DEF CON 33 - Browser Extension Clickjacking: One Click and Your Credit Card Is Stolen - Marek Tóth

Clickjacking is not dead; this presentation demonstrates how browser extensions, specifically password managers, can be exploited via iframe and DOM manipulation to steal credentials and personal data with minimal user interaction 0:00-0:42 11:36-12:03.

Key Takeaways:
• Iframe-based clickjacking exploits misconfigurations in the extension manifest (specifically web_accessible_resources) to load the password manager interface on a malicious domain, resulting in unauthorized data sharing after a few clicks 11:36-12:03.
• DOM-based attacks manipulate the visibility or layering of password manager interfaces, causing users to inadvertently click autofill menus while accepting cookie banners or captchas 14:48-15:46.
• The researcher tested nine popular password managers and found that the vast majority were vulnerable to stealing login credentials, 2FA codes, and credit card data through this technique 31:14-31:26.
• Because password managers autofill across subdomains by default, any Cross-Site Scripting (XSS) vulnerability on a trusted site can trigger these attacks to compromise user credentials 35:36-36:11.
• Four out of seven tested FIDO2 certified passkey solutions were vulnerable to hijacking due to improper session binding, allowing attackers to gain persistent access with a single click 41:32-41:45.

Users can mitigate these risks by disabling manual autofill or restricting extension site access, while developers should implement CSS and DOM protections like mutation observers to detect UI manipulation.

Sources:

• 0:00-0:42 Speaker introduction and hypothesis that clickjacking is not dead.
• 11:36-12:03 Demonstration of iframe-based clickjacking using North Pass.
• 14:48-15:46 Technical explanation of DOM-based clickjacking methods.
• 31:14-31:26(https://www.youtube.com/watc