New clickjacking affects all browsers; cause remains unknown

arstechnica.com

14 points·makimaki··5 comments

Ok, I'll bite: Does anyone have an idea how this exploit works?

I'm sure it involves iframes and some sort of absolute CSS positioning. That's about as flexible you can get if Javascript is off. (I'd guess the affected Adobe product is Flash)

Hmm, can you open an IFrame that is transparent, at a desired scroll-offset, and still receives clicks?

Then you could, for example, open an Amazon IFrame with the region at Amazon you know to be a one-click-order button exactly aligned over an attractive click-region in your exploit page.

If you can still detect the click before it goes to the IFrame, you could also simulate the click on your page so the 'teeing off' of the click to another site stays unnoticed.

Slashdot to the rescue:

http://it.slashdot.org/comments.pl?sid=976325&cid=251571...

My interpretation is that an attacker can make a user do something on a website, but precisely what, I don't know.

I've seen quite a few strange behaviors in all the browsers whilst hacking away at CSS.

Not inclined to attempt a duplicate exploit, but it may involve some combination of visibility: hidden; with older tags that breaks the expected behavior. Absolute positioning w/z-index could be involved as well. That might explain why Adobe was upset about it - you can do some pretty weird stuff with z-index and the flash player.

That doesn't nearly cover all the possibilities I can think of, and it's probably not the last CSS exploit we'll see.

Reply on news.ycombinator.com