Mozilla is doing its part in the battle against clickjacking. The open-source company is offering an updated plug-in for the Firefox browser that blocks what security researchers call one of the most dangerous problems on the Web.
Clickjacking occurs when a person browsing a Web site clicks on an invisible link that leads them to a malicious site without their knowledge. Some never realize it even happened. A design feature in HTML that lets Web sites embed content from other sites makes it possible, which means nearly everybody is vulnerable.
The Firefox add-on, NoScript, is a well-known security plug-in. It is used to block all sorts of content types within Web pages. It is not a security scanner in the sense that it does not scan content with any form of signature database to look for specific known threats. Rather, it is a tool that enables you to block certain types of content. An update to NoScript includes a feature dubbed ClearClick to combat clickjacking.
Combating Clickjacking
According to Fraser Howard, principal malware researcher at SophosLabs, the new feature in NoScript is specifically designed to combat the user-interface redress attacks known as clickjacking and should help. However, there is a potential downside.
“Enabling the feature will result in some degree of false positives,” Howard warned. “This is not a criticism of the product; more a reminder that given the widespread legitimate use of similar techniques, some false positives are inevitable.”
Of course, the NoScript add-on alone isn’t enough to solve the problem. That’s because it only covers Firefox. The other 70 percent of the browser market is still open to clickjacking.
“User discretion is still an important factor in the defense against these attacks, just like any other,” Howard said. “The usual common-sense guidelines apply to this, just like other forms of malicious Web attack.”
More Fixes…