ZDnet and other technical news sites have reported that clickjacking — a potentially serious threat — can affect any browser.
Clickjacking from the Layperson’s Perspective
In a nutshell, clickjacking is accomplished by a malicious page that hides behind a seemingly safe page. When you click an item on the supposedly safe page, your computer is clickjacked by malicious code which then hijacks your pc’s accessories or other components.This happens without your knowledge.
Generally, webcams are hijacked, but clickjacking is not limited to affecting a cam. Your microphone or sound system can be exploited, for example, or your computer can be taken over in other ways.
Adobe’s Flash Player was especially vulnerable to clickjacking, but Adobe has come out with a fix to address the issue.
Is This Only an Explorer or Firefox Problem?
Clickjacking is a cross-browser threat, meaning that the malicious code can affect Internet Explorer, Firefox, Chrome or any other Internet borwser. Merely disabling javascript will not fix it.
A “No Script” add-on that works with Firefox is the only known solution.
Problems with the Clickjacking Fix
After using No Script for a week or so, I disabled it because it made web surfing a chore. Every site I visited was blocked to some degree because of YouTube videos, javascript coding or ads installed on the page. For instance, the following were all blocked by No Script:
- Google Analytics
- Pepperjam network
- Peelaway Ads
- Voxant’s newsroom
- Chitika
- and many, many more (see the partial list of affiliate programs and other utilities blocked by No Script).
There’s a little bit of good news for Google publishers and advertisers. Adsense is automatically whitelisted by the No Script add-on. Most of the others will need to be approved manually. It is doubtful that the average Internet user will whitelist advertising networks.
If clickjacking is indeed a serious threat and script blocking solutions are the only way to fight back, then I can see online advertising taking a big hit. Adserver Plus, Doubleclick and other big ad networks were blocked by the No Script add-on.
Conclusion: Maybe the Threat is Overrated
My web browsing experience is back up to speed since I’ve disabled No Script and so far I haven’t been hit by any type of clickjacking activities. Perhaps the threat is more overrated than it actually is.
The NotGuru blog has posted some videos that show exactly how clickjacking works and how to install fixes.
Tags: browser hijack, clickjacking, malware, NoScript, Security