Android系统点击劫持攻防技术研究

Study of Clickjacking Technology on Android

点击劫持攻击是近年来出现的一种新型Web攻击手段,使用多层透明或不透明的界面欺骗用户点击实现攻击。随着移动互联网的发展和普及,此类攻击逐渐在移动平台中出现,并具有更强的隐蔽性和危害性。文中在总结传统Web点击劫持攻击方法的基础上,深入研究了Android系统中点击劫持攻击的原理,重点分析了基于通知视图(Toast)的点击劫持攻击(Tapjacking)与基于网页视图(Web View)的点击劫持攻击两种攻击方式的实现方法。由于X-FRAME-OPTIONS与Frame Busting代码等传统Web点击劫持防御方法存在一定局限性,无法有效地防御Android系统点击劫持攻击,文中研究了几种针对Android系统点击劫持攻击的防御手段,能在一定程度上减缓该类攻击的危害。

Clickjacking is a new type of Web attack in recent years. It uses transparent or overlapping interfaces spoofing user clicks. With the development and popularization of Mobile Internet, such attack appears on the mobile platforms, and is more harmful and indetect- able. In this paper, based on summarizing the traditional Clickjacking attack on the web, research the theories in depth on Android, mainly analyze Tapjacking and WebView-based Clickjacking. Because the traditional Clickjacking has certain limitations such as X-FRAME- OPTIONS and Frame Busting code, cannot effectively defense Android Clickjacking attack, in this paper study several defense way a- gainst Clickjacking, which can slow down the dangers of this kind of attack to a certain extent.