Sunday, May 19, 2024

Gesture Jacking – New Attack That Deceives Website Visitors

The Web Platform is incredibly powerful, but regrettably, malicious websites will do all in their capacity to misuse it.

To prevent such exploitation, blocking actions that weren’t accompanied by a “User Gesture” is one of the weakest (but easiest to implement) defenses.

Gestures are a weak primitive because, although it is easy to determine whether a user has clicked or pressed a key, they do not suit the design objective of clearly conveying a user request well.

A more certain method of deceiving users is gesture-jacking, which eliminates the need for accurate window position, precise click timing, and the random nature of the user’s display settings.

Run Free ThreatScan on Your Mailbox

AI-Powered Protection for Business Email Security

Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Try Trustifi Free Threat Scan with Sophisticated AI-Powered Email Protection .

Rather, the attacker lures the user into holding a key, causes a victim webpage to appear, and then transfers the key down to the victim’s website.

Overview Of Gesture Jacking Attack

Security researcher Paulos Yibelo describes in detail a form of attack in which a user is tricked into holding down a key (such as Enter), and that action is interpreted as accepting a popup window and activating a button on the website of the intended victim. 

The victim’s security could be severely compromised if the button on that page executes a risky activity (such as “Grant access,” “Transfer money,” etc.).

Eric Lawrence, an expert browser developer and general program manager for Microsoft Defender, investigated the attack and referenced Yibelo’s post.

The author refers to the attack as a cross-window forgery; however, Eric Lawrence refers to it as a gesture-jacking attack because it most closely resembles the ClickJacking attack vector that gained attention in 2008. 

“Some folks expected that this attack shouldn’t be possible– “browsers have popup-blockers after all!” Unfortunately for their hopes and dreams, the popup blocker isn’t magical”, Eric Lawrence wrote in his blog.

“Holding the Enter key is a user-gesture, so the attacker’s page is allowed to spawn a popup window to a victim site”.

According to him, the foundation of this attack is dependent on a feature of the web-based platform. In particular, when you visit a URL that has a fragment in it:

The browser will automatically concentrate on the first element—if any—whose id matches the value of the fragment by scrolling to it.

Keyboard input will, therefore, be directed towards that element.

According to Yibelo, a website can prevent unintentional button clicks by either randomly assigning the id value on every page load or by removing the id attribute from critical buttons.

Alternatively, to remove an unexpected URL fragment, the page may “redirect” upon loading.

An additional option is provided for Chromium-based browsers: a document can specify that it does not wish to use the default button-focusing behavior.

A website can disable all forms of automatic scrolling (and focussing) from the fragment by adding the force-load-at-top document policy (added as an opt-out for the clean Scroll-to-Text-Fragment functionality).

The researcher noted that attackers have long exploited gesture-jacking to manipulate browser user interfaces, and hence, browser teams have had to release numerous upgrades to stop this abuse.

It is recommended to use frame-ancestors CSP to prevent framing, auto-focus/make default the safe option and disable sensitive UI elements.

Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide


Latest articles

Hackers Exploiting Docusign With Phishing Attack To Steal Credentials

Hackers prefer phishing as it exploits human vulnerabilities rather than technical flaws which make...

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that...

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices,...

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine,...

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers...

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information...

Russian APT Hackers Attacking Critical Infrastructure

Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles