ITPEC FE Morning April 2020 Question 37

Misleading the user into interacting with a UI and performing unintended operations — clickjacking hides the real target of a click.

The attacker's page loads a legitimate site in a transparent frame and places it over harmless-looking content. The user thinks they are clicking the visible button, but the click lands on the hidden page, where it can change a setting, make a purchase or grant a permission while the user is logged in.

Answer (b)

Why not others:

• •(a) — taking remote control of a computer describes a remote access trojan (RAT); in clickjacking the victim clicks, the attacker never operates the mouse
• •(c) — locking the pointer is a denial of the user's input, not a trick that gets the user's own click to do something else
• •(d) — removing a device driver needs control of the system already, and stops the user acting rather than misdirecting an action

Key rule: Defend against clickjacking by forbidding other sites to frame your pages: the X-Frame-Options header or the CSP frame-ancestors directive.

Security · AI-written, may contain errors