Like this

Uncategorized

Facebook is probably going to be mad about this, but whatever. Clickjacking the Facebook Like Button is so simple that anyone could figure it out within a few minutes with some really basic JS. I put together a really basic example, similar to what the major clickjacking scam this weekend was doing. I used jQuery just because I was too lazy to remove it from my default page template, but it would be very simple to do it without as well. Example is up here.

Basically all they do is set the Like Buttons iframe opacity to 0 and positioning to absolute, then track mouse movements, keeping the hidden iframe underneath your cursor. With a little tweaking of positioning you get the actual button part of the iframe always under the cursor, so any clicks register as a click on there.

The only one disadvantage is that if people click more than once, it will trigger an unlike. You could easily get around this one too by setting a cookie / localStorage after the first click.

More information in this post on Mashable about what the clickjacking scam was this holiday weekend.

P.S. I put the example on a domain I don’t use just incase facebook decides to block it or something

5 Comments

5 Responses

  1. [...] her STATUS MESSAGE”, and many others. Zach Allia, of LikeButton.me has written up a guide to how this clickjacking attack is taking place. Facebook has been the victim of numerous security attacks over the past couple weekends. While [...]

  2. Kenton  •  June 1, 2010 @8:01 am

    I find it humorous that you have a Facebook like button at the bottom of this post. Good to see no one has actually clicked it.

  3. paula  •  June 1, 2010 @11:11 am

    Thanks for this explaination. Does this mean that savvy techs can develop aps that look and fee like “like buttons” in many ways? How can I protect myself? Not super savvy myself, but trying to learn a lot the last two months.

  4. Mike  •  June 2, 2010 @7:09 am

    I know absolutely nothing about javascript, HTML or anything like that. But I am a user who pays attention. When investigating these crazy pages, I noticed that my cursor was flashing from the pointer to the pointing hand (no technical words here) showing that a link was always under the cursor. I then used Chrome’s ‘view source’ thing and found the word ‘iframe’ which was all I needed to know. It’s clever, but people don’t know it’s happened because what they have liked never appears on THEIR newsfeeds. It’s a stealth attack.

  5. Dinosaur Gifts  •  August 5, 2010 @7:56 am

    No kidding. no one will click on this facebook button. lol

Leave a Reply

Allowed tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

    1. September 4th

      1. Created Xploding Plastix Radio.

        6:15am via Pandora

      2. @krrysstall I wanna be there so badly to take care of you! [zachallia]

        2:38pm via Twitter

    2. September 3rd

      1. @lilylinqs WE JUST FIGURED IT OUT BEFORE YOU REPLIED!!!!! soooo amazing! thank you [zachallia]

        10:41pm via Twitter

      2. who is L? we love you, but you have us stumped! [zachallia]

        10:38pm via Twitter

    3. September 2nd

      1. @montoya_c dig it. [zachallia]

        8:57pm via Twitter

    4. September 1st

      1. Purchased Doodle Buddy - Pinger, Inc..

        4:28am via iTunes

      2. iTunes 10 now says coming soon on apple site.. [zachallia]

        7:06pm via Twitter

      3. RT @shanev: Coldplay? Ugh. Turning off keynote [zachallia]

        6:51pm via Twitter

      4. i am SO pumped about ping [zachallia]

        5:42pm via Twitter

      5. my live broadcast just went back to the beginning [zachallia]

        5:33pm via Twitter

      6. @randomslagathor that's what she said [zachallia]

        5:30pm via Twitter

      7. RT @krrysstall: apple event, lunch, more unpacking, gloucester for @petelindberg. good day. [zachallia]

        5:15pm via Twitter

    5. August 30th

      1. Purchased I'm Having Fun Now - Jenny and Johnny.

        6:46am via iTunes

      2. @Rosenthallll stop in Boston when you are back [zachallia]

        2:44am via Twitter

      3. @mg I wouldn't take drum lessons... Watch them on YouTube and just start playing along with songs with headphones on [zachallia]

        2:43am via Twitter

      4. my wife makes the best dinners. @krrysstall [zachallia]

        2:42am via Twitter

      5. @jeffsoto so so good [zachallia]

        2:41am via Twitter

      6. the @fludapp app is so much better looking than @pulsepad... too bad i don't like news [zachallia]

        6:18pm via Twitter

    6. August 27th

      1. Couple deep breaths... Everything is gonna be alright. [zachallia]

        11:41pm via Twitter

      2. Moved so much stuff today, great teamwork.... Of course forgot the only stuff I was required to bring though... So stressed gonna puke [zachallia]

        11:36pm via Twitter

      3. @jktweet omg I can't wait to see the pro pics [zachallia]

        4:10pm via Twitter

      4. Purchased Comcast mobile App - Comcast Cable Communications.

        3:45pm via iTunes

      5. RT @krrysstall: I better be done moving in time to take a shower at the condo for emilys party. [zachallia]

        2:43pm via Twitter

    7. August 26th

      1. Purchased Gilt on the Go - Gilt Groupe.

        6:14pm via iTunes

    8. August 25th

      1. I currently have 5 extra invites to the new Digg! http://digg.com/login/bb84b9422c27cc6dd0a7a4f127b90adaa [zachallia]

        9:20pm via Twitter

      2. @ErnNicole @krrysstall she can't... Our scanner is broken [zachallia]

        8:25pm via Twitter

      3. i wish US currency looked this awesome: http://bit.ly/9sssmW [zachallia]

        3:59pm via Twitter

      4. need more pictures of people cuddling kittens, kittens cuddling kittens, etc.. for cuddle.me [zachallia]

        3:57pm via Twitter

    9. August 24th

      1. @beachpizza i'm already starting to teach him the command "pee on kelseys new shoes" [zachallia]

        1:35am via Twitter

      2. RT @krrysstall: Little Ned! http://yfrog.com/ms18gzrj [zachallia]

        1:29am via Twitter

      3. @beachpizza i'll call him nedward [zachallia]

        1:29am via Twitter

      4. ned [zachallia]

        1:23am via Twitter

      5. @bitchinmona yes he is! [zachallia]

        1:20am via Twitter

      6. need a name for new male puppy... http://twitpic.com/2hwa6h [zachallia]

        12:49am via Twitter

      7. i need pictures of people cuddling cats, send me some [zachallia]

        12:06am via Twitter

      8. tuesday boozeday [zachallia]

        2:08pm via Twitter

      9. @Joey_Rozmus it's definitely better, but only if you don't call it autumn [zachallia]

        1:41pm via Twitter

    10. August 23rd

      1. @slate thanks! [zachallia]

        3:02pm via Twitter

      2. mondays aren't as bad when you don't have anything to do [zachallia]

        3:02pm via Twitter

    11. August 22nd

      1. @slate .. give likebutton.me a shout on twitter! [zachallia]

        6:29pm via Twitter

      2. Can't wait to get back home to my wife and eat Chinese food [zachallia]

        4:35pm via Twitter

    12. August 21st

      1. @caitlinemery yay iphone! [zachallia]

        10:28pm via Twitter

      2. @shervin @foursquare you don't use your feet in dodgeball!! Kickball you mean??? [zachallia]

        7:00pm via Twitter

      3. Lower depths has great brunch [zachallia]

        5:54pm via Twitter

      4. @MsQueenn thanks queen!! [zachallia]

        5:53pm via Twitter

      5. also, a wedding slideshow of highlights from the photographer here: http://bit.ly/d7qqBi [zachallia]

        2:35pm via Twitter

      6. some highlights from the wedding photographer on his blog, leave comments!!! http://bit.ly/cFLwqt [zachallia]

        2:34pm via Twitter

    13. August 20th

      1. RT @jalter: It *might* be a bad sign when one of the sub-headers on your site is "Comment/Complaint" #Delta [zachallia]

        1:21am via Twitter

      2. @krrysstall I miss you more!!! [zachallia]

        7:12pm via Twitter

      3. @caitlinemery just watch my Facebook places checkins [zachallia]

        5:54pm via Twitter

      Upstream

      Powered by Lifestream.



    • About Zach Allia

      Boston native, OG facebook platform developer (Free Gifts), OG iPhone developer (Tap Tap Revenge), exec producer, love javascript, dinosaurs, cats, and burritos