![Page 1: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/1.jpg)
CSE484/CSEM584ComputerSecurity:
Clickjacking
ThankstoFranzi Roesner,DanBoneh,DieterGollmann,DanHalperin,YoshiKohno,JohnManferdelli,JohnMitchell,Vitaly Shmatikov,BennetYee,andmanyothersforsampleslidesandmaterials...
![Page 2: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/2.jpg)
Lab2
• Questions– WhatistheflowoftheXSSattacks?– HowkindofinformationdoyouneedleakedforSQLinjectionattacks?
– Others?
![Page 3: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/3.jpg)
DirectingUserBehavior
• Demo– http://lcamtuf.coredump.cx/ffgeo2/
![Page 4: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/4.jpg)
ThefollowingslidesoriginallymadebyVitalyShmatikov
hNp://www.cs.utexas.edu/~shmat/courses/cs361s/clickjack.ppt
![Page 5: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/5.jpg)
• Attackeroverlaysmultipletransparentoropaqueframestotrickauserintoclickingonabuttonorlinkonanotherpage
• Clicksmeantforthevisiblepagearehijackedandroutedtoanother,invisiblepage
Clickjacking(UIRedressing)
slide 5
[Hansen and Grossman 2008]
![Page 6: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/6.jpg)
ClickjackingintheWild
• Googlesearchfor“clickjacking”returns624,000results…thisisnotahypotheticalthreat!
• Summer2010:Facebookwormsuperimposesaninvisibleiframeovertheentirepagethatlinksbacktothevictim'sFacebookpage– Ifvictimisloggedin,automaticallyrecommendslinktonewfriendsassoonasthepageisclickedon
• ManyclickjackingattacksagainstTwitter– Userssendouttweetsagainsttheirwill
slide 6
![Page 7: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/7.jpg)
It’sAllAboutiFrame
• Anysitecanframeanyothersite<iframesrc=“http://www.google.com/...”>
</iframe>• HTMLattributes
– Style– Opacity definesvisibilitypercentageoftheiframe
• 1.0:completelyvisible• 0.0:completelyinvisible
slide 7
![Page 8: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/8.jpg)
HidingtheTargetElement
• UseCSSopacity propertyandz-indexpropertytohidetargetelementandmakeotherelementfloatunder thetargetelement
• UsingCSSpointer-events: nonepropertytocoverotherelementover thetargetelement
Click
z-index: -1
opacity: 0.1 pointer-event: none
Click
slide 8
[“Clickjacking: Attacks and Defenses”]
![Page 9: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/9.jpg)
Whatothertypesofuser-manipulativeattacksmightbepossibleusingpropertiesofcss?
![Page 10: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/10.jpg)
PartialOverlaysandCropping
• OverlayotherelementsontoaniframeusingCSSz-index propertyorFlashWindowModewmode=direct property
• WraptargetelementinanewiframeandchooseCSSpositionoffsetproperties
slide 10
[“Clickjacking: Attacks and Defenses”]
z-index: 1 PayPal iframe PayPal iframe
![Page 11: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/11.jpg)
Drag-and-DropAPI
• Modernbrowserssupportdrag-and-dropAPI• JavaScriptcanuseittosetdatabeingdraggedandreaditwhenit’sdropped
• Not restrictedbythesameoriginpolicy:datafromoneorigincanbedraggedtoaframeofanotherorigin– Reason:drag-and-dropcanonlybeinitiatedbyuser’smousegesture,notbyJavaScriptonitsown
slide 11
[“Next Generation Clickjacking”]
![Page 12: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/12.jpg)
AbusingDrag-and-DropAPI
slide 12
[“Next Generation Clickjacking”]
Frog. Blender. You know what to do.
1. Bait the user to click and start dragging2. Invisible iframe with attacker’s
text field under mouse cursor,use API to set data being dragged
3. Invisible iframe from another origin with a form field
Attack webpage
666666666666666666
With two drag-and-drops(simulated scrollbar, etc.),can select and extractarbitrary content fromanother origin
![Page 13: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/13.jpg)
FakeCursors
• UseCSScursor propertyandJavaScripttosimulateafakecursoricononthescreen
slide 13
[“Clickjacking: Attacks and Defenses”]
Real cursor icon Fake cursor icon
cursor: none
![Page 14: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/14.jpg)
CursorSpoofing
slide 14
[“Clickjacking: Attacks and Defenses”]
![Page 15: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/15.jpg)
Keyboard“Strokejacking”
• Simulateaninputfieldgettingfocus,butactuallythekeyboardfocusisontargetelement,forcingusertotypesomeunwantedinformationintotargetelement
slide 15
[“Clickjacking: Attacks and Defenses”]
Transfer
Bank TransferBank Account: ________Amount: ___________ USD
Typing GameType whatever screen shows to you
Xfpog95403poigr06=2kfpx
[__________________________]
Attacker’s page Hidden iframe within attacker’s page
95403062
![Page 16: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/16.jpg)
Double-ClickAttack
• Baittheusertoperformadouble-click,switchfocustoapopupwindowunderthecursorrightbetweenthetwoclicks
slide 16
[“Clickjacking: Attacks and Defenses”]
First click
Second click
![Page 17: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/17.jpg)
Whack-A-MoleAttack
• Asktheusertoclickasfastaspossible,suddentlyswitchFacebookLikebutton
slide 17
[“Clickjacking: Attacks and Defenses”]
![Page 18: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/18.jpg)
SOLUTIONS?
![Page 19: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/19.jpg)
Solution:FrameBusting
• Iamapageowner• AllIneedtodoismakesurethatmywebpageisnotloadedinanenclosingframe…Clickjacking:solved!– DoesnotworkforFB“Like”buttonsandsuch,butOk
• Howhardcanthisbe?if(top!=self)top.location.href =location.href
slide 19
![Page 20: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/20.jpg)
FrameBustingintheWild
◆SurveybyGustavRydstedt,Elie Burzstein,DanBoneh,CollinJackson
FollowingslidesshamelesslyjackedfromRydstedt
slide 20
![Page 21: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/21.jpg)
Conditional Statementsif (top != self)
if (top.location != self.location)if (top.location != location)if (parent.frames.length > 0)
if (window != top)if (window.top !== window.self)if (window.self != window.top)
if (parent && parent != window)if (parent &&
parent.frames && parent.frames.length>0)
if((self.parent&&!(self.parent===self))&&
(self.parent.frames.length!=0))
IfMyFrameIsNotOnTop…
slide 21
![Page 22: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/22.jpg)
Counter-Action Statements
top.location = self.location
top.location.href = document.location.href
top.location.href = self.location.href
top.location.replace(self.location)
top.location.href = window.location.href
top.location.replace(document.location)
top.location.href = window.location.href
top.location.href = "URL"
document.write(’’)
top.location = location
top.location.replace(document.location)
top.location.replace(’URL’)
top.location.href = document.location
top.location.replace(window.location.href)
top.location.href = location.href
self.parent.location = document.location
parent.location.href = self.document.location
top.location.href = self.location
top.location = window.location
top.location.replace(window.location.pathname) slide 22
…MoveItToTop
![Page 23: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/23.jpg)
WhatAboutMyOwniFrames?
• Check:istheenclosingframeoneofmyown?• Howhardcanthisbe?• Surveyofseveralhundredtopwebsites……all framebustingcodeisbroken!
slide 23
![Page 24: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/24.jpg)
CourtesyofWalmartif(top.location!=location){if(document.referer&&document.referer.indexOf("walmart.com")==-1){top.location.replace(document.location.href);}
}
slide 24
![Page 25: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/25.jpg)
ErrorinRefererChecking
Fromhttp://www.attacker.com/walmart.com.html<iframesrc=“http://www.walmart.com”>
slide 25
![Page 26: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/26.jpg)
Courtesyof
if(window.self!=window.top&&!document.referer.match(/https?:\/\/[^?\/]+\.nytimes\.com\//))
{self.location=top.location;
}
slide 26
![Page 27: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/27.jpg)
ErrorinRefererChecking
Fromhttp://www.attacker.com/a.html?b=https://www.nytimes.com/
<iframesrc=“http://www.nytimes.com”>
slide 27
![Page 28: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/28.jpg)
Courtesyof
if(self!=top){vardomain=getDomain(document.referer);varokDomains=/usbank|localhost|usbnet/;varmatchDomain=domain.search(okDomains);
if(matchDomain==-1){//framebust}
}slide 28
![Page 29: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/29.jpg)
ErrorinRefererChecking
Fromhttp://usbank.attacker.com/<iframesrc=“http://www.usbank.com”>
slide 29
![Page 30: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/30.jpg)
StrategicRelationship?NorwegianStateHouseBankhttp://www.husbanken.no
slide 30
![Page 31: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/31.jpg)
StrategicRelationship?BankofMoscow
http://www.rusbank.org
slide 31
![Page 32: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/32.jpg)
Courtesyoftry{
A=!top.location.href}catch(B){}A=A&&
!(document.referer.match(/^https?:\/\/[-az09.]*\.google\.(co\.|com\.)?[a-z]+\/imgres/i))&&!(document.referer.match(/^https?:\/\/([^\/]*\.)?(myspace\.com|myspace\.cn|simsidekick\.com|levisawards\.com|digg\.com)\//i));
if(A){//Framebust}slide 32
![Page 33: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/33.jpg)
GoogleImagesdoesnot framebust
DoYourTrustedSitesFrameBust?
slide 33
![Page 34: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/34.jpg)
ManyAttacksonRefererHeader
• Openredirectrefererchanger• HTTPS->HTTPredirectchangestheheader• Apparently,hardtogetregularexpressionright
• Trustothersitestoframeyourpages,butwhatifthosetrustedsitescanbeframedthemselves?
slide 34
![Page 35: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/35.jpg)
TypicalFrameBustingCode
if(top.location!=self.location){parent.location=self.location;
}
slide 35
![Page 36: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/36.jpg)
WhoIsYourDaddyParent?
framed1.html<iframe
src=“framed2.html”>
framed2.html<iframe
src=“victim.com”>
slide 36
Double framing!!
![Page 37: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/37.jpg)
WhoIsOnTop?
Iftop.location canbechangedordisabled,thiscodeisuseless
if(top.location !=self.location)top.location =self.location
slide 37
![Page 38: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/38.jpg)
LocationClobbering
• IE7varlocation=“clobbered”;
• Safariwindow.__defineSetter__("location",function(){});
– top.locationnowundefined
slide 38
![Page 39: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/39.jpg)
UserCanStopFrameBusting
• Usercanmanuallycancelanyredirectionattemptmadebyframebustingcode
• Attackerjustneedstoask…<script>window.onbeforeunload =function(){return”DoyouwanttoleavePayPal?";
}</script><iframesrc="http://www.paypal.com">
slide 39
![Page 40: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/40.jpg)
AskNicely
slide 40
![Page 41: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/41.jpg)
…OrDon’tEvenAsk
• Mostbrowsersletattackercanceltherelocationprogrammatically
varprevent_bust=0window.onbeforeunload =function(){kill_bust++}setInterval(function(){
if(kill_bust>0){kill_bust-=2;window.top.location='http://no-content-204.com'}
},1);<iframesrc="http://www.victim.com">
slide 41
![Page 42: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/42.jpg)
X-Frame-Options
• HTTPheadersentwiththepage• Twopossiblevalues:DENY andSAMEORIGIN• DENY:pagewillnotrenderifframed• SAMEORIGIN:pagewillonlyrenderiftopframehasthesameorigin
slide 42
![Page 43: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/43.jpg)
AdoptionofX-Frame-Options• Goodadoptionbybrowsers• Pooradoptionbysites• Limitations
– Per-pagepolicy– Nowhitelistingoforigins– Proxyproblems
slide 43
![Page 44: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/44.jpg)
ContentSecurityPolicy(Firefox4)
• AnotherHTTPheader:frame-ancestorsdirectivecanspecifyallowedframers
• Allowsspecificrestrictionsandabilitiespersite
slide 44
![Page 45: Computer Security: Clickjacking - University of Washington · CSE 484 / CSE M 584 Computer Security: Clickjacking Jared Moore jlcmoore@cs.washington.edu Thanks to Franzi Roesner,](https://reader033.vdocument.in/reader033/viewer/2022042106/5e848765c4ef533deb424191/html5/thumbnails/45.jpg)
<style>html{visibility:hidden}</style><script>if(self==top){document.documentElement.style.visibility='visible';}else{top.location=self.location;}</script>
BestForNow(StillNotGood)
slide 45