Is clickjacking illegal?

I cant seem to find any solid information and or facts stating that clickjacking is illegal. I have some sweet methods using a clickjacking script + facebook, just want to make sure its not illegal.

A) Its breaches the TOS of any/all ad networks
B) It is straight up fraud which is illegal

-aReJay

what do you think...

Guys I don't think OP is talking about defrauding ad networks, but asking about this for social networks...

Darkone I have never really head of any criminal or civil cases involing it, but there's no doubt in my mind that it could easily fall under the Computer Fraud and Abuse Act. I have heard of people getting c&d for doing this on fb, and I'm sure at some point we will see some civil action from them as well..

It's one thing to abuse the privilages you are given as a developer (not following tos to the letter when it comes to using publish_stream for example), but clickjacking is a much more direct and blatent breach of computer 'authorization'.. It is a whole other can of worms so be careful

It is making them to click at any cost...So it is not fair..Simple if you visit a site and it gives you a click to visit a Hot babe then tell me..will you click!!!lols..

Any new thoughts about that? I mean, is it legal or not? Since there is loads of pages clickjacking facebook users ...

likes have no monetary value, so its not fraud, and not illegal.

I don't think there's been a case involving it specifically, but I think if it went to court you'd probably be convicted. You're using a browser vulnerability to execute some code you shouldn't have the permissions to execute. Not only that, but you're executing code that posts an unauthorized message that appears to come from the victim.

The law is vague on purpose and if they do catch you, the evidence is always stacked way against you. It's basically up to the court to agree that you're a dick for doing it and you're stuck with it. Here's the law in NJ:

2A:38A-3. Computer-related offenses; compensatory and punitive damages; costs and expenses
A person or enterprise damaged in business or property as a result of any of the following actions may sue the actor therefor in the Superior Court and may recover compensatory and punitive damages and the cost of the suit including a reasonable attorney's fee, costs of investigation and litigation:

a. The purposeful or knowing, and unauthorized altering, damaging, taking or destruction of any data, data base, computer program, computer software or computer equipment existing internally or externally to a computer, computer system or computer network;

b. The purposeful or knowing, and unauthorized altering, damaging, taking or destroying of a computer, computer system or computer network;

c. The purposeful or knowing, and unauthorized accessing or attempt to access any computer, computer system or computer network;

d. The purposeful or knowing, and unauthorized altering, accessing, tampering with, obtaining, intercepting, damaging or destroying of a financial instrument; or

e. The purposeful or knowing accessing and reckless altering, damaging, destroying or obtaining of any data, data base, computer, computer program, computer software, computer equipment, computer system or computer network.

L.1984, c. 182, s. 3.

Click to expand...

What about if you play with layers? I mean, almost no JavaScript, you just put on facebook like button and mask it like something else, I'm not even sure if that's clickjacking but I saw that on one page...

safex said:

It is making them to click at any cost...So it is not fair..Simple if you visit a site and it gives you a click to visit a Hot babe then tell me..will you click!!!lols..

Click to expand...

Your not 100% correct, i mean yes its forces them to click but its all happened in my site. i mean when they get to a clickjacked paged they usually get to a picture and when they click on it then they will get clickjacked but until then its their choice if to click or not.

For me usually when i get to a site with a picture "click here to enter" etc etc, its always feel fishy for me so basically all the clickjack process happened on your site.

now you can see it this way, each site has it own terms its right that the clickjack script is against Google TOS and almost any other ppc/ad network but its not against your site terms, meaning lets say you inviting people over to your house so i guess you decide the terms of entering your house because you set you set the rules, so in this case if people will decide to enter you house one of the terms is that they can be clickjacked of course you can't use that as an excuse to tell the adsense team or any other network your dealing with but still i see it that in the worst case youll get banned and wont get paid which is pretty worst to me.

Im no recommending starting using clickjack script for adsense ppc networks,
but i did heard somewhere that it works pretty nice with Facebook like buttons specially if its social network and friendly traffic so you wont have to fake referrer etc etc.

also since its facebook like buttons the and you using Facebook traffic you can have higher success rate, because when you clickjack people for facebook likes when they get clickjacked they have to be logged to facebook when they clicked so they will hit the like automatically instead of getting to a login page which in most of the case they will quit the process since they didn't tried to get to this page they got clickjacked

Cheers

It does work really with Facebook, but I'm sure they'll fix it soon. It breaks my rule of the not leaving an easy paper trail though. If Facebook wants to make an example out of someone, they can just subpoena the affiliate program, web host, whoever. You're linked directly to a pretty serious crime.

Like back when I was mailing, I'd phish tons of accounts for various purposes, but I'd never ever use them to mail even that was a way to make huge money. Some guys I knew did, and got busted.

dannyhw said:

...
The law is vague on purpose and if they do catch you, the evidence is always stacked way against you. It's basically up to the court to agree that you're a dick for doing it and you're stuck with it.
...

Click to expand...

Great quote. Laws are never black&white, they are almost always darkish. For example popups actually are screen space jacking and ARE exploiting browser weaknesses. Most browsers have popup protection. When a user enables it, he or she explicitly signals his desire to not want popups. Yet no court cares. It'd be interesting to try and connect click jacking with freedom of speech

What about likejacking? With no moving like buttons and stuff like that, only masked like button...

How (il)legal is that?

I've done likejacking before, then norton and mcafee detect my site as clickjacking infect, so I remove it immediately.

Well I'm not talking about that code. No crazy JS just like jacking...

i believe it'll prob violate someone's TOS for sure.

If Samy got arrested for XSS, which essentially did the same thing that clickjacking does (in his case - adding friends), yes, it's illegal. They'll find a way to prosecute you.