Top 10 winner

Clickjacking / Videojacking

Jeremiah Grossman · blog.jeremiahgrossman.com · 7 October 2008

The disclosure that clickjacking plus Adobe Flash turns any machine with a webcam or microphone into a remote surveillance device on one click, and that clickjacking the Flash Global Security Settings panel makes it persistent. Notes it bypasses CSRF token defences and that framebusting, plugin disabling and NoScript are the only stopgaps.

Record

Researcher

Jeremiah Grossman

Published by

blog.jeremiahgrossman.com

Date

7 October 2008

In the archive

• Ranked #4 in the 2008 Top 10 Web Hacking Techniques

Related sources

• Demonstration video

Tags

• clickjacking
• ui-redress
• flash
• iframe
• csrf
• info-leak
• mitigation
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Jeremiah Grossman, first published at the original source. Preserved copies are kept so the citation survives its host.