[HN Gopher] DoubleClickjacking: A New type of web hacking technique
___________________________________________________________________
DoubleClickjacking: A New type of web hacking technique
Author : shinzub
Score : 220 points
Date : 2025-01-14 04:44 UTC (4 days ago)
(HTM) web link (www.paulosyibelo.com)
(TXT) w3m dump (www.paulosyibelo.com)
| gnabgib wrote:
| Title: _DoubleClickjacking: A New Era of UI Redressing_
| efortis wrote:
| I think the suggested mitigation will only work when the user
| double-clicks without moving the mouse.
|
| So I'd try adding a small timeout when the tab is visible:
| document.addEventListener("visibilitychange", () => { if
| (!document.hidden) setTimeout(enableButtons, 200)
| })
| efortis wrote:
| and `disableButtons` on `document.hidden`
| IshKebab wrote:
| Eh, it's hardly seamless, and double clicking is extremely
| uncommon on the web so that would be a big red flag.
| giantrobot wrote:
| Double clicking on the web is extremely common with older less
| technically adept users. This same cohort is also the most
| susceptible to scams.
| waltwalther wrote:
| This. I have told my eighty-year-old parents this many times
| over the years, but it doesn't seem to stick.
| Moru wrote:
| I see a lot of people doubleclicking on the web. Both young
| and old.
| NotYourLawyer wrote:
| I've tried to explain it many times too, but I can't really
| articulate a good, comprehensive rule for when to single
| and when to double click.
| cobbal wrote:
| Another complicating factor that many less-tech-literate
| don't have a good internal model for is window focus.
| I've seen several people try and single-click on a not
| focused web button, only for nothing to happen. When they
| click again, the button is activated. They then learn to
| always double click that button.
|
| Having a mental model of "this button needs to be double
| clicked" gets them the result they want, even if that's
| not a very accurate reflection of the computer.
| Pxtl wrote:
| When you're on windows and not in the browser, you
| double-click to launch a file or program in the Explorer
| (which also is what runs the desktop). Single-click is
| select.
|
| So, the rule:
|
| List of files on your computer or desktop? Double-click.
| Otherwise? Don't.
| NotYourLawyer wrote:
| What if I'm opening an email in Outlook? What if I'm
| looking at something in Control Panel? (That one's a
| trick question, since the answer has changed in modern
| Windows versions.)
| Pxtl wrote:
| I'd say don't do that. Who reads emails?
|
| Although seriously, I find I never break out of the
| preview in Outlook email. The only spot in Outlook where
| I really _need_ to double-click is the calendar. Which is
| annoying.
| giantrobot wrote:
| > When you're on windows and not in the browser
|
| So many people have absolutely no concept of different
| windows let alone a browser. They run Chrome or IE
| maximized and that is "the Internet". They'll have tons
| of tabs open because they don't understand tabs and how
| to navigate them or that they _can_ be closed.
|
| A problem with billions of people using computers is that
| only a tiny fraction have working knowledge of them, an
| even smaller fraction _understand_ them. Most people only
| understand operations by rote.
| wat10000 wrote:
| In theory: if you're clicking on a UI element that has
| some notion of being selected, then a single-click
| selects it, and you need a double-click to take an action
| on it. If there's no notion of selection, then a single
| click takes an action.
|
| In practice: adherence to this ranges from perfect to
| abysmal. And users who don't understand the computer well
| may not know how to think about whether a given UI
| element is selectable or not.
| bangaladore wrote:
| Another obvious case of double click is to select all text in
| a given area. This one is a bit more obscure though.
|
| Edit: Actually that's generally I guess triple click. Double
| to select a word.
| Etheryte wrote:
| I couldn't even begin to count how many bug reports I've seen
| over the years that start with "when I accidentally double-
| click foo, bar happens". It might not be an intentional usage
| pattern, sure, but that doesn't mean it doesn't happen a lot.
| kevinsync wrote:
| Yeah, I have no data beyond anecdotal to back this up, but I
| witness A LOT of people double-clicking everything,
| regardless of what it is. I assume it's because they only got
| so far in "computer" as to learn "click + drag to move,
| double-click to open a program or file". Link on a web page?
| I want to open that!
| doublerabbit wrote:
| > double clicking is extremely uncommon on the web so that
| would be a big red flag.
|
| You've never had a slow internet connection have you? I've seen
| double clicking from all users in the office. Comes from
| frustration.
|
| How many times have you tried to open an application; for it
| not open? So you click the icon again only for two windows to
| split open?
|
| Young, old, even techs. It's not as uncommon as you think.
| portaouflop wrote:
| I've even triple or quadruple clicked sometimes with
| disastrous results
| psygn89 wrote:
| I've had a few worn mouses register double clicks upon a
| single click. It happens inhumanly fast and users won't
| realize it until using an app that reacts to double clicks.
| uhoh-itsmaciek wrote:
| Google Drive uses it as an interaction pattern. I find that
| baffling, but while uncommon, it's not totally absent. And as
| others have pointed out, many users carry over their
| expectation of having to double-click from desktop interfaces.
| kazinator wrote:
| Web browsers and the applications on them have become extremely
| memory hungry. Memory management pauses are common and people
| click multiple times irately.
| recursive wrote:
| I double click to select text all the time. Get your flags
| ready.
| bangaladore wrote:
| I'd laugh if an effective way to present this is:
|
| CAPTCHA:
|
| Please copy `qwertyuiopasdfhkl`
|
| Into here `<textbox>`
|
| Edit: Quick (ai mockup) concept... https://imgur.com/mc0IdEA
| Obviously it would be most effective with a longer string
| though.
| sharpshadow wrote:
| New fear unlocked lazy cookie consent banners.
| yellow_lead wrote:
| Am I mistaken or does this require the user to allow pop-ups?
| gruez wrote:
| Default configuration for most browsers is to allow popups if
| it was initiated by a user action.
| yellow_lead wrote:
| Ah, thanks, that makes sense.
| xp84 wrote:
| They also usually open tabs on most new window operations (I
| think when the page doesn't specify window dimensions) rather
| than windows. Which doesn't matter much but to my laziness
| makes it even easier to line the evil page's double click
| target with the "allow" button you're meant to hit.
| krunck wrote:
| Browser content should never be able to modify the configuration
| of my desktop window layout by opening a new window. There I said
| it.
| NoMoreNicksLeft wrote:
| Agreed, but I think this was a workaround for early web apps
| that existed in the primitive days. You'd need two webpages of
| the same site open to complete some task, but the apps weren't
| sophisticated enough to do that within a single window/tab.
| Once they did it back then, now too many web apps and workflows
| would suffer if they just killed that functionality entirely,
| too many users would scream.
| KTibow wrote:
| TFA doesn't use separate windows, only separate tabs.
| maxrmk wrote:
| This is clever, and I got a good laugh out of their example
| video. The demo UI of "Double click here" isn't very convincing -
| I bet there's a version of this that gets people to double click
| consistently though.
| bee_rider wrote:
| Hmm. I guess it is never impossible that there's a version of
| something that will trick people consistently. But, I'm kinda
| struggling to recall a time I've needed to double click on a
| website.
|
| Actually the double-click action is pretty rare nowadays,
| right? In particular, I use it a lot to select a word in a
| terminal, but most of the time when I am getting UI
| instructions it is from a website about how to use the website
| itself, and since that's a website it has to be abstract enough
| to also make sense for mobile users.
|
| Telling people to double click is, I think, mostly dead.
| chatmasta wrote:
| It doesn't need to be a literal double click. It could be
| something like a CAPTCHA "confirm you're human," where you
| click once, it appears to load, and then you click a confirm
| button. Do it fast enough and it might appear like a double
| click.
|
| Not sure this would work with the exploit though.
| foobazgt wrote:
| My mother constantly struggles between when to double click
| or not after decades of using computers. This is probably an
| issue that will die out with her generation, though.
|
| Entirely separate, a common failure mode of dying mice is
| that they start generating spurious clicks. I've had a couple
| of logitechs do this to me. And the thing about scams is you
| can often legit make money off of very low success rates.
| JadeNB wrote:
| > Entirely separate, a common failure mode of dying mice is
| that they start generating spurious clicks.
|
| Speaking of things dying out, it's been so long since I
| used anything but a trackpad that I thought at first this
| was some strange claim about rodents!
| opello wrote:
| And may just come back once some subset of the population
| only interacts with touch screen devices.
| dylan604 wrote:
| Google drive and similar sites use double click for folders
| to open similar to a regular OS would. Single click tends to
| show some metadata where the double click does the actual
| navigation.
|
| it pisses me off
| hansvm wrote:
| YouTube gets me to double-click on occasion:
|
| - The page mostly loads
|
| - An ad starts playing
|
| - I attempt to hit "pause" while I go handle a thing or two
| [0]
|
| - As I'm about to click "pause", the layout shifts to the
| left exactly enough for me to unmute the ad
|
| - I immediately click again to stop listening to whatever
| scam is currently being peddled
|
| [0] For some videos I like to read the description before
| watching. For all videos I like to make it as obvious as
| possible to Google that there isn't a real person watching
| the ad (browser not focused, ad muted, ...).
| chatmasta wrote:
| The exploit would be more effective if it obfuscated the UI on
| the authorization (victim) page. Right now, even if you double
| click a convincing button, it's extremely obvious that you just
| got duped (no pun intended).
|
| Sure, maybe the attacker can abuse the access privileges before
| you have a chance to revoke them. But it's not exactly a smooth
| clickjacking.
|
| I'd start by changing the dimensions of the parent window
| (prior to redirecting to victim) to the size of the button on
| the target page - no need to show everything around it
| (assuming you can make it scroll to the right place). And if
| the OAuth redirects to the attacker page, it can restore the
| size to the original.
|
| Back in the day, this trick was used for clickjacking Digg
| upvotes.
| joshfraser wrote:
| You can change the visibility of the target page so they
| wouldn't know
| chatmasta wrote:
| How? You don't control the DOM on that. You can adjust the
| window prior to changing its location but that's it.
| jeroenhd wrote:
| I don't think you can, but you could open a popup over the
| target to hide the authorisation page to make it a little
| less obvious. JS also has a window.close() function for
| opened windows, but I believe browsers might show a warning
| when you try that on an external origin.
|
| One could also confuse the user by spawning a whole bunch
| of tabs for other services after clicking the authorise
| button, making the user think something weird is going on
| and closing all the tabs that just popped up without
| realising they clicked the authorisation button.
| seanwilson wrote:
| Why stop at double-click? "Click here 10 times quickly to
| confirm you're human". Or some kind of clicker game.
| temporallobe wrote:
| Like in reCAPTCHA (v2 at least) where it asks users to click
| on tiles to identify common objects like bridges or
| motorcycles. Surely one could conjure up a fake version of
| this.
| seanwilson wrote:
| I've seen people complete actual CAPTCHAs that were
| something like "Click here exactly 10 times to prove you're
| human" so I don't think you'd need anything fancy. People
| wouldn't stop to question it and are used to doing much
| weirder CAPTCHAs without understanding what they're for.
| adrr wrote:
| Punch the monkey by double clicking it.
| bangaladore wrote:
| Bit off topic, but what's the reasoning behind messing with the
| native browser scroll here. Almost gets me motion sick when
| scrolling through this article.
| technion wrote:
| Marketing people have demanded this on many websites sites I've
| been involved with. Don't ask me why.
| dmix wrote:
| What is it? Smooth scrolling?
| bangaladore wrote:
| From the html:
|
| // SmoothScroll for websites v1.2.1
| braiamp wrote:
| And this is why NoScript is a required extension. Matrix
| if you use Chromium based browsers.
| hombre_fatal wrote:
| You'd think the library would first check for macOS/iOS
| which already has far superior smooth scrolling.
| ndriscoll wrote:
| Maybe the industry should develop a secret header we can all
| have our browser send to disable this sort of thing. Like
| `X-Shibboleet: true`.
| jeroenhd wrote:
| A uBlock rule for smooth scrolling libraries can do
| wonders, though on some pages that breaks all JS scripts
| because of brittle JS assuming certain objects are
| magically instantiated.
| btown wrote:
| My hypothesis on this is that marketers who have personal
| MacBooks but are forced to use Windows computers at work,
| with mice with notched scroll wheels, find JS-driven smooth
| scrolling to be superior to the native snapping experience
| they see at work on many websites. But it wreaks havoc on
| people who already have computers with native high-resolution
| trackpads. Alas, the folks at big companies care more about
| their at-work than at-home experience, and it's been cargo-
| culted to smaller companies now as well. The conversation
| "detect if there is indeed a trackpad being used" never even
| comes up.
| packtreefly wrote:
| It is the height of irony to me that a blog post complaining
| about clickjacking is presented on a website that is guilty of
| scrolljacking.
| thoughtpalette wrote:
| I thought the same. Glad to see it called out here. Maybe
| that's the post for next week...
| mediumsmart wrote:
| the scrolling is almost normal in librewolf - but that is
| with privacy badger blocking 14 trackers on that page ...
| p3rls wrote:
| Nah in my opinion it needs more acceleration, really why not
| just basically remap my mousewheel to home/end
| beaugunderson wrote:
| this one is especially bad since they somehow broke pinch zoom
| as well, it now scrolls in addition to zooming
| gwbas1c wrote:
| I'm a little skeptical that this is a real exploit.
|
| When I watched the Salesforce video, _the exploit was
| demonstrated by pointing the browser at a file on disk,_ not on a
| public website. I also don 't understand the "proof," IE,
| something showed up in the salesforce inbox, but I don't
| understand how that shows that the user was hacked. It appears to
| be an automated email from an identity provider.
|
| I also don't understand when the popup is shown, and what the
| element is when the popup is closed.
|
| Some slow-mo with highlighting on the fake window, and the "proof
| of exploit," might make this easier to understand and demonstrate
| akersten wrote:
| It's also not a novel threat model. For example prior art, the
| browser confirmation dialogs in Firefox at least don't enable
| their buttons until the window has had focus for 500ms or so.
| Possibly to avoid inadvertently unintentionally clicking "run"
| on a recently downloaded item, but it solves for this too and I
| wouldn't be shocked if this was on their mind too.
|
| If I were running some site where pressing a button does some
| kind of auth that I really want a user to read, that seems like
| a reasonable mitigation compared to the hyperbole found in the
| article:
|
| > This technique seemingly affects almost every website
| stavros wrote:
| It doesn't matter where the file was, the page simply redirects
| itself to the Salesforce website and opens a popover with the
| "double click me" button over the "allow" button in the window
| below.
| Vortigaunt wrote:
| Thankfully this shouldn't become a large problem, because
| websites simply don't load that quick
| joshfraser wrote:
| It could be preloaded
| cryptonector wrote:
| I understood GP's joke, but I don't understand yours.
| bawolff wrote:
| Neither are a joke.
|
| The exploit requires pages to load instantly. The first
| person was saying it usually takes a few hundred ms to load
| a page (at least). The second person points out that you
| can load the page in the background so it is in the local
| browser cache already, in which case loading is near
| instant.
| stavros wrote:
| I understood the first comment as tongue in cheek,
| because the web has become very slow. It's a legitimate
| argument, too, but I read it as at least a bit tongue in
| cheek.
| theodorejb wrote:
| > The exploit requires pages to load instantly.
|
| How so? The page with the double-click prompt immediately
| changes the parent page behind it to the target location,
| and it can easily show a loading indicator for a couple
| seconds to wait for the target page to render before
| prompting the user to double-click.
| Too wrote:
| They load in the background. Look at the second video
| attempting to attack Slack. Look closely at the first tab in
| the top left corner, you can see that it is loading and
| eventually settles on Slack before the victim clicks the
| button. The attacker website has a delay on the click button to
| allow it to finish.
| lozenge wrote:
| Make them fill in the CAPTCHA on the temporary page, then
| double click to finish.
| joshfraser wrote:
| Back in 2013 I discovered that you could use clickjacking to
| trick someone into buying anything you wanted from Amazon
| (assuming they were signed in). It took them almost a year to fix
| the issue. They never paid me a bounty.
|
| https://onlineaspect.com/2014/06/06/clickjacking-amazon-com/
| superq wrote:
| On that note, https://github.com/aws/aws-codedeploy-
| agent/issues/30
| paulpauper wrote:
| Bug bounties are kind of a joke. they will invent almost any
| reason to not pay. it has to be something where the site is
| malfunctioning, not CSS tricks, which has to do with the
| browser , not the vendor. Clickjacking can work on any site,
| not just Amazon.
| Dwedit wrote:
| In other words, a social engineering attack to trick people into
| authorizing something they did not want to authorize.
|
| Related XKCD:
| https://www.explainxkcd.com/wiki/index.php/2415:_Allow_Captc...
| jmull3n wrote:
| This would be super effective as a form submit button that
| doesn't respond, tricking the user into rage clicking
| lapcat wrote:
| It appears that you can replace double-click with command-click,
| and listen for keydown rather than mousedown.
| cryptonector wrote:
| And this is a great reason to us Firefox's containers feature.
| denuoweb wrote:
| Lots of people suggesting that double click here means to click
| the mouse twice quickly but I believe it refers to clicking
| submit (once), then clicking the pop up button (once), to get two
| total clicks.
| janmo wrote:
| There is also a technique where they ask you to press: [Win + R]
| + [CRTL + V] + [ENTER] to verify that you are human.
|
| This will install malware code that was put in the clipboard by
| using javascript.
| HeliumHydride wrote:
| The "Run" app appears right after pressing Win+R, so this
| wouldn't work.
| janmo wrote:
| I tried it on a VM, it did work. [WIN + R] opens the run app
| down left in the left corner.
|
| [CRTL + V] pastes a small code snippet in the run app and
| once [ENTER] is pressed it closes the run app and in the
| background downloads and executes a larger code snippet from
| a malicious website.
|
| So if you press exactly what they told you to press it would
| install a malware on your computer. Now this typically
| targets people that don't even know what the run app is.
| begueradj wrote:
| There is the classic "drive by download attack" where you
| have nothing to press.
| yapyap wrote:
| yeah, you paste malicious code into the run window (basically a
| powershell) and then paste in code. pretty obvious most of the
| time
| steven_noble wrote:
| The article's headline says it's a new technique. The article's
| body does not really say this.
| Too wrote:
| This is just a variation of a trick that is as old as the
| internet. Most old attacks were using timing instead of double-
| clicking, usually by tricking the user to click on a bouncing
| monkey to win a price, instead hitting what was behind.
|
| The real question is, how have browser vendors still not
| learned. Don't allow any clicks the first moments after a focus
| change.
| mylastattempt wrote:
| If they implement that without an opt-out in the settings,
| even if buried deep, using the web as a 'power user' will
| become even more painful!
| chrismarlow9 wrote:
| You can use similar tricks to sniff auto fill data with arrow
| keys, a fake pacman game, and hidden form fields using focus.
| nneonneo wrote:
| The idea here is simple: get users to commit to clicking twice,
| but the pop up page only accepts a single click before closing.
| Their second click goes to the page underneath the pop up, which
| is e.g. an authentication button.
| bawolff wrote:
| That's clever, but i feel like it would be difficult to pull off
| in practise.
|
| Also i wonder if the suggested mitigation can somehow be worked
| around by somehow preloading the page into the bfcache.
| inopinatus wrote:
| people who write search result UIs that update/rearrange whilst
| you're trying to select something have known about the general
| class of bait-and-switch click vulnerability for years
| alp1n3_eth wrote:
| I feel like this relies more on social engineering itself than
| anything else. I think confirmations / captchas should be in use
| for any critical functionality any way, but watching the exploit
| vid makes it seem like I can submit a bug for a user going to
| GitHub, downloading malware, then running that malware, because
| an email told them they should. The extra tab involvement
| wouldn't raise any red flags for a user?
| swframe2 wrote:
| I clicked on a bad link a few months ago. I can't believe I fell
| for it. I've disabled javascript by default in my browser and
| only enable it for websites that I trust. It is painful for some
| websites that redirect a lot.
|
| What are you doing to reduce your chances of running bad
| javascript code?
| pinoy420 wrote:
| Genius. I am gonna use this until browsers do a permanent prompt
| "are you sure you want to close this window?"
| grokblah wrote:
| This could be mitigated by solving a longstanding UX issue: UI
| elements changing just before you click or tap.
|
| Why not, by default, prevent interactions with newly visible (or
| newly at that location) UI elements? I find it incredibly
| annoying when a page is loading and things appear or move as I'm
| clicking/tapping. A nice improvement would be to give feedback
| that your action was ineffective/blocked.
___________________________________________________________________
(page generated 2025-01-18 23:01 UTC)