Clickjacking Evolves to Hook Millions of Visitors to Top Sites

guest · Aug 15, 2019

Clickjacking Evolves to Hook Millions of Visitors to Top Sites
Researchers said that clickjacking is a threat that’s evolving, with new tactics just starting to emerge
August 14, 2019
https://threatpost.com/clickjacking-millions-top-sites/147367/

Clickjacking, where links on a website redirect unknowing users to spam, advertising or malware, has been around for decades. However, new tactics that defy the best mitigation efforts of browsers has led to it affecting millions of internet users browsing the web’s top sites, researchers found in a new study.

“We further revealed that many third-party scripts intercept user clicks for monetization via committing ad click fraud,” researchers said. “In addition, we demonstrated that click interception can lead victim users to malicious contents. Our research sheds light on an emerging client-side threat, and highlights the need to restrict the privilege of third-party JavaScript code.”
These scripts look like an innocent-looking link (such as a Facebook button) – but secretly have code for a different application embedded in an iframe tag or other component. So, when a victim clicks on the link, they are “hijacked” (hence the name clickjacked) and brought to a malicious or spam page.
Website Collusion

“Instead of relying on click bots, attackers recently started to intercept and redirect clicks or page visits from real users to fabricate realistic ad clicks,” researchers said.
Interestingly, while many third-party scripts modified first-party hyperlinks to intercept user clicks, researchers also discovered that some websites collude with third-party scripts to hijack user clicks for monetization.
Click to expand...

Paper: "All Your Clicks Belong to Me: Investigating Click Interception on the Web"
(PDF - 1.87 MB): https://www.usenix.org/system/files/sec19fall_zhang_prepub.pdf

Log in or Sign up

Clickjacking Evolves to Hook Millions of Visitors to Top Sites

guest Guest

Log in or Sign up

Clickjacking Evolves to Hook Millions of Visitors to Top Sites

guest Guest

Useful Searches