the-web-application-hackers-handbook

514 Chapter 13 n Attacking Users: Other Techniques
Framebusting Defenses
When UI redress attacks were first widely discussed, many high-profile web
applications sought to defend against them using a defensive technique known
as framebusting. In some cases this was already being used to defend against
other frame-based attacks.
Framebusting can take various forms, but it essentially involves each relevant
page of an application running a script to detect if it is being loaded within an
iframe. If so, an attempt is made to “bust” out of the iframe, or some other
defensive action is performed, such as redirecting to an error page or refusing
to display the application’s own interface.
A Stanford University study in 2010 examined the framebusting defenses used
by 500 top websites. It found that in every instance these could be circumvented in
one way or another. How this can be done depends on the specific details of each
defense, but can be illustrated using a common example of framebusting code:
if (top.location != self.location)
{ top.location = self.location }
This code checks whether the URL of the page itself matches the URL of the
top frame in the browser window. If it doesn’t, the page has been loaded within
a child frame. In that case the script tries to break out of the frame by reloading
itself into the top-level frame in the window.
An attacker performing a UI redress attack can circumvent this defense to
successfully frame the target page in several ways:
n Since the attacker’s page controls the top-level frame, it can redefine the
meaning of top.location so that an exception occurs when a child frame
tries to reference it. For example, in Internet Explorer, the attacker can
run the following code:
var location = ‘foo’;
This redefines location as a local variable in the top-level frame so that
code running in a child frame cannot access it.
n The top-level frame can hook the window.onbeforeunload event so that
the attacker’s event handler is run when the framebusting code tries to
set the location of the top-level frame. The attacker’s code can perform a
further redirect to a URL that returns an HTTP 204 (No Content) response.
This causes the browser to cancel the chain of redirection calls and leaves
the URL of the top-level frame unchanged.
n The top-level frame can define the sandbox attribute when loading the
target application into a child frame. This disables scripting in the child
frame while leaving its cookies enabled.