x-frame header option to avoid clickjacking over their website. And this feature is supported by almost all browser.
As it can be seen in the above image, Google uses x-frame-options. So if you try to open their website in an iframe...
The website won't load. But...
When the same thing
<html>
<head>
<title>Clickjack test page</title>
</head>
<body>
<p>Website is vulnerable to clickjacking!</p>
<iframe src="http://www.google.com" width="350" height="400"></iframe>
</body>
</html>
Was opened in a Nokia symbian browser
Buuhahahah. Kind of universal clickjacking.
Well, opera browsers were not vulnerable :)
I reported it on 21st March 2013
But they said they won't fix.
There can be many reasons for not fixing it. The best one I guess is they are busy manufacturing Lumia and Symbian are out of the game :D.
But they should have fixed it because clickjacking is quite harmful in some of the cases and is even used as a catalyst for CSRF attacks. Suppose you are visiting an XYZ website. And the bad website owner has found a CSRF bug. He hides the payload in a frame inside his webpages. Sets the height and width of the frame to zero or changes the opacity to make it invisible, and everything will go un-noticed. Even applicable for an XSS bug. Executing XSS and CSRF inside an invisible frame has the least probability of suspicion rather than crafting the payload URL and send emails or use your ninja S.E tricks to take over the victim.
Cheers :)
Sorry for a very late post :)
Test device :- nokia 5233
vulnerable application :- Nokia browser 7.3.1.33
Everyone is quite well aware of clickjacking bugs.
If you don't, then read it out.
https://www.owasp.org/index.php/Clickjacking
Most of the website owners use the x-frame header option to avoid clickjacking over their website. And this feature is supported by almost all browser.
As it can be seen in the above image, Google uses x-frame-options. So if you try to open their website in an iframe...
The website won't load. But...
When the same thing
<html>
<head>
<title>Clickjack test page</title>
</head>
<body>
<p>Website is vulnerable to clickjacking!</p>
<iframe src="http://www.google.com" width="350" height="400"></iframe>
</body>
</html>
Was opened in a Nokia symbian browser
Buuhahahah. Kind of universal clickjacking.
Well, opera browsers were not vulnerable :)
I reported it on 21st March 2013
But they said they won't fix.
There can be many reasons for not fixing it. The best one I guess is they are busy manufacturing Lumia and Symbian are out of the game :D.
But they should have fixed it because clickjacking is quite harmful in some of the cases and is even used as a catalyst for CSRF attacks. Suppose you are visiting an XYZ website. And the bad website owner has found a CSRF bug. He hides the payload in a frame inside his webpages. Sets the height and width of the frame to zero or changes the opacity to make it invisible, and everything will go un-noticed. Even applicable for an XSS bug. Executing XSS and CSRF inside an invisible frame has the least probability of suspicion rather than crafting the payload URL and send emails or use your ninja S.E tricks to take over the victim.
Cheers :)
Sorry for a very late post :)
thankx 4 this wonderfull article, I dont know how click jacking works but after reading this article, now i have some knowledge about clickjaking...... thankx CyberBoy
ReplyDeleteGlad it was useful for u :)
ReplyDeleteBro can u post some more articles about Click jacking so that i can learn more....
ReplyDelete