Where was the Hacker in the Room for X-FRAME-OPTIONs?

Update: don’t worry, they took care of it – but as of Feb 2012 only IE:  http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx

Or maybe where was the Dev in the room?

Imagine you’re sitting at a computer logged into your favorite website, lolcats, and you click on a shady link while logged in. There are a lot of attack scenarios that start this way.

Browsers have a cross domain policy that prevent the shady site from accessing any of your lolcats cookies, which typically contain your authentication tokens. But BY DESIGN, the shady site is certainly allowed to do requests (eg POST or GET) across domains. So there’s nothing to prevent the shady site from framing lolcats in an invisible iframe and having you play an animated whack-a-mole game, clicking exactly where the invisible lolcats site is having you inadvertently  rank the attacker’s disgusting kitten as cute. This is performed with your very own account, because the cookies are all legitimate from being logged in. This makes all your lolcats buddies laugh at your bad taste.

This is contrived, sure. But tools are getting a lot better to automate this sort of thing. You don’t need a whack-a-mole game to do clickjacking anymore, there are whole Javascript frameworks to automate everything. In fact, the attack is as easy as just getting them to visit the shady site, no clicks required. One such tool is:


Currently clickjacking defense is treated somewhat less importantly than XSRFf, but the fact is, the surface area for a clickjacking attack is basically identical to XSRF. Both are confused deputy problems.

One of the first ways to defend against this attack was frame busting scripts, which are snippets of Javascript and HTML to try to make it so websites can’t be invisibly framed. These are notoriously difficult, and can vary from application to application. To deal with this problem, Spencer Low went into a cave of solitude for some time and came up with a pretty good framebusting solution. Unfortunately, it turns out whatever frame busting solution you have is circumventable using IE’s XSS filter in IE8 or IE9. Details are


So there is only one defense that really works to defend against clickjacking, and this is X-FRAME-OPTIONs.  X-FRAME-OPTIONs is a newish header designed by Microsoft that’s now included in all modern browsers (chrome, Firefox, Safari, in addition to IE8 and IE9). What X-FRAME-OPTIONs does is set a header that says this response cannot be framed except under certain circumstances. There does need to be work on server applications to add this header, but I believe this is fundamentally the right approach to stop clickjacking. You don’t want lolcats framed by the shady site? Just configure lolcats to put the X-FRAME-OPTIONs header in the response and it cannot be framed.

Here’s the problem, X-FRAME-OPTIONs has three options: ALLOW, SAMEORIGIN, and DENY. That’s it. And they do exactly what you’d think they do.

What if, by design, I want my application to be framed by something in a different domain? There are a lot of legitimate circumstances this happens, and they pop up all the time in Online Services.

As a security industry, what we do right now in these situations is say there’s no good and easy defense. Web applications are sometimes vulnerable to clickjacking because the fact is there’s nothing good we can really do on these edge case scenarios. We can (and do) develop frame busting scripts that takes a lot of work, probably have holes, and are certainly bypassible in IE8 and IE9 due to the XSS protection unless we just explicitly switch off the XSS protection. It’s an active problem to determine if switching off XSS protection in order to hopefully develop a script that might with enough effort prevent clickjacking is worth it.

I wonder why when designing X-FRAME-OPTIONs it wasn’t just designed as a whitelist solution. Instead of only having the ALLOW, SAMEORIGIN, and DENY options, it could have a list of domains that are allowed to frame the content. It would make so much more sense to explicitly allow domains that are allowed to frame our application instead of being arbitrarily restricted to sameorigin. It would give us flexibility while at the same time allowing us to be safe.

I applaud the IE team for coming up with X-FRAME-OPTIONs in the first place, and for other browsers to adopt it. It can protect 95% of sites from clickjacking. I just wish that we didn’t have to have vulnerable sections of applications just because of the limitation of options.

madwifi == awesome

You know, with how much people tout the prism2 chipset, atheros sometimes gets looked over.




I mean, it’s got interfaces to act as vaps, to go in rfmon mode…  pretty cool.  I haven’t figured out how to reach the full potential of my prism2.5 card yet though, so I guess I’ll need more experimenting with both

gcc security tips

Here are some flags that may help vulnerable code from being executed.


This should get rid of some buffer overflows that can be analyzed statically and some obvious ones (strcpying input, format string vulnerabilities).

More information can be found here: http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html


From the man page:

Emit extra code to check for buffer overflows, such as stack smashing attacks.  This is done by adding a guard variable to functions with vulnerable objects.  This includes functions that call alloca, and functions with buffers larger than 8 bytes. The guards are initialized when a function is entered and then checked when the function exits.  If a guard check fails, an error message is printed and the program exits.

(this is enabled by default in recent versions of Ubuntu)

gnu readline – python

This is the very start of our cryptanal program frontend

#!/usr/bin/env python

import readline

"""The shell class is the front end for cryptanal"""

class shell:
  def __init__(self, filename=None):
WWW         WW eEeEeEeE LL        CCCCC    OOOO    MMMM    MMMM  eEeEeEeE
 WW         W  EE       LL       Cc      OOO  OOO  MM MM  M  MM  EE
  WW       WW  EeEeE    LL      CC       OO    OO  MM  MMM   MM  EeEeE
  WWw WW  WW   EE       LL       Cc      OOO  OOO  MM        MM  EE
   WWW  WWW    eEeEeEeE LlLlLlL   CCCCC    OOOO    MM        MM  eEeEeEeE

                             TO CRYPTO-SHELL
  (Useful for deciphering what little Susie is writing to little Billy)

    self.filename = filename
    self.crypto = None
    #if self.filename != None:
      #self.crypto = freqcount.subCryptAnal(self.filename)

    #setup the tab completion information here
    self.commands = ["help", "printfreq"]
    readline.parse_and_bind("tab: complete")

  #completer funtion for tab complete
  def completer(self, word, index):
    matches =
      return matches[index] + " "
    except IndexError:

  #this is the main event loop
  def mainloop(self):
    while 1:
      command=raw_input('> ').lstrip()
      if command.lower().startswith('help'):
        print "Error: command not recognized"

  def help(self, args):
    print "HELP"

if __name__ == '__main__':
  thisshell = shell()

Privilidge Separation in sshd

This was accepted into openssh sometime in 2002.  It helps make openssh exploits more difficult in terms of gaining root.

Do a ps -ef on your system where an underprivilidged user is logged in via ssh.  eg

# ps -ef |grep sshd |grep myuser
root       28694  7865  0 Mar25 ?        00:00:00 sshd: myuser [priv]
myuser     28703 28694  0 Mar25 ?        00:00:00 sshd: myuser@pts/2

While that [priv] may seem disconcerting, it (by itself) shouldn’t be.  There is privilege seperation in sshd  so that if an exploit is found in the child does not result in a system compromise.