What is clickjacking?

Clickjacking is a type of online attack that involves tricking a user into clicking on a button or link that performs an action that the user did not intend to perform. Clickjacking can be used to steal sensitive information, install malware on a user’s device, or perform other types of malicious activity.

The basic concept behind clickjacking is relatively simple. An attacker creates a webpage that contains an element, such as a button or a link, that is overlaid with another element, such as an image or a video. The user sees the visible element and clicks on it, but the invisible element beneath it is the one that actually receives the user’s click.

For example, an attacker might create a fake “Like” button on a webpage. When the user clicks on the button, the button performs an action that the user did not intend, such as sharing the webpage on their social media profile.

There are many ways that attackers can create clickjacking attacks. Some of the most common techniques include:

Using iframes:

Iframes are HTML elements that allow one webpage to be embedded within another webpage. An attacker can create an iframe that contains a button or link, and then position the iframe so that it is overlaid with another element on the page.

Using CSS:

CSS (Cascading Style Sheets) is a language used to define the layout and appearance of webpages. An attacker can use CSS to position an element on top of another element on the page, creating the appearance of a single button or link.

Using JavaScript:

JavaScript is a programming language used to create interactive webpages. An attacker can use JavaScript to manipulate the behaviour of a button or link, making it perform an action that the user did not intend.

Clickjacking attacks can be difficult for users to detect, as the visible element on the webpage appears to be legitimate. However, there are a few warning signs that users can look out for:

Unexpected behaviour:

If a button or link performs an unexpected action, such as sharing a webpage on social media without the user’s consent, it may be a clickjacking attack.

Missing functionality:

If a button or link appears to be missing some of its usual functionality, such as the ability to open in a new tab or window, it may be a sign of clickjacking.

Strange layout:

If a button or link appears to be positioned strangely on the page, or if it appears to be partially obscured by another element, it may be a sign of clickjacking.

To protect against clickjacking attacks, users can take a few simple steps:

Keep software up to date:

Clickjacking attacks often rely on vulnerabilities in web browsers or other software. Keeping software up to date can help to prevent these types of attacks.

Use browser extensions:

There are several browser extensions available that can help to prevent clickjacking attacks, such as NoScript and Clickjacking Defence.

Be cautious online:

If something seems too good to be true, or if a button or link appears to be behaving strangely, it’s best to err on the side of caution and avoid clicking on it.

In conclusion, clickjacking is a type of online attack that involves tricking a user into clicking on a button or link that performs an unintended action. Clickjacking attacks can be difficult to detect, but users can protect themselves by keeping software up to date, using browser extensions, and being cautious online.

UK Cyber Security Group Ltd is here to help

Please check out our Cyber Essentials Checklist

Please check out our Free Cyber Insurance

If you would like to know more, do get in touch as we are happy to answer any questions. Looking to improve your cybersecurity but not sure where to start? Begin by getting certified in Cyber Essentials, the UK government’s scheme that covers all the technical controls that will provide the protection that you need to help guard against criminal attacks. Or just get in touch by clicking contact us