How can I stop clickjacking attacks?
One of the people at my office apparently clicked a "Like" button on a website, and next thing I know, our customers on Facebook are complaining about the porn link we "liked" after they followed our apparent recommendation. Welcome to the clickjacking party. Is there a way to prevent clickjacking from happening, short of barring people from going online at work?
Answers
Hi SilverHawk,
See this article about clickjacking, it includes a section on "likejacking" that you might find helpful.
Clickjacking
http://en.wikipedia.org/wiki/Clickjacking
"Likejacking, is a malicious technique of tricking users of a website into posting a Facebook status update for a site they did not intentionally mean to "like".[10] The term "likejacking" came from a comment posted by Corey Ballou[11] in the article How to "Like" Anything on the Web (Safely), which is one of the first documented postings explaining the possibility of malicious activity regarding Facebook's "like" button.[12]
According to an article in IEEE Spectrum, a solution to likejacking was developed at one of Facebook's hackathons.[13] A "Like" bookmarklet is available that avoids the possibility of likejacking present in the Facebook Like Button.[14]"
- Share this answer
- Permalink
Related Questions
The news wires have been reporting the largest DDoS attack in history is taking place today against a company called Spamhaus. I haven't...
Is Palo Alto the only true NGFW? SonicWall? Juniper SRX? Do you think that Gartner's definition of a NGFW is correct? Does anyone know...
I've been in IT for awhile, and am considering a shift to focus more on security and related technologies, policies, etc. What kinds of...
Are there reputable security applications out there for BlackBerry, Android, and iPhone that will protect my business emails, chats, and...
Yes, it's true that everyone should know better, and should be backing up data to an off-site facility on a regular basis. But, in...
There are a couple of things that you can do that are really easy and will greatly decrease the risk while people are browsing. I install the NoScript plug-in on all the browsers at my office. We currently use Firefox, but I'm sure there is either a version of it for Chrome or a similar plug-in. The most effective thing that you can do, in my opinion, is disable Flash. If that generates too many complaints, at least make certain the most current version of Flash is installed and change the global security settings to "always deny" or at least "always ask". There is also a setting in there to deny access to your machine's cam and mic.