Malicious camera spying using ClickJacking

Posted on by guya

Update: Adobe has fixed this issue by framebusting the Settings Manager pages. Now, 99.9% of the users are protected from this specific exploit. Congrats on the fast response. —-

Turn every browser into a surveillance zombie. The wet dream of every private eye and peeping tom. Imagine this scenario, you play a short game on the web and by doing that you unknowingly grant someone full access to your webcam and microphone.

I’ve made a live demo of it in here, this demo won’t listen or record any of your input.

If you don’t want to try it or don’t have a webcam connected, then check out the video.

[kml_flashembed movie="www.youtube.com/v/gxyLbpldmuU" /]

When I’ve first heard about ClickJacking and how Adobe is concerned about it, I thought that the Flash Player Security Dialog must have been compromised. But the Security Dialog does a good job disabling itself when you try to mess with it’s visibility through DHTML. Unless there’s some 0-day issue with the Dialog it’s probably relatively safe.

The problem here is the Flash Player Setting Manager, this inheritance from Macromedia might be the Flash Player security Achilles heel.

I’ve written a quick and dirty Javascript game that exploit just that, and demonstrate how an attacker can get a hold of the user’s camera and microphone. This can be used, for example, with platform like ustream, justin and alike or to stream to a private server to create a malicious surveillance platform.

I’ve made it as a JS game to make it easier to understand, but, bear in mind that every Flash, Java, SilverLight, DHTML game or application can be used to achieve the same thing.

Some of the clicks are real game clicks other are jacked clicks. Every time the click is needed to be jacked the content simply move behind the br using z-index

I had doubts about publishing this, but, if I could have understand it so are the bad guys, so it’s better to know about it.

In this case Adobe could have just framebust the pages that holds the Settings Manager. There are two issues with frambusting in this case, it won’t solve all cases (legacy browsers for ex) and will force Adobe to rely on javascript.

Play it here, watch it here

This entry was posted in ClickJacking, Flash Security, Games, Javascript, Safeloper, Security, Silverlight by guya. Bookmark the permalink.

100 thoughts on “Malicious camera spying using ClickJacking”

  1. spacer x-tense on said:

    nice PoC spacer

    Reply ↓
  2. spacer Josh Tynjala on said:

    Impressive. Thanks for sharing.

    Reply ↓

  3. Pingback: Zero Day mobile edition

  4. Pingback: Details of Clickjacking Attack Revealed With Online Spying Demo - Desktop Security News Analysis - Dark Reading

  5. Pingback: hackademix.net » Hello ClearClick, Goodbye Clickjacking!

  6. Pingback: Monyer’s Training Notes » Blog Archive » Clickjacking Details

  7. Pingback: Clickjacking Details | ??'s Blog

  8. Pingback: Hello ClearClick, Goodbye Clickjacking! | ??'s Blog

  9. Pingback: Clickjacking here’s how it works | Ugh!!'s Greymatter Honeypot

  10. Pingback: Clickjacking Details | ???

  11. Pingback: Hello ClearClick, Goodbye Clickjacking! | ???

  12. Pingback: Revelan vulnerabilidad clickjacking - Foros de CHW

  13. Pingback: Clickjacking Attack Revealed

  14. Pingback: Hit the button, Jack! « partikelfernsteuerung

  15. Pingback: The WHATWG Blog » Blog Archive » This Week in HTML 5 - Episode 8

  16. Pingback: Midnight Research Labs - Clickjacking details released

  17. spacer w0lf on said:

    This seems really wet dream for spywares spacer Hope all the browser soon find a way to fix the way they handle br.

    Reply ↓

  18. Pingback: Clickjacking for spying? | Maestro Security Blogs

  19. Pingback: Clickjacking: One click to cam spy | The Blog Pirate

  20. Pingback: ClickJacking | Aplikacje internetowe

  21. spacer yehg.net on said:

    plugins are always vulnerable. Many 0days still out there spacer

    Reply ↓

  22. Pingback: Video: l’uso del Clickjacking per spiare gli utenti ignari | Blog.makernet.it

  23. Pingback: Click jacking - Xtreme CPU

  24. Pingback: "Clickjacking" Details Emerge | Student Tech News

  25. spacer Elisabeth on said:

    This is Dong-bin(Elisabeth) Kim and I’m a reporter of Information Security 21C, mothly magazine, and Boan news, internet daily news site.
    I’m very impressed, so I’d like to introduce your PoC via our magazine.
    So, if you’re O.K, I’d like to capture you PoC and put it into our magazine.
    Please send comment to me.

    Reply ↓

  26. Pingback: Firefox Extension Blocks Clickjacking! | TekBlog

  27. Pingback: Liquidmatrix Security Digest » Security Briefing: October 8th (Late Edition)

  28. Pingback: Clickjacking peligrosa vulnerabilidad de los navegadores modernos | AtajoTV

  29. Pingback: Clickjacking Attack Lets Web Sites See, Hear You |

  30. Pingback: Clickjacking : une faille de sécurité touchant Adobe Flash Player

  31. Pingback: “Clickjacking” Details Emerge | Syber News

  32. spacer Kilgore on said:

    Really nice PoC !

    Reply ↓
  33. spacer sheez on said:

    blah, this was demonstrated by a DOD security expert YEARS ago. Man, get with the times.

    Reply ↓

  34. Pingback: ???????????? ??????????? ????? Clickjacking | Raz0r.name - ???? ? web-????????????

  35. Pingback: TechOnlineNews.com » Adobe stopft Flash-Player-Lücke

  36. Pingback: La France d’en bas » Blog Archive » Le ClickJacking utilise flash pour vous filmer à votre insu

  37. Pingback: ClickJacking Exploit : FraudO.com

  38. Pingback: Apukeittiö.fi » Blog Archive » ClickJacking tai UI Redressing

  39. Pingback: ew-bloggt » Forscher enthüllen Details zu Clickjacking-Attacken

  40. Pingback: ????????????????????? - GENMICHA | ????

  41. Pingback: ® NoScript - Addon untuk Mencegah ClickJacking

  42. Pingback: Ajaxian » This Week in HTML 5: Web Forms 2, Search, and more

  43. Pingback: Security Ninja Blog | Clickjacking

  44. Pingback: ???? ????? » ???? » Hello ClearClick, Goodbye Clickjacking! - ???? ?????

  45. spacer Kugelfisch on said:

    In fact, Macromedia’s Framekiller does not seem to help at all, as the settings manager’s flash-movie itself can still be loaded into an br. Have a quick look at this derivate of your PoC: kugelfisch.bplaced.net/game.html

    Reply ↓

  46. Pingback: Adobe’s Workaround for “Clickjacking” Issue, and What You Can Do Now

  47. Pingback: Adobe fixes ‘clickjacking’ flaw | TechHairBall.com

  48. Pingback: Telecom,Security & P2P » [Chinese]clickjacking??

  49. Pingback: Clickjacking: Potentially harmful web browser exploit | Network Administrator | TechRepublic.com

  50. spacer Eugene on said:

    looking forward for more information about this. thanks for sharing. Eugene

    Reply ↓

  51. Pingback: El Clickjacking y como afecta a las instituciones « robert dice…

  52. Pingback: Flash Security: Clickjacking the Webcam : TroyWorks

  53. Pingback: Clickjacking Details | Small Business System

  54. Pingback: Application Security Talk » Clickjacking: Do you see what I see?

  55. spacer John aniime on said:

    Click Jacking has long since been called by search engine marketers… u need a new term.

    what click jacking really is is swapping in your own ads into someone elses page often by overlaying or using javascript or filtering their content

    Reply ↓

  56. Pingback: Preventing Clickjacking with Framebusting - KeepItLocked.net

  57. Pingback: Moja prednáška na WebExpo Praha 2008

  58. Pingback: Packets of Consciousness » Clearjacking: So How Fun is This, Now?

  59. spacer Decapper on said:

    Yeah I would hate for this too happen -www.pricelessweddings.com.au as I would be caught pants down spacer

    Reply ↓

  60. Pingback: Marco’s Webdev Notepad » Blog Archive » Clickjacking

  61. Pingback: Brown Tips » Blog Archive » What IS ClickJacking

  62. Pingback: Prominent Security » Twitter, and the Popularity of Clickjacking.

  63. spacer travesti on said:

    ction, please visit the blog post of Flash developer Guy Aharonovsky, where he demonstrates in a video how a user unintentionally changes his browser’s security settings while playing a JavaScript

    Reply ↓

  64. Pingback: Flash + Internet = Big Brother is watching you

  65. Pingback: Dipl.-Inform. Carsten Eilers

  66. Pingback: Dipl.-Inform. Carsten Eilers

  67. Pingback: John Smith’s younger brother, Adam | GUYA.NET

  68. spacer y8 juegos on said:

    what click jacking really is is swapping in your own ads into someone elses page often by overlaying or using javascript or filtering their content?

    Reply ↓

  69. Pingback: Preventing Clickjacking with Framebusting | Keep It Locked

  70. spacer Enoch Boris on said:

    Hiya! I just would like to give an enormous thumbs up for the nice data you could have here on this post. I will be coming back to your weblog for more soon.

    Reply ↓