DoubleClickjacking: A New Threat to Website Security and Account Safety
Cybersecurity researchers have identified a concerning evolution of the traditional clickjacking attack—dubbed DoubleClickjacking. This sophisticated method bypasses existing defenses, leaving even major websites vulnerable to exploitation and exposing users to potential account takeovers.
Here’s a deep dive into what DoubleClickjacking is, how it works, and what can be done to mitigate its risks.
What Is DoubleClickjacking?
DoubleClickjacking builds upon the decade-old concept of clickjacking, where users are tricked into clicking on hidden or disguised elements, often resulting in unauthorized actions.
Modern browsers have largely mitigated traditional clickjacking risks by defaulting cookies to “SameSite: Lax.” However, DoubleClickjacking cleverly circumvents these protections by leveraging a two-click sequence to manipulate user actions.
In a demonstration by researcher PAULOS, users are lured into double-clicking on a seemingly harmless prompt. During this interaction, attackers exploit the timing and event sequence to replace the original window with a sensitive page—such as an OAuth authorization dialog or an account settings confirmation page—in the background. The second click, made in good faith, inadvertently authorizes a malicious action, granting attackers unauthorized access to user accounts.
How DoubleClickjacking Works
The Setup:
The attacker creates a website with a button that triggers a new browser window.
This new window displays a benign prompt, such as “Double-click to verify you’re not a robot.”
Exploiting the User:
When the user clicks the button, a new window opens with the innocent-looking prompt.
Simultaneously, the original (parent) window’s content is replaced with a sensitive page, such as an OAuth prompt or payment confirmation, using window.opener.location.
The Malicious Action:
The unsuspecting user’s second click unknowingly interacts with the replaced page, authorizing the attacker’s desired action.
The following shows Doubleclick attack in action:
Shopify shop takeover via Doubleclick oauth
Slack oauth overtook via Doubleclick
Salesforce account ovetook via Doubleclick
Why This Matters
DoubleClickjacking demonstrates how timing vulnerabilities can be exploited to bypass even modern web security standards. The attack is particularly dangerous for pages involving sensitive actions, such as granting OAuth permissions, updating account settings, or confirming payments.
How to Mitigate the Risk
For Web Developers
Enhance Client-Side Protections:
Add protective scripts to sensitive pages, especially those handling OAuth permissions or financial transactions.
Disable or limit window.opener navigation to prevent unauthorized content switching.For example:
(function(){
if (window.matchMedia && window.matchMedia("(hover: hover)").matches) {
var buttons = document.querySelectorAll('form button, form input[type="submit"]');
buttons.forEach(button => button.disabled = true);
function enableButtons() { buttons.forEach(button => button.disabled = false); }
document.addEventListener("mousemove", enableButtons);
document.addEventListener("keydown", e => { if(e.key === "Tab") enableButtons(); });
}
})();
This script ensures that buttons remain disabled until real user activity—like moving a mouse or pressing a key—is detected, thwarting automated or tricked clicks. Platforms such as Dropbox already employ such preventative measures.
Implement Strict Content Security Policies (CSPs):
Use CSP directives to block unauthorized frames and embedded content.
Consider enforcing stricter sandboxing rules for embedded windows.
For Browser Developers
Introduce Double-Click Protection:
Develop new standards, such as a “Double-Click-Protection” HTTP header, to prevent rapid context switching during double-click sequences.
Enhance Multi-Click Safeguards:
Expand existing security measures to account for timing vulnerabilities in user interactions.
For End Users
Stay cautious while interacting with prompts or buttons on unfamiliar websites.
Regularly review app permissions and account settings to ensure unauthorized actions have not been taken.
Conclusion
DoubleClickjacking represents a significant advancement in web-based attack techniques, exploiting timing vulnerabilities to bypass established defenses. As the threat landscape evolves, both developers and browser manufacturers must act swiftly to counter these sophisticated attacks.
The cybersecurity community’s vigilance and proactive measures are critical to safeguarding user trust and protecting sensitive data in an increasingly interconnected world.
Stay informed. Stay secure.
