bugtraq - Re: Advisory: Google Chrome 1.0.154.43 ClickJacking Vulnerability.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <448e9a320901281540o3eef40cbo51ac4ae54ccadbcf@mail.gmail.com>
Date: Thu, 29 Jan 2009 00:40:40 +0100
From: Michal Zalewski <lcamtuf@...edump.cx>
To: Aditya K Sood <adi_ks@...niche.org>
Cc: bugtraq@...urityfocus.com, submissions@...ketstormsecurity.org,
	vuln@...unia.com, submit@...uriteam.com
Subject: Re: Advisory: Google Chrome 1.0.154.43 ClickJacking Vulnerability.

Hello Aditya,

> http://www.secniche.org/gcr_clkj

1) It is by now well-understood that because of the inherent and
broadly depended on properties of HTML, every sufficiently featured
browser is and likely will remain susceptible to the behavior known as
clickjacking. A more thorough analysis, also covering Chrome, is
provided here:

http://code.google.com/p/browsersec/wiki/Part2#Arbitrary_page_mashups_(UI_redressing)

2) To my best knowledge, the proof of concept provided in your post,
where a same-origin <div> follows a mouse pointer, is not a valid
demonstration of the issue at hand.

Regards,
/mz