Self-XSS (Cross Site Scripting) ~ Social Engineering Attack and Prevention

Self-XSS (Cross Site Scripting) ~ Social Engineering Attack and Prevention

Last time , I have explained about the Clickjacking attack and prevention.  Today,  i am going to explain about the Self-XSS(Cross Site Scripting) Attack

What is Self-XSS?

Self-XSS is one of the popular Social Engineering Attack used by Attackers to trick users into paste the malicious code in browser.  Results in attacker accessing to the whatever website you visit. Usually scammers use this attack for tricking users to buy products or get money through online survey .

Recently, Hackers Attacked Facebook with explicit hardcore porn images. Facebook says it might be self-Xss Attack .

Javascript can be executed in browser url bar.
For example , enter the following code in your browser:

javascript:alert('kotharavichandra');

This will show a pop up box with "kotharavichandra".  An attacker can use this for malicious purpose. He can steal Confidential data, cookies, redirect to malware sites and more.
For Eg:
Entering the following code will display the cookies in your browser:

javascript:alert("Cookies:"+document.cookies+"  "+"\n By \n kotharavichandra");

The above code is not going to anything maliciously other than displaying the cookies.  But an attacker can extend the script so that it can take advantage your data.

Security Tips from kotharavichandra:

• Use NoScript add on that will prevent javascript running in your browser.
• Don't click the shorthand urls for Example: bit.ly/55ewEb?22.  This may redirect to an infected sites. 

Aware of Social Engineering:

• If anyone ask you(even if he is your friend) to paste the scripts in browser bar, Never do this mistake.  
• If anyone says "Iphone only $10", Don't eager to click it. 
• If anyone says "1000 shares will cure a baby", Never do this mistake. Facebook shares never help to get money or help to cure baby.
• Read our EHN spam report to know the latest updates about the facebook scams.

God give us the Sixth Sense,Use it and think before you click any links or following the other instructions.

Read More

What is Clickjacking Attack? How to Prevent? | UI Redressing

What is Clickjacking Attack? How to Prevent? | UI Redressing

Will answering simple maths quiz delete your Social Network account?  If your answer is "No", then check this news Linkedin Clickjacking Vulnerability and come back.  Will visiting a website turn on your webcam? The answer is "Yes".  Check this Flash player clickjacking vulnerability.

If you read above news completely, It will be easy for you to understand  what is clickjacking.  Ok, lets continue to our Article.

Clickjacking also known as UI Redressing,is one of Malicious Technique tricking users to click the button/image that will run hidden malicious script from another site.

An attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the the innocuous page. Thus an attacker hijack the click to another website.  That's why it is known as Clickjacking(Click+Hijacking).  The term "clickjacking" was coined by Jeremiah Grossman and Robert Hansen in 2008.

Example:

Lets take the real time example "Linkedin clickjacking vulnerability.

The above image may look like simple maths problem.  Once you click the submit button, it will delete your Linkedin account(if you are logged in) without asking any questions.

Clickjacking Attack can be used for:

• Tricking users to turn on their webcam and microphone using this adobe vulnerability (this security flaw fixed by adobe)
• Getting more Twitter Followers
• Post in your facebook wall.
• Can delete your profile.

Prevention Techniques:

Client Side(Security tips for users):

Flash Player:

Update your Flash Player(old version are vulnerable to Clickjacking). 

Browser Security Addons: 

Noscript:
Noscript is Mozilla add on that provides protection against clickjacking,XSS and other malicious scripts.  Noscript is available for mobiles also.

Comitari Web Protection Suite: Comitari provides client side protection against ClickJacking (aka UI Redressing) attacks. Installed as browser add-on

GuardedID: It is a commercial product which provides client-side clickjack protection for users of IE or Firefox without interfering with the operation of legitimate iFrames

Server Side( For Developers)

Frame Killer:

Framekiller is javascript snippet that can be used in webpage  to avoid inserting frames from different sources.  This can provide security against frame based clikjacking.

Read More