The Security Practice

New Research and Progress Against Clickjacking at the W3C

The Web Application Security Working Group at the W3C is nearing one year since its charter was approved. In that time, it’s made some quite important progress. Content Security Policy (CSP) 1.0 is fast approaching Working Group Last Call, version 1.1 is under draft, and Cross-Origin Resource Sharing (CORS) has completed Working Group Last Call with a new security considerations section. Congratulations and thanks to the editors Anne van Kesteren, Adam Barth and Brandon Sterne.

The other threat this WG was chartered to address was clickjacking. Since its flashy debut five years ago, clickjacking and other variants on user interface redressing attacks have remained a quiet thorn in the side of web application authors and security teams. With X-Frame-Options as the only commonly implemented solution to emerge in that time, vulnerable applications are left with the unappealing choice of accepting the risk of clickjacking or opting-out of in-context display altogether. With the increasing popularity of in-context mashups for applications like social networking, shopping and payments, the risks to users and the potential profits for attackers are quite real.

This is why I’m so pleased that at the WebAppSec WG’s second face to face meeting on May 2-3, a real start was made towards effective risk mitigation for many forms of clickjacking. At the end of a session devoted to clickjacking, the WG agreed to proceed towards standardizing a combination of client-side detection heuristics, informed by application-supplied policy hints, with a reporting loop that can feed into server-side anti-fraud systems. Web security pioneer Giorgio Maone, author of NoScript, has generously volunteered to edit the new specification and contribute the techniques he developed with ClearClick. David Lin-Shung Huang will co-edit, bringing his own insights and refinements from research into anti-clickjacking technology at Carnegie-Mellon University Silicon Valley and Microsoft Research.

I’m also happy that some of the research we’ve been doing here at PayPal on anti-fraud analytics and clickjacking will be contributed to the standard, to help close the loop between user agent detection and application response and remove the need for yet another browser security dialog box. You can read more about that work for the first time here:

Adaptive User Interface Randomization as an Anti-Clickjacking Strategy

If you’re interested in helping to fix clickjacking, please follow the WG's progress at [email protected].

- Brad Hill

 

 

Raising the Bar with the Domain Policy Framework

PayPal is pleased to be invited by Artemis Internet Inc. to participate in the Domain Policy Working Group.  PayPal has long been a leader in multi-stakeholder efforts to tackle the problems of crime, fraud and phishing on the Internet.  We have identifed the need for and advocated uniform security policy frameworks to address Web security (Web Security Framework: Problems and Requirements), are early adopters of DNSSEC for secure domain names, and helped develop standards like Domain-based Message Authentication, Reporting & Conformance (DMARC) for email authentication and HTTP Strict Transport Security (HSTS) for secure web site communications.  As such, we support the opportunities presented by the Domain Policy Framework (DPF) for broader adoption of these and other security technologies.

The DPF offers an opportunity to take an important step towards meeting users’ expectations of a safe Internet experience.  Users often have difficulty interpreting technical security indicators (such as the "HTTPS lock icon") and even the technically savvy have no easy way to distinguish between a “secure” site (using HTTPS) and a “safe” one that will not victimize its users.  We are encouraged by the effort to create user-recognizable spaces on the Internet where uniform and modern best practices for security and safety will be enforced.  We also look forward to a time when domain registrants will be held to high standards for truthful and accurate self-identification, trustworthy operation, and protection of users.  As the viability and benefits of such an approach are demonstrated in parts of the new gTLD space, we hope this work will help accelerate efforts to enable a safer Internet everywhere, for all users.

 - Brad Hill