SN 1040 Clickjacking and the Pop-in-Front problem

[Jamie Cox]

The discussion of clickjacking in SN 1040 reminds me of a similar long-standing problem in Windows & MacOS, and probably Linux. I call it the pop-in-front problem. Because we have mulit-tasking operating systems, and a complex windowed environment with pop-up dialog boxes, it is always possible for a dialog box from the system or another application to pop up in front of a completely different UI element just as the user is clicking on it. This can result in unintended actions of variable severity. I have had this happen to me, but I've never heard of this being abused or being a security threat, but I believe it could happen.

This problem becomes a race condition between the user's intent to click on one thing, and another thing popping up in front of that a millisecond or two before the click. You could imagine the user intending to click a boring check box on a spreadsheet and instead clicking OK on a dialog box asking "Allow DangerApp Full Hard Drive Access?". To make it worse, the dialog will probably disappear the moment it is clicked. The user would have no idea what just happened.

 

[SeanBZA]

Thing with most unixes is that there is no passwordless elevation with a single click, all will ask for the password for either root, or current user if using Sudo, which gives you a screen with the elevation prompt, and which program is calling for elevated permission. Unlike windows which will allow this without prompt if the currently logged in user is an administrator already, which most users by default are.

 

[Jamie Cox]

I use the password manager Bitwarden. They made a UI change a while back that seemed weird and random to me. In the Browser plug-in, you used to be able to click anywhere in a medium sized rectangle to auto-fill the credentials for the current site or for credit cards. Now there is a tiny button marked "Fill" that you must click to accomplish the same thing. After listening to SN 1040, and thinking about it, I think what Bitwarden was doing was literally reducing the attack surface for clickjacking. An attacker must now get the user to click on a much smaller, more specific spot for the attack to succeed. It's not iron clad, but it's mitigation of a sort.