Nov. 23, 2009

Posted by in Facebook | 3 comments

Facebook Worm Uses Clickjacking in the Wild

Reports have been spreading today of a new Facebook worm that posts a link to the infection page on people’s profiles. The infection page itself includes a button that users are told to click, with the promise of seeing “something hot” or dominating FarmVille. Nick FitzGerald at AVG posted a walkthrough of the worm (warning: slightly NSFW image), and when explaining how the worm operated, gave an explanation similar to that of other articles I saw:

A sequence of iframes on the exploit page call a sequence of other pages and scripts, eventually resulting in a form submission to Facebook “as if” the victim had submitted a URL for a wall post and clicked on the “Share” button to confirm the post.

With all due respect to FitzGerald and others, I was suspicious. First, I know from experience what sort of CSRF protections Facebook has put in place. Second, if this were truly just CSRF, why not execute the attack on loading the page instead of requiring a second click?

I do know of one relative of CSRF attacks (some classify it as simply CSRF, but I do see a distinction) that requires another click, and that’s clickjacking. I decided to check out an infection page to see exactly what was going on.

Sure enough, both the “hot” and “dominate FarmVille” pages load in invisible iframe, which calls for another local page, which in turn loads another invisible iframe. The actual source of the second local page looks like this (URI edited):

<html><head></head><body><div style=”overflow: hidden; width: 56px; height: 24px; position: relative;” id=”div”>
<iframe name=”iframe” src=”http://EVILURI/index.php?n=632″ style=”border: 0pt none ; left: -985px; top: -393px; position: absolute; width: 1618px; height: 978px;” scrolling=”no”></iframe></div></body></html>

The address that the iframe loads simply redirects to a Facebook share page with the infection page specified as the share link. Note that the style attribute on the iframe includes negative values for “left” and “top” – this ensures that when the page loads, the “Share” button for the Facebook page is at the top-left corner of the iframe, and thus positioned right underneath the button users think they are clicking.

It’s perhaps worth noting that the possibility of such a worm has been pointed out before, including on this blog:

All of the following actions can be mistakenly performed by a user simply clicking a link or button on an innocent-looking page via clickjacking:

…

Post a link to your profile. This is possible by applying clickjacking to several Facebook pages used for sharing content. A custom title and description can be set for the link. Other content, such as a Flash video, can also be posted this way.

I also encouraged Facebook in my Month of Facebook Bugs Report to take clickjacking seriously. The behavior of this worm is only the beginning – as I’ve pointed out for months, a similar attack could authorize a Facebook application (malicious or hijacked) and steal user information while spreading links even more virally. This new worm may be one of the first examples of clickjacking used in the wild, but it certainly won’t be the last.

3 Comments

  1. reda says:
    November 24, 2009 at 8:35 am

    This can be used to attck client and get zombies

  2. Joff73 says:
    November 27, 2009 at 6:49 pm

    In fact, really good website ^^ I came here because i’ve read a book who quote your site, and i’m not disappointed at all :)
    Your explanations of Facebook Applications are interesting but could you add an exemple at it to understand it better.
    Except that, continue =)

  3. forex signals says:
    June 30, 2011 at 7:10 pm

    great post,love the way that is written,in touch and very detaild.

Trackbacks/Pingbacks

  1. Tweets that mention Facebook Worm Uses Clickjacking in the Wild | Social Hacking -- Topsy.com - [...] This post was mentioned on Twitter by theharmonyguy, Kris Drent. Kris Drent said: RT @theharmonyguy: New Post - Please ...
  2. uberVU - social comments - Social comments and analytics for this post... This post was mentioned on Twitter by theharmonyguy: New Post - Please RT: Facebook ...
  3. Roy Firestein » The Web won’t be safe, let alone secure, unless we break it - [...] direction. We’ve seen outbreaks of Twitter worms, XSS Defacements of government websites, Facebook Clickjacking attacks, sites that disclose which ...
  4. Der Angriff der Clickjacking-Würmer, "Likejacking" und "Buttonjacking" - Dipl.-Inform. Carsten Eilers - [...] Einen Teils des Quelltexts des "Wurms" und eine Beschreibung seiner Funktion hat 'theharmonyguy' veröffentlicht. [...]

Leave a Reply