UPDATE 12:56 pm Feb 12, 2009: The “Don’t Click” thing going on at Twitter this very minute is exactly the exploit described in this post. Original post follows…
I came across this interesting post last week, and thought I’d do a screencast of it.
I just find it fascinating what sneaky stuff people can do on the Interwebs, and by studying them, we become a little smarter, and a little less likely to fall victim to these tricks.
Plus I was looking for a good subject for a screencast.
Clickjacking is a technique where a web developer can trick you into clicking on something that you don’t mean to click on. In this example, it tricks someone into updating their twitter account without their knowledge.
Check out the video (done with the totally amazing Screenflow software), and read up on it on James Podolsey’s blog.
If you use firefox and want to block this sort of thing, grab the Noscript addon.
Twitter Clickjacking from Scott Jangro on Vimeo.
