Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 544
Alerts This Week
Warning Icon 1 544

Firefox 3.6.9 Security Update: X-FRAME-OPTIONS Defense Against Clickjacking

Calendar Sep 08, 2010 • User Avatar Anthony Pell
1 min read
General Esm H446
Topics%20covered

Topics Covered

security advisory software update firefox web security clickjacking
Firefox 3.6.9 now supports the X-FRAME-OPTIONS header, which enables web servers to forbid clients from opening downloaded pages in iframes. Clickjacking involves an attacker website inserting a transparent iframe containing, for example, Facebook content under the cursor. Users think they are clicking on the visible web page, but are in fact clicking on elements in the transparent Facebook iframe. Earlier this year, hundreds of thousands of Facebook users fell victim to a clickjacking attack after unwittingly clicking on a concealed 'Like' button on a crafted web page. The new option would allow Facebook to prevent attackers from loading content in an iframe in Firefox. Despite the fact that Internet Explorer 8 and Chrome already support this option, Facebook is not using it.

The link for this article located at H Security is no longer available.