2 ms·
New clickjacking affects all browsers; cause remains unknown
- palish 18y agoOk, I'll bite: Does anyone have an idea how this exploit works?
- kirse 18y agoI'm sure it involves iframes and some sort of absolute CSS positioning. That's about as flexible you can get if Javascript is off. (I'd guess the affected Adobe product is Flash)
- gojomo 18y agoHmm, can you open an IFrame that is transparent, at a desired scroll-offset, and still receives clicks? Then you could, for example, open an Amazon IFrame with the region at Amazon you know to be a one-click-order button exactly aligned over an attractive click-region in your exploit page. If you can still detect the click before it goes to the IFrame, you could also simulate the click on your page so the 'teeing off' of the click to another site stays unnoticed.
- inerte 18y agoSlashdot to the rescue: http://it.slashdot.org/comments.pl?sid=976325&cid=25157139 http://it.slashdot.org/comments.pl?sid=976325&cid=251571... My interpretation is that an attacker can make a user do something on a website, but precisely what, I don't know.
- deleted 18y ago[deleted]
- brianmckenzie 18y agoI've seen quite a few strange behaviors in all the browsers whilst hacking away at CSS. Not inclined to attempt a duplicate exploit, but it may involve some combination of visibility: hidden; with older tags that breaks the expected behavior. Absolute positioning w/z-index could be involved as well. That might explain why Adobe was upset about it - you can do some pretty weird stuff with z-index and the flash player. That doesn't nearly cover all the possibilities I can think of, and it's probably not the last CSS exploit we'll see.