CN104767747A - Click-jacking security detection method and device - Google Patents

Abstract

The embodiment of the invention provides a click jacking safety detection method and device. The method comprises the steps that a button element and webpage URL information in a webpage to be detected are separated; the button element and a sensitive element in a sensitive element database are compared; if the sensitive element in the sensitive element database exists in the button element, the webpage URL information of the webpage to be detected is compared with a website white list in a website white list database; if the webpage URL information of the webpage to be detected is in the website white list, the click jacking safety detection is not executed; if the webpage URL information of the webpage to be detected is not in the website white list, the click jacking safety detection is executed. The click jacking safety detection method can achieve automatic safety detection for click jacking of SNS websites.

Description

Click-jacking security detection method and device

technical field

The invention relates to the technical field of computer network security, in particular to a click hijacking security detection method and device applied to social network sites SNS.

Background technique

Clickjacking (click hijacking) is a visually deceptive web attack method that executes malicious programs by tricking users into clicking certain parts of web pages that contain hidden buttons. An inline frame (i.e., an inline frame) that contains another document, and hackers can load other content into the target website through the iframe. If a hacker carefully designs the Clickjacking attack page, no matter whether the user clicks the mouse normally or unintentionally, the click may lead to malicious behaviors such as downloading a Trojan horse program.

In the process of realizing the present invention, the inventor has found that the above-mentioned existing defense technology for clickjacking has at least the following problems:

At present, large websites have many pages, and some pages must be nested by other websites according to business needs. However, some sensitive pages are not allowed to be nested by other pages, so it is almost impossible to automatically detect clickjacking vulnerabilities, the false positive rate is high, and it is almost unusable.

Especially for SNS (SNS: specifically refers to Internet application services that help people build social networks. It also refers to information carriers that are already mature and popular in society, such as short message SMS services. Another common explanation of SNS: the full name SocialNetwork Site, That is, "social networking site" or "social network") website, the interactive feature will amplify the effect of clickjacking attack, which may cause large-scale worm outbreaks and cause great losses to users.

Because the clickjacking vulnerability is difficult to exploit and difficult to detect, many large-scale attack cases have occurred, causing great security risks.

At present, the protection of SNS-based websites is based on manual discovery and self-configuration, but automatic clickjacking security detection cannot be realized.

Contents of the invention

The purpose of the present invention is to provide a click-jacking security detection method and device, so as to realize automatic security detection of click-jacking attacks on SNS websites.

On the one hand, an embodiment of the present invention provides a clickjacking security detection method, the method comprising:

Separate the button element in the webpage to be detected from the URL information of the webpage uniform resource locator;

Comparing the button element with the sensitive elements in the sensitive element database, if there is a sensitive element in the sensitive element database in the button element, then compare the URL information of the webpage to be detected with the URL information in the URL whitelist database list for comparison;

If the web page URL information of the web page to be detected is in the web site whitelist, the security detection of click hijacking is not performed; if the web page URL information of the web page to be detected is not in the web site white list, then the security detection of click hijacking is performed.

On the other hand, an embodiment of the present invention provides a clickjacking safety detection device, which includes:

The button element separation module is used to separate the button element in the webpage to be detected from the URL information of the webpage uniform resource locator;

A sensitive element storage module, used to store sensitive elements;

The URL whitelist storage module is used to store the URL whitelist;

The first comparison module is used to compare the button element with the sensitive element in the sensitive element storage module;

The second comparison module is used to compare the webpage URL information of the webpage to be detected with the URL whitelist if there is a sensitive element in the sensitive element storage module in the button element;

Click hijacking safety detection module, be used for if the webpage URL information of described webpage to be detected is in described website white list, then do not carry out the safety detection of click hijacking; If the webpage URL information of webpage to be detected is not in website whitelist, then Perform security checks for clickjacking.

The above technical solution has the following beneficial effects: due to the adoption of technologies such as button element separation and URL whitelisting, the automatic detection of clickjacking vulnerabilities becomes controllable and sustainable iterations, thus greatly improving the detection speed and detection of clickjacking vulnerabilities. Accuracy, low detection cost, good detection effect.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

Fig. 1 is the flowchart of the clickjacking security detection method of the embodiment of the present invention;

FIG. 2 is a logic block diagram of a clickjacking safety detection device according to an embodiment of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

The present invention detects sensitive elements in the web pages of SNS websites (Social Networking Site, social network sites, whose main function is to establish online communities for a group of people with the same interests and activities, relatively well-known ones include FaceBook, Twitter, Weibo, etc.), Determine whether the security detection of click hijacking is needed, and then perform automatic click hijacking automatic detection by detecting whether the web page contains a corresponding safe HTTP response, and propose a corresponding method and device, which solves the automatic security of click hijacking attacks on SNS websites Detect problems.

The embodiment of the present invention provides a method and device for safety detection of click hijacking applied in SNS, so as to complete automatic safety detection of click hijacking of SNS websites.

FIG. 1 is a flowchart of a clickjacking security detection method according to an embodiment of the present invention. As shown in Figure 1, the clickjacking security detection method includes:

Step 102: separating the button elements in the webpage to be detected from the URL information of the webpage;

Step 104: compare the button element with the sensitive elements in the sensitive element database, if there is no sensitive element in the button element, then do not perform the security detection of click hijacking, that is, determine that there is no click hijacking vulnerability in the webpage; if the If there is a sensitive element in the sensitive element database in the button element, compare the URL information of the webpage to be detected with the URL whitelist in the URL whitelist database;

Preferably, the sensitive element includes button element codes capable of causing clickjacking attacks.

Preferably, the URL whitelist may include URL information of URLs that are allowed to be embedded in other webpages according to business requirements.

Step 106: If the webpage URL information of the webpage to be detected is in the above-mentioned URL whitelist, then the security detection of clickjacking is not performed; if the webpage URL information of the webpage to be detected is not in the URL whitelist, then the security detection of clickjacking is performed.

Optionally, step 101 may be included before step 102: acquiring the webpage to be detected, and dynamically parsing the webpage to be detected. The purpose of dynamic parsing is to parse out the javascript language, and what is obtained is the DOM tree generated after the html and javascript languages are run. Under normal circumstances, the DOM tree generated by javascript cannot be found through the source code, so dynamic parsing is required. In subsequent corresponding steps, all the button elements in the dynamically parsed webpage and the URL information of the webpage to be detected can be separated (extracted).

Preferably, the specific processing procedure of performing the security detection of click hijacking in the above step 106 may include: sending an HTTP request of the webpage to be detected to the server where the URL information is located, detecting whether the returned HTTP header contains the X-FRAME-OPTIONS header, If it does not contain the X-FRAME-OPTIONS header, it is determined that the webpage to be detected has a clickjacking vulnerability; otherwise, it is determined that the webpage to be detected has been defended against clickjacking, and the webpage does not have a clickjacking vulnerability.

X-FRAME-OPTIONS is an http header proposed by Microsoft, which is specially used to defend against clickjacking attacks using iframe nesting.

And it can be well supported in versions above IE8, Firefox3.6, and Chrome4.

This header has three values:

DENY //deny any domain loading

SAMEORIGIN //Allow loading under the same origin domain

ALLOW-FROM //You can define the page address that allows the frame to load

The program adds the response header to the HTTP response packet, and the browser will determine how to load the iframe page by judging the response header when loading the page, thus achieving the effect of defending against click hijacking attacks.

The clickjacking security detection method applied to SNS adopts button element separation, URL whitelist and other technologies to make the automatic detection of clickjacking vulnerabilities controllable and sustainable iteration, thus greatly improving the detection of clickjacking vulnerabilities The invention has the advantages of speed and detection accuracy, low detection cost and good detection effect.

Since there are many web pages that need to be detected, there are also many button elements on the web page, but the requests corresponding to many button elements are the same, and the requests that fall to the back end are all consistent. In the embodiment of the present invention, the request corresponding to the button element is compared with the button element in the above-mentioned first comparison module, so that no matter how many buttons there are during detection, as long as the request corresponding to the backend conforms to the sensitive element, it is deemed necessary Perform security detection of clickjacking. In this way, the actual calculation amount is much smaller, so the detection speed can be greatly improved.

One of the difficulties in automatic detection of clickjacking is that many buttons can be embedded in other web pages according to functional requirements. Functional requirements are ever-changing. Due to uncontrollable situations like this, the false positive rate of automatic detection of clickjacking vulnerabilities is very high, or even unavailable. Because the embodiment of the present invention adopts the white list of websites, uncontrollable factors caused by functional requirements are controlled in the white list, especially for SNS websites, where such requirements are single and highly controllable, so the detection accuracy is greatly improved.

According to the above method provided by the embodiment of the present invention, the embodiment of the present invention also provides a clickjacking security detection device. FIG. 2 is a functional block diagram of a clickjacking security detection device applied to a social network site SNS according to an embodiment of the present invention. As shown in Figure 2, the device includes:

The button element separation module 220 is used to separate the button element in the webpage to be detected from the webpage URL information;

The sensitive element storage module 230 is used to store sensitive elements; the sensitive elements stored in the sensitive element storage module 230 include button element codes that may or can cause click hijacking attacks; typically, the sensitive element information can be "attention", "like" ", "publish", etc.

The URL whitelist storage module 240 is used to store the URL whitelist; the URL whitelist stored in the URL whitelist storage module 240 may include URL information of URLs that are allowed to be embedded in other webpages in business requirements;

The first comparison module 250 is used to compare the above-mentioned button element with the sensitive element in the sensitive element storage module 230, if there is no sensitive element in the button element, then the safety detection of click hijacking is not performed;

The second comparison module 260 is used to compare the webpage URL information of the webpage to be detected with the URL whitelist if there is a sensitive element in the sensitive element storage module 230 in the above-mentioned button element;

Click hijacking safety detection module 270, if the webpage URL information of this webpage to be detected is in the website white list, then do not execute the safety detection of click hijacking; If the webpage URL information of the webpage to be detected is not in the website whitelist, then perform click Security detection of hijacking.

Further, the device also includes: a web page dynamic analysis module 210, configured to acquire the web page to be detected, and send the web page to the button element separation module 220 after dynamic analysis.

Preferably, the clickjacking security detection module 270 can specifically be used to send the HTTP request of the webpage to be detected; detect whether the returned/responsive HTTP header contains the X-FRAME-OPTIONS header, if it does not contain the X-FRAME-OPTIONS header , it is determined that the webpage to be detected has a clickjacking vulnerability, otherwise, the webpage to be detected does not have a clickjacking vulnerability.

For the working process of the device, reference may be made to the foregoing method embodiments, and details are not repeated here.

The advantage of above-mentioned device is:

Due to the adoption of technologies such as button element separation and URL whitelist, the device makes the automatic detection of clickjacking vulnerabilities controllable and sustainable iteration, thus greatly improving the detection speed and accuracy of clickjacking vulnerabilities, and the detection cost is low , the beneficial effect of good detection effect.

Those skilled in the art can also understand that various illustrative logical blocks (illustrativelogical blocks), units, and steps listed in the embodiments of the present invention can be implemented by electronic hardware, computer software, or a combination of both. To clearly demonstrate the interchangeability of hardware and software, the various illustrative components, units and steps above have generally described their functions. Whether such functions are implemented by hardware or software depends on the specific application and overall system design requirements. Those skilled in the art may use various methods to implement the described functions for each specific application, but such implementation should not be understood as exceeding the protection scope of the embodiments of the present invention.

The specific embodiments described above have further described the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above descriptions are only specific embodiments of the present invention and are not intended to limit the scope of the present invention. Protection scope, within the spirit and principles of the present invention, any modification, equivalent replacement, improvement, etc., shall be included in the protection scope of the present invention.

Claims (10)

1. click and kidnap a safety detection method, it is characterized in that, described method comprises:

Button element in webpage to be detected is separated with webpage uniform resource position mark URL information;

Sensitive elements in described button element and sensitive elements database is compared, if there is the sensitive elements in sensitive elements database in described button element, then the network address white list in the webpage URL information of webpage to be detected and network address white list database is compared;

If the webpage URL information of described webpage to be detected is in described network address white list, then do not perform the safety detection clicked and kidnap; If the webpage URL information of webpage to be detected is not in network address white list, then perform the safety detection clicked and kidnap.

2. method according to claim 1, is characterized in that, described button element in webpage to be detected is separated with webpage URL information before, also comprise the steps:

Obtain webpage to be detected, dynamic analysis is carried out to described webpage to be detected.

3. method according to claim 1 and 2, is characterized in that, the described safety detection clicking abduction that performs comprises the steps:

Send the HTTP request of webpage to be detected;

Detect whether containing X-FRAME-OPTIONS head in the http header returned, if not containing X-FRAME-OPTIONS head, then judge that this webpage to be detected exists to click and kidnap leak, otherwise this webpage to be detected does not exist to click kidnaps leak.

4. method according to claim 1 and 2, is characterized in that, described sensitive elements comprises the button element code that can cause and click hijack attack.

5. method according to claim 1 and 2, is characterized in that, comprises in business demand the network address URL information allowing to be embedded by other webpages in described network address white list.

6. click and kidnap a safety detection device, it is characterized in that, comprising:

Button element separation module, for being separated the button element in webpage to be detected with webpage uniform resource position mark URL information;

Sensitive elements memory module, for storing sensitive elements;

Network address white list memory module, for storing network address white list;

First comparing module, for comparing the sensitive elements in described button element and sensitive elements memory module;

Second comparing module, if for there is the sensitive elements in sensitive elements memory module in described button element, then compared the webpage URL information of webpage to be detected and network address white list;

Click and kidnap safety detection module, if for the webpage URL information of described webpage to be detected in described network address white list, then do not perform the safety detection clicked and kidnap; If the webpage URL information of webpage to be detected is not in network address white list, then perform the safety detection clicked and kidnap.

7. device according to claim 6, is characterized in that, also comprises:

Webpage dynamic analysis module, for obtaining webpage to be detected, treats to detect after webpage carries out dynamic analysis sending to described button element separation module.

8. the device according to claim 6 or 7, is characterized in that, safety detection module is kidnapped in described click, specifically for sending the HTTP request of webpage to be detected; Detect whether containing X-FRAME-OPTIONS head in the http header returned, if not containing X-FRAME-OPTIONS head, then judge that this webpage to be detected exists to click and kidnap leak, otherwise this webpage to be detected does not exist to click kidnaps leak.

9. the device according to claim 6 or 7, is characterized in that, the sensitive elements stored in described sensitive elements memory module comprises the button element code that can cause and click hijack attack.

10. the device according to claim 6 or 7, is characterized in that, comprises in business demand the network address URL information allowing to be embedded by other webpages in described network address white list memory module in the network address white list stored.