ClickJarking – :
In internet world, clicking is inevitable as it has become the order of the day. In cyberspace every click counts, a click can lead you to safe site while some can expose you to exploitation zone where your details are hijacked and harvested.
Clickjacking is a user interface [UI] redress attack or a malicious technique of tricking a user into clicking on something different from what the user perceives or sees on the screen; thus potentially revealing confidential information or allowing others to take control of their phone or computer while clicking.
Many internet users have been tricked into clicking link / webpage element which is invisible or disguised as another element. This can cause users to unwittingly download malware, visit malicious web pages, provide credentials or sensitive information online against their wish.
Click-Jarking attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they intended to click on the top level page.
Using a similar technique, keystrokes can also be hijacked with a carefully crafted combination of stylesheets, iframes, and text boxes. Hence a user can be led to believe they are typing in the password to their email or bank account, but are instead typing into an invisible frame controlled by the attacker.
For instance, an attacker can build a web site that has a button on it that says “click here for a free gift”. However, on top of that web page, the attacker has loaded an iframe with your mail account, and lined up exactly the “delete all messages” button directly on top of the “free gift” button. The victim tries to click on the “free gift” button but instead actually clicked on the invisible “delete all messages” button. In essence, the attacker has “hijacked” the user’s click, hence the name “Clickjacking”.
Clickjacking can also make you to propagate malicious page / link if it is masqueraded as FREE GIFT button.
Check well before you click and stay safe while you surf.
Thanks
Engr. Chikwado F. Okeke
Cybersecurity Professional
https://possibond.com.
+234(0)8127944123