1. Mffdau

(1)

JOURNAL OF SCIENCE OF HNUE DOI: 10.18173/2354-1059 2017-0009 Natural Sci. 2017, Vol. 62, No. 3, pp 69-75

This paper is available online al http //stdb.hnue.edu.vn

D E X U A T M Q T S O B I E N P H A P P H O N G C H O N G PHUOfNG T H U C TAN C O N G C L I C K J A C K I N G

N g u y e n D a n g T i e n

Truang Dai hpc KI thugt Hgu cdn Cdng an Nhdn ddn. Bd Cdng an

Tom tat. Trong bai bao nay, chiing toi de xuat mot so bien phap phong chong phuong thdc liia dao true tuyen (phishing) rat pho bien, do la phuang Ihiic t3n cong Clickjacking. Day la dang tan cong ma khi sii dung trinh duyet de Iruy c^p cac iing dung, nan nhan bj lira truy cSp va thao tac tren cac trang web gia mao do hacker tao ra. Nhihig trang web nay thudng dugc mip dudi vd bpc ciia mot trang web an loan. Tin cong Clickjacking khong yeu ciu kT thuat cao nhung hieu qua thu duoc cd the rat Idn, Hau qua gay ra nhe la sit phien toai doi vol ngudi dling, nang hem la bj mat cap thdng tin cac loai tai khoan hay cac dii lieu nhay cam. Chung toi cung dua ra mpt so phuang phap phong ngira tu phia may chu Web va tur phia ngirdi diing de ngan chan dang tan cong nay mpt each hieu qua.

Tir khda: Tan cong Clickjacking, the iframe, thiet lap z-index, hacker, dich vu m^ing.

1. Mffdau

Clickjacking dugc Robert Hansen (ngudi sang lap va dieu hanh hang SecTheory) va Jeremiah Grossman (Haker mu 0-ang) phat hien va cdng bd vao nam 2008. Nam 2010, tai hdi thao Black Hal Europe dien ra lai Barcelona, chuyen gia bao mat ngudi Anh - Paul Stone ciing da trinh dien them cac kl thugt khai thac mdi eua dang tin cdng nay [I].

Clickjacking (hay UI Redress Attack) la mdt dang iSn edng lira dao tren irng dung web.

Thugt ngii Clickjacking mo la vipc hacker dg ngudi dung click vao cac lien ket dpe hai, nguy hiem, dugc an minh dudi ve ngoai la mdt trang web an loan. Viec click vao cac lien kel dd cd the don gian la bi dieu hudng sang cac trang web khac, lang view cho mdt quang cao giup kiem tien cho hackff, hay nang han la bi danh cap cac thdng lin bi mat. nhay cam va chiem quyen dieu khien may linh. Dieu dang ngai la hinh thuc lira dao nay xual hi?n nhieu tren web den miic ngudi ta xem dd la mpt phin hien nhien khi iruy cap Internet. Cac thiet hai diudng xiy ra ddi vdi cac ca nhan sii dung intemet han la nha cung cap dich vu hogc doanh nghiep nen phuang thirc tan cong nay it dugc truyen thdng chu y so vdi eac dang lan cdng khac nhu SQL injection, DoS hay DDoS....

Mdt sd gjai phap phdng chong Cliclgacking da dugc nghien cuu trudc day. Trong [2], lac gia de xual mgt phuang phap trong do tai thdi diem ban dau, hanh ddng truy cap vao limg dudng din ciia trang web dugc md phdng. Sau dd he thdng se phan tich md phdng nay va dua ra ldi eanh bao doi vdi ngudi dimg ring cd kha nang day la trang web lin cdng Clickjacking hay khdng. Guvstav va cpng su [3]

da trinh bay phuang phap trong do su dyng Id thuat frame-busting va ap dung cho mpt so trang wdi.

Ngaynhan bai: 19/2/2017, Ngay nhan dang- 20/3/2017.

Tac gia lien he: Nguyen Dang Tien, email: [email protected]

(2)

Nguyen Dang Tien

Trong [4-6], cac tac gia tap trung vao phan tich cac chien thuat hacker su dung trong phuong phap Clickjacking va each phdng cac Id thuat phdng chdng loai tan cdng nay. Nhara nang eao nhan thiic ciia ngudi sir dung intemet ve Clickjacking, trong bai bao nay toi trinh bay mdt sd nghien cuu ve cac kt thuat tan cdng, mdi nguy hiem ciia phuang thuc nay va cudi ciing la mdt sd hudng dan each thiic phdng chdng.

2. Noi dung nghien cuu

2.1. Phirong phap tan cong Clickjacking va each phdng trong 2.1.1. Kich ban tan cong Clickjacking

6 phan nay, tdi md ta kjch ban ciia mdt cudc lan edng Clickjacking dan gian Qua trinh cd the dugc thuc hien nhu sau:

Hacker du ngudi diing tray cgp vao mot trang web da dugc tao sin, trang web nay cd the la mpt lin thdng bao nhan tbudng vdi cae tai san hap dan, hay cae trang cd ndi dung nhgy cam thu hiit ngudi xem.. Chiing thudng cd dang nhu sau.

Chiic murng hiin da 1» iiginri tliir 101).110(1 iru> vap ngii) hiim iiiiy!

( lick \i\o NH.VN THiaNG tk^ iihAn ngin 1^ mot cliitc iPliom- 7

Hinh 1. Trang triing thudng nhdm thu hut ngudi dUng

Tmy cap web de ining ihudng mdt chiec iPhone'' Phan thudng nay du hap dan de khien ngudi dung de dang nhin chupt vao ndt "NHAN THLTCJNG" ma khong biet rang dang bi dua vao nguy hiem.

Thu hien ra sau oi click chupt se la;

^ ^ ^ ^ Transfer to Bank

Giao dich thuc hien thanh cong!!!

Ban da chuyen 500.000 t'SD cho .\nonynious Hinh 2. Giao dich chuyen khodn dd dugc thuc Men

(3)

Dexudl mpi so bien phdp phdng chong phucmg thdc ldn cdng Clickjacking Chuyen gi r^a xay ra? Ngudi dung dang tuang tac vdi trang web thdng bao Ining Ihudng, click vao niil " N H A N THU'CJNG" chu khdng su dung gi den dich vu ngan hang, vay thdng bao chuydn khoan thanh cdng d dSu? Tai sao sd du trong lai khoan da biln mit 500 USD?

Xem xel ki ban mgt chut, d day ro rang ngudi diing dang tuong tac vdi dich vu Internet Banking cua ngan hang, vdi mdt niit "CHUYEN ICHOAN" nim d tren dd. Nhung thir hign Ihi len den man hinli may tinh ciia ngn nhan lai la mot trang web khdng lien quan gl ddn npi dung. Khi ngudi dimg click vao niit "NHAN T H U Q N G " dugc hien thi U-en man hinh thi thuc su hacker da didu hudng click vao nut "CHUYEN KHOAN", do dd giao dich chuyen tiSn dugc thuc hien, liin trong tai khoan bi mit.

Kt diual nay cd the Ihuc hien dugc la do mdt sd tinh chit ciia ngdn ngd H>^erText Markup Language (HTML) da bi lgi dung. Ngon ngij HTML cung cip the iframe cd chuc nang hi8n thi ndi dung ciia cae trang web khae tren Orang web hien tai. Mdi phin tu ciia mpt trang web (HTML Element) cd ba che dd dd la hien thi, lam md va bj an. Neu cac HTML Element chong len nhau thi thu tu eiia nd dugc quyet dinh bdi mpt tham sd gpi la z-index.

Nhu vay d irong trudng hgp nay, trang giao dich ngan hang da dugc dung the iframe dl tai vd va chgy tren trang web cua hacker, ddng thdi dugc thi£l lap z-index Ak dgt trudc lit ca cac dianh phin khac nhung lai tdn tgi d ugng thai an. Mdt trang web thdng bao Ining thuong dugc cho hien thi tren man hinh nhung hoan loan khdng cd y nghta, vi ui cua niit "NHAN THU'CJNG" chinh la vj tri cua niit

"CHUYEN KHOAN" da dugc an di. Chiing ta cd die liinh dung trang web nhu sau:

Hmh 3. Mo td cdch md trang web duoc Men thj va trang bj an di Ddi vdi ngudi diing. khi hg nhan mil "NHAN THUONG" ciing la liic tien dugc chuyen di. Nhu vgy, cac giao dich nhay cam lien quan den dich vu ngan liang dugc an ngay Uudc mat ngudi diing nhung hg khdng he hay biet. va hau qua gay ra cd the la rat ldn.

2.1.2. Mot so kl thuat tan cong Clickjacking

Clickjacking la mgt dang lin cdng kieu lira dao, do dd nd khdng yeu cau qua cao ve mat ki thuai.

ma chii yeu khai thac d yeu td eon ngudi. Thuc le ehi' ra rang ddi vdi mpi ca che bao mat, yeu td eon ngu'di la quan trgng nhit va ciing de bi khai thac nhat Viec tan edng dd tim tai khoan, doan mat khau doi vdi hacker khd han nhieu so vdi viee lgi dyng su sa y ciia ngudi diing de chiem doat thdng lin.

Clickjacking cd the dugc sir dung vdi nhieu Id thuat da dang, tu don gan den nang cao. Trong phSn liep theo, tdi se de cgp den mpt sd id thuat dac trung nhat cua Clickjacking

* Tuang tdc vdi frame dn

KI thuat nay dugc trinh bay d vi du trea lgi dung cac tinh nang duge eung cap cua ngdn ngii HTML va Cascading Style Sheets (CSS) do la the iframe va chi sd z-index. Trong HTML, the iframe dugc dung de lai va chay cac trang web khac tren trang hien tai. Mdt the iframe cd the dugc khai bao nhu sau:

<body> 1

</iframe>

</body>

(4)

Nguyen Ding Tien

Trong dd, src="../transfer.html"la dia chi trang web mudn tai ve. Hacker se lao mdi iframe tai noi dung ciia cac trang nhay cam nhu giao dich ngan hang, kiiai bao thdng tin tai khoan... ve trang cua minh, viec tai qua iframe nay vln eung cip day du chuc nang binh thudng nhu khi ta tray cap vao chinh trang web dd,

Hinh 4. Website ciia ngan hdng BIDVdugc tdi ve vd chgy binh thudng sif dgng the iframe tgi thdi diem bdi bdo

Doan code giup lai ndi dung ve cd the dugc viet don gian nhu sau:

<head>

< t i t l e > C h u c miing ban dS t r i i n g i P h o n e < / t i t l e >

</head>

<body>

height="100%" id="bank" frameborder="0" s c r o l l i n g = " y e s " >

< / i f r a m e >

</body>

O vi du tren. trang giao dich eiia ngan hang BIDV dugc tai ve tren trang web ciia hacker bang the iframe, kk hgp cau hlnh Ihem mpt vai tham sd nliu width="100%"heighl="100%"frameborder="0", trang giao dich nay da ed the hien thi va hoat ddng binh Ihudng nhu khi truy cap vao dja chi chinh chii.

Tuy nhien, dieu nguy hiem la hacker khdng de ngudi diing thiy dugc trang nay, ma an giiu no bing thidt lap z-index. Trong CSS. z-index la diam sd thilt lap thu tu x£p chdng len nhau ciia cac thanh phan HTML, mSc dinh la 0 va thanh phin nao cd z-index Ign hem se uu tien xep cao han, nghia la du-gc uu lien hiSn thi han. 6 day, hacker thiet l|p z-index=-l, do do thanh phin nguy hi6m nay sS dugc an minh sau cac HTML Element khac, ngay trudc mat nhung ngudi diing khdng nhan ra. Khi do, hg vd linh thao tac tren mdt trang web nguy hiem ma kliong he hay biet.

* Stra doi vi tri con trd chupt

Day la Id Ihual sir dung cac linh nang ciia Javascript, hacker khdng can thiel phai du nguoi diing click vao mdt diem nao dd tren man hinh niia, ma chung cd the kiem soat dugc vj tri ciia con trd chu^l.

Ddng thai, kk hgp vdi viec thay doi vi tri cua cac ddi tugng tren trang web, khi ngudi diing click chu$t vaobatkydiemnaothivi tri dd deu dang chira nhiing lien kdl dpc hai.

72

(5)

Dexudt mdt sd bi^n phdp phong chong phuang thuc ldn cong Clickjacking

* Mgt so kl thugt tan cdng Clickjacking nang cao

Dua vao y tudng chii dao tren, hacker cd the phat trien them nhthig kJ thu^t phuc lap hon, giup an minh idt han, tang kha nang thanh cdng va lugng thdng lin thu thap dugc. Cac kT thuat tan cdng nang cao cd the sii dung den gdm cd:

- Su dyng cac dogn ma Java va Javascript, hacker khdng nJiiing kiem soat dugc thao tac click chudi, ma cdn cd the thuc hien keo-tha cac ddi tugng nhu djch chuyen mpt dogn text vao form dir heu hay chuyen ra khoi iframe. Qua dd. hacker ed the Ihu duge eac thdng lin nhay cam nhu tai khoan ngan hang, mat khau dang nhap.

- Hacker cd the lgi dung Id hdng cross site scripting cua cac web site bing each chen vao URL cua cac web site nay mdt script dieu hudng

http://myidol.com. vn/home/searchphp?q=%3Cseript+type%3Dtext%2Fjavascript+srcVo3D%22h ttp%3A%2F%2F]92.168.0.207%3A3000%2Fhook.js%22%3E%3C%2Fscnpl%3E.

Khi ngudi dung click vao link chira URL tren. ngudi dung se bi dieu hudng ldi web site chiia mpt doan ma dpc Java script (nhu URL tren thi dogn ma ddc la Hook:js). Sau dd, doan ma dde nay se dugc tiem nhiem vao trinh duyet cua ngudi diing va Hacker hoan loan cd the kiem soat hay dieu khien trinh duyet Khi do. Hacker tao ra nhiing thdng bao gia mao nhu update flash va chen tiep ma ddc reverse shell gia mgo phin mem flash, khi ngudi diing eai dat phan mem nay thi Hacker se chiem loan quyen sd huu may cua ngudi dung. Hay Hacker cd the tiiy y tao ra nhiing Plugin gia mao khac de du ngudi dung click vao va lay cap thdng tin ngudi dimg nhu cac tai khoan quan trgng

- Thidt kl mpt iframe an theo ddi sy di chuyen hay dieu kluen vi tri ciia con trd chupt, ddng thdi kiSm soat thdi dilm click chupt. Didu nay cd tJie thyc hien dugc bdi cac linh nang trong Javascnpt. Tir dd, hacker cd thd "chilm doat" cac su kien click chupt ma khdng can quan tam nd dang a vi m' nao, hogc tao ra mdt cudc tan cong multi-click lien tuc, duac hoan thanh sau mdt sd lan click chupt. Ket thiic cugc tin cdng, hacker se tra lgi quyen Idem soat con ird. Cl day, ngudi diing chi thay mpt sd diao lac la so vdi binh thudng nhung khd cd the nhan ra minh dang bi tin cdng nhu the nao.

- Su dung cac lo hdng trong cac phin mem tiem an nhieu nii ro nhu Adobe Flash. ActiveX hay Microsoft s'ilverLighl. Google cung da ghi nhan sy xuit hipn cua dang tin cdng Clickjacking tren hp dieu hanh Android cua hg.

* Mgt sd biin phdp phong chong tan cdng Clickjacking

Tin cdng Clickjacking la mdt dang tin cdng lira dao, hau qua gay ra cho ngudi dung ca nhan la kha da dang. Ban diu, ki thuat nay dugc su dung dl nhim I6i keo ngudi diing den caclrang quang eao hay eac bai viet nhay cam. Cac he thong quang cao cua Google, Mierosoit ... tinh sd lin click chupt vao banner de linh ra so lien phai tra. Su dung Clickjacking, hacker cd the dieu hudng ngudi dung den eac trang quang cao, "chilm doat" nhirng cu click chupt cua hp va lien se dugc dua ve lat khoan cua chung Facebook cung tirng la ngn nhan eua Cliekjacing khi ngudi dung vo linh nhan vao cac dudng link lam lay lan cac ma dgc hai hay dan gian la "like" mdt Page nao dd. Tin edng dgng nay kha phd bien tren Internet, din noi nhidu ngudi xem do la dieu hien nhien khi truy cap web, dan ldi lam ly chu quan, xem nhe tinh bao mSt.

Ddi vdi cae Id thuat tin cdng Cliekjacing nang cao, hacker khdng nhung chilm dogl cii click chugt ma cdn ca cac doan text. Chiing cd die chua thdng tin tai khoan ngan hang, mat khau hay cac thdng tin nhay cam Tliipt hgi cd the xay den vdi ngudi dimg la rat ldn.

D I phdng chong tin cdng Clickjacking, hai ylu td can dugc quan lam do la con ngudi va Id thuSt.

Trong dd, ylu to con ngudi cd vai tro quan trgng, dae biet la vdi cac dang tan cdng lira dao. Ngudi diing cin cd hilu bill ca ban ve bao mat thdng lin, cd y thiic canh giac khi tmy cap vao cae trang web lg va cac hanh ddng la, dgc biet canh giac irudc cac ldi du dd, mdn hdi tren Internet.

(6)

Nguyen Dang Tien

Co kha nhieu phuang phap khac nhau de phdng chdng Clickjacking, trong pham vi bai bao, toi dg cap den mpt sd phu-ang phap hieu qua nhit, dugc Ihuc hien d ca hai phia: may chii cung cap dich vu va ngudi dung intemet.

* Cf phia Mdy chu web

- KT thugt Framebuster: KT thuat dau tien ed the ke den la sii dyng cac kich ban Javascnpt dac biet nham ngan chgn viec tai ndi dung trang web vao irong mdt frame. Nhung doan ma nhu the duge ggi la framebuster. chiing tdi de xuat viet nliu sau.

< s c r i p t >

i f ( t o p ! ^ w i n d o w )

{top.location=window.location}

</script>

O kich ban framebuster tren, mpt dieu kien dugc kiem tra dd la trang web dugc tai cd phai nam trong mdt frame hay khdng. Neu trang lam viec hien tai khdng phai la trang cao nhat (dugc hien thi) thi trang eao nhit se dugc gan lai de hien tlii ra cho ngudi dung. Tuy nhien, trong thuc te Id thuat nay chua hoan toim dam bao de chdng lai Cliclgacking.

- KT [hug! X-Frame-Options- X-Frame-Options Header la mpt tuy chgn a may chu, thdng bao cho trinh duyet rang website nay cd cho phep dugc nhiing vao trong cac the frame, iframe hay khdng.

Header nay xual hien vao nam 2009 va hien tai da dugc hau het eac trinh duyet hd trg. Cd ba gia tri tiiy chgn ciiaX-Frame-Options gdm ed:

X - F r a m e - O p t i o n s : DENY i X - F r a m e - O p t i o n s : SAMEORIGIN

X - F r a m e - O p t i o n s : ALLOW-FROM h t t p s : / / e x a m p l e . c o m /

u day. chung ldi de nghi chpn DENY" cam hoan toan viec tai trang Web vao trong frame. Cu the chung tdi dua ra mpt sd giai phap nhu sau

- Doi vdi may chu Apache:

Header always set X-Frame-Options DENY i - Ddi vdi may chii Lighthllpd:

server.modules += ("mod_setenv") \

$HTTP["scheme"] == "https"

(

s e t e n v . a d d - r e s p o n s e - h e a d e r ( " X - F r a m e - O p t i o n s " => "DENY")

Sau khi cudc tan cdng Clickjacking gay ra thiet hai va dugc phat hien, cae nha cung cip dich vu Web Idn da canh giac hon vdi nd. Facebook, Twitter hay GilHub deu da cSu hinli X-Frame-Options giup chan dgng tan cdng nay.

- KT thudl sda lot XSS de trdnh bi hacker kel ven hap Clickjacking: XSS la ldi a Server cd the gay nguy hiem Idn cho ngudi dimg, tuy nhien lgi khdng qua khd de phdng tranh. Ban chat cua XSS ciing la khdng kiem soat Id dii lieu nhap vao nhu SQL Injection. Bien phap dua ra la kiem duyel ki du lieu vao, chan cac lir khda nguy hiem.

Mdt phuang phap hieu qua khac la ma hda eac ky lu dac biet ciia dir lieu vao, sir dung ham

hlmlentitiesO cua HTML, nhu sau: _

; e c h o h t m l e n t i t i e s { $ r o w [ " c o n t e n t " ] ) ; J

(7)

De xudi mot so bien phdp phong chong phuong thuc ldn cong Clickjacking

Phuang phap tren ciing cd the duae sd dung vdi ASP, JSP.

* (Jphia ngudi diing

Ve phia ngudi dung, trudc hel can nang cao nhan thuc ve van de bao mat khi truy cap Internet, than trgng vdi cac giao dich, thao tac nhay cam tren mang.

Ve kl thuat, cd the su dung mdt sd phuong p h ^ sau: Cai dat Add-on vao trinh duyet de ngan chan viec chay Flash hay Javascript, nhuNoScript cua FireFox hay Clickjacking Reveal ciia Chrome.

Tuy nhien dieu nay ed the gay ra mpt sd phien toai trong qua trinh duyet web; Thudng xuyen cap nhat cac ban nang cap cua trinh duyet, he dieu hanh va cac ban va Idi tir nlia san xuat; Can than vol cac thao tac la, cac "mdn qua" bat ngd tu Intemet; Can than vdi eac URL thiSu tin cay tren mang; Cai dat cac phan mem Anti Virus manh va Ihudng xuyen update.

3. Ket luan

Clickjacking la dang tan cdng phd bien, tuy khdng yeu eau kT Ihual khai thac qua cao nhung hgu qua gay ra cd the rat nghiem trgng Day la cudc tan cdng mang cac dgc tnmg cua dgng tan cdng Ida dao, do dd ngoai van de kJ thuat, yeu td con ngudi la quan upng trong viec phdng chdng, phat hien va tranh bi roi vao bay ma hacker dyng san Cac dgng tan cdng gay thiel hai hay gian vao cac may chu cung cap dich vu nhu tan cdng DDOS, SQL-Injection thudng duoc gidi trayen thdng va chuyen mdn cbii y nhieu han ma sa y bo qua cac cupc tan cdng cd muc tieu nham den cac ca nhan su dung internet Cac nha phai inen website cijng chua thirc sy chii y den Clickjacking. Hien nay. ngoai cac trang web ldn da chan iframe. van cd nlueu trang web nhay cam ve ITnh vuc lat chinh. ngan hang trong nudc eho phep tai trang cua minli qua trang web khac. Han bao gid het, mdi ngudi dung Internet phai tu trang bi cho minh nhihig hieu biel ca ban ve van de an ninh bao mat thdng lin. de cd the "an loan" tren khdng gian mang. dgc biet la trong thdi dgi Intemet ket ndi van vat nhu hien nay.

TAI LIEU THAM KHAO [I] S.Paul, 2010. Next Generation Clickjacking. White paper.

[2] M. Balduzzi, M. Egele, E. Kirda, D. Balzarotti, C. Kmegel, 2010, A Solution for the Automated Detection ofCUck/acking Attacks.

[3] G. Rydstcdt, E, Bursztein, D Boneh, C, Jackson, 2010, B. Busting .A Study of Clickjacking Vulnerabilities on PopularSiies Sianford University,

[4] L Huang A, Moshchuk. H, Wang, S. Scheditei.C Jackson. 2012. Clickjacking. Attacks and Defenses.

[5] A.Narayanan, 2012. Clickjacking Vulnerability and Countermeasures, Foundation of Computer Science PCS, New York, USA.

[6] H. Shahriara, V Devendran, 2014. Classification of Clickjacking Attacks and Detection Techniques, Kenncsaw Slate University, Kennesaw, Georgia, USA.

ABSTRACT

Clickjacking attack prevention using various techniques

Nguyen DangTicn People's Police University oj Technology and Logi.itics, Bac Ninh, yteinam In this paper, we propose some methods of Clickjacking allacks to prevent a very popular online Fraud (phishing) Tliis is an atlack method thai u.sers access the applicalions via browsers; victims are chealed and manipulated on ihc fake website created by the hacker. These sites are usually hiding under the guise of a secure site. Clickjacking attack does not require high technical, but the consequences may be serious. The consequences may cause a nuisance for users, more heavily account information or other types of sensitive data may be stolen. We also offer a number of insurance methods to Web servers and users lo prevent clickjacking allack effectively.

Keywords: Clickjacking atlack, iframe lag, hacker, set the z-index, intcrnel service.

75