The Clickjack Fix and Its Side Effects
19th November 2008
ZDnet and other technical news sites have reported that clickjacking — a potentially serious threat — can affect any browser.
What is Clickjacking
In laymen’s terms, clickjacking happens when a malicious page is hiding behind what appears to be a safe webpage. When you click an item on the supposedly safe page, your computer is clickjacked by malicious code which then hijacks your pc’s accessories or other components.This takes place without your knowledge.
Generally, webcams are hijacked, but clickjacking is not limited to affecting a cam. For instance, your sound system or microphone can be exploited, or your PC can be taken over in other ways.
Particularly vulnerable to clickjacking was Adobe’s Flash Player, but Adobe has issued a fix that addresses the issue.
What Browsers are Safe?
Clickjacking is a malicious piece of code that can affect any Internet browser. Merely disabling javascript will not fix it.
A “No Script” add-on that works with Firefox is the only known solution.
Problems with the Clickjacking Fix
After using No Script for a week or so, I disabled it because it made web surfing a chore. Every site I visited was blocked to some degree because of YouTube videos, javascript coding or ads installed on the page. For instance, the following were all blocked by No Script:
- Google Analytics
- Pepperjam network
- Peelaway Ads
- Voxant’s newsroom
- Chitika
- and many, many more (see the partial list of affiliate programs and other utilities blocked by No Script).
Fortunately for adsense publishers, Google’s Adsense is among the short list of networks automatically whiteliested by the No Script add-on. Most of the others will need to be manually approved, and it is unlikely that the average Internet user will know that an ad is safe enough to whitelist.
If clickjacking is as bad of a problem as some say it is and if No Script and similar “script blocking” solutions are the only ways to fight back, then online advertising could take a major hit. Adserver Plus and other heavy hitting advertising networks were blocked by the Firefox add-on.
Conclusion: Maybe the Threat is Overrated
My web browsing experience is back up to speed since I’ve disabled No Script and so far I haven’t been hit by any type of clickjacking activities. It is possible that the clickjacking threat is overrated.
The NotGuru blog has posted some videos that show exactly how clickjacking works and how to install fixes.
Print This Post