Talks and Poster Presentations (with Proceedings-Entry):
M. Balduzzi, M. Egele, D. Balzarotti, E. Kirda, C. Krügel:
"A Solution for the Automated Detection of Clickjacking Attacks";
Talk: ACM Symposium on Information computer and Communication Security (AsiaCCS),
- 2010-04-16; in: "Proceedings of the 5th ACM Symposium on Information computer and Communication Security",
Clickjacking is a web-based attack that has recently received
a wide media coverage. In a clickjacking attack, a malicious
page is constructed such that it tricks victims into clicking
on an element of a diﬀerent page that is only barely (or not
at all) visible. By stealing the victim´s clicks, an attacker
could force the user to perform an unintended action that is
advantageous for the attacker (e.g., initiate an online money
transaction). Although clickjacking has been the subject
of many discussions and alarming reports, it is currently
unclear to what extent clickjacking is being used by attackers
in the wild, and how signiﬁcant the attack is for the security
of Internet users.
In this paper, we propose a novel solution for the auto-
mated and eﬃcient detection of clickjacking attacks. We
describe the system that we designed, implemented and de-
ployed to analyze over a million unique web pages. The
experiments show that our approach is feasible in practice.
Also, the empirical study that we conducted on a large num-
ber of popular websites suggests that clickjacking has not yet
been largely adopted by attackers on the Internet.
"Official" electronic version of the publication (accessed through its Digital Object Identifier - DOI)
Electronic version of the publication:
Project Head Paolo Milani Comparetti:
Worldwide Observatory of Malicious Behaviors and Attack Threats
Project Head Christian Platzer:
SECoverer - Finding Security Vulnerabilities in Web Applications
Created from the Publication Database of the Vienna University of Technology.