IE8’s Clickjacking Fix Not Much Help, Experts Say
Microsoft
NoScript lets users selectively block the use of scripting languages within the Firefox browser. Because clickjacking requires scripting, the attack doesn’t work when NoScript is enabled.
For months, Maone’s plug-in has been the best-known technology for thwarting clickjacking. With the IE 8 test code, however, Microsoft finally has its own alternative.
To help the situation, Maone is developing a compatibility feature so that NoScript users will be able to take advantage of the same Web code used by IE, and he is now lobbying to have this feature included in an upcoming version of Firefox.
Hansen and Maone also criticized Microsoft for holding off on technical details of the technology. “Even though they implemented that, they haven’t given guidance on how to actually use it,” Hansen said.
In an e-mailed statement, Microsoft said that it planned to put up a blog post on the anti-clickjacking feature sometime this week and that it had worked with all major browser vendors “to get feedback and input on our implementation of the clickjacking tag before shipping Internet Explorer 8 RC1.”
That post might be helpful. As things stand now, it looks like “the feature doesn’t allow the user to protect themselves,” said Jeremiah Grossman, chief technology officer with White Hat Security.
Hansen said that Microsoft developers first proposed their IE8 clickjacking fix several months ago when he first described the problem to them. “I dismissed it as not a long-term, viable solution to clickjacking,” he said.
Leave a Reply