{"id":141439,"date":"2025-08-24T11:11:56","date_gmt":"2025-08-24T09:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-brauzernye-dopolneniya-s-menedzherami-parolej-ispolzuyushhaya-klikdzheking"},"modified":"2026-01-24T17:56:45","modified_gmt":"2026-01-24T15:56:45","slug":"ataka-na-brauzernye-dopolneniya-s-menedzherami-parolej-ispolzuyushhaya-klikdzheking","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-na-brauzernye-dopolneniya-s-menedzherami-parolej-ispolzuyushhaya-klikdzheking","title":{"rendered":"\u00datok na prohl\u00ed\u017ee\u010dov\u00e9 dopl\u0148ky s ochranou hesel vyu\u017e\u00edvaj\u00edc\u00ed clickjacking.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Na konferenci DEF CON 33 byla p\u0159edstavena metoda \u00fatoku na prohl\u00ed\u017ee\u010dov\u00e9 dopl\u0148ky, kter\u00e9 vkl\u00e1daj\u00ed sv\u00e9 prvky u\u017eivatelsk\u00e9ho rozhran\u00ed do zobrazen\u00e9 str\u00e1nky. Aplikace \u00fatoku na dopl\u0148ky s mana\u017eery hesel m\u016f\u017ee v\u00e9st k \u00faniku informac\u00ed ulo\u017een\u00fdch v mana\u017eerech hesel, jako jsou autentiza\u010dn\u00ed \u00fadaje, \u00fadaje o kreditn\u00edch kart\u00e1ch, osobn\u00ed \u00fadaje a jednor\u00e1zov\u00e1 hesla pro dvoufaktorovou autentizaci. Probl\u00e9m se t\u00fdk\u00e1 v\u0161ech testovan\u00fdch mana\u017eer\u016f hesel, v\u010detn\u011b 1Password, Bitwarden, LastPass, KeePassXC-Browser, NordPass, ProtonPass a Keeper.    <\/p>\n<p>Metoda \u00fatoku je zalo\u017eena na tom, \u017ee prohl\u00ed\u017ee\u010dov\u00e9 dopl\u0148ky vkl\u00e1daj\u00ed dialog s po\u017eadavkem na automatick\u00e9 dopln\u011bn\u00ed hesla p\u0159\u00edmo na zobrazovanou str\u00e1nku, integruj\u00edce sv\u00e9 prvky do DOM (Document Object Model) t\u00e9to str\u00e1nky. Pokud \u00fato\u010dn\u00edk m\u00e1 mo\u017enost spustit sv\u016fj JavaScriptov\u00fd k\u00f3d na str\u00e1nce, nap\u0159\u00edklad zneu\u017eit\u00edm XSS zranitelnosti na webu, m\u016f\u017ee manipulovat se v\u0161emi prvky v DOM, v\u010detn\u011b vkl\u00e1dan\u00fdch prohl\u00ed\u017ee\u010dov\u00fdch dopl\u0148k\u016f.     <\/p>\n<p>Mezi dal\u0161\u00edmi mo\u017enostmi je mo\u017en\u00e9 u\u010dinit potvrzovac\u00ed dialog pr\u016fhledn\u00fdm a prostorov\u011b sladit tla\u010d\u00edtko v tomto dialogu s tla\u010d\u00edtkem vkl\u00e1dan\u00e9ho dialogu vytvo\u0159en\u00e9ho \u00fato\u010dn\u00edkem, kter\u00fd pob\u00edz\u00ed u\u017eivatele k kliknut\u00ed. Jako takov\u00e9 vkl\u00e1dan\u00e9 dialogy mohou b\u00fdt pou\u017eity fiktivn\u00ed \u017e\u00e1dosti o opr\u00e1vn\u011bn\u00ed k pr\u00e1ci s cookies, reklamn\u00ed bannery nebo formul\u00e1\u0159e s CAPTCHA. Um\u00edst\u011bn\u00edm vkl\u00e1dan\u00e9ho dialogu pod pr\u016fhledn\u00fd dialog mana\u017eera hesel a slad\u011bn\u00edm pozice tla\u010d\u00edtek na obrazovce lze dos\u00e1hnout toho, \u017ee kliknut\u00ed u\u017eivatele p\u0159ipadne na tla\u010d\u00edtko potvrzen\u00ed vypln\u011bn\u00ed autentiza\u010dn\u00edch \u00fadaj\u016f v dialogu mana\u017eera hesel, a\u010dkoli si u\u017eivatel bude myslet, \u017ee klikl nap\u0159\u00edklad na tla\u010d\u00edtko pro zav\u0159en\u00ed okna s reklamou.     <center><img decoding=\"async\" alt=\"\u00datok na prohl\u00ed\u017ee\u010dov\u00e9 dopl\u0148ky s ochranou hesel vyu\u017e\u00edvaj\u00edc\u00ed clickjacking.\" src=\"\/wp-content\/uploads\/2025\/08\/9df2f88789928b98278bb49ac8522c38.png\" style=\"display:block;margin: 0 auto;\" \/><\/center>    <\/p>\n<p>\u00datok spo\u010d\u00edv\u00e1 v n\u00e1sleduj\u00edc\u00edch kroc\u00edch:  <\/p>\n<ul>\n<li class=\"l\"> Vytvo\u0159en\u00ed vt\u00edrav\u00e9ho prvku na str\u00e1nce, kter\u00fd podn\u011bcuje ke kliknut\u00ed.\n<li class=\"l\"> P\u0159id\u00e1n\u00ed webov\u00e9ho formul\u00e1\u0159e pro p\u0159ihl\u00e1\u0161en\u00ed nebo vypln\u011bn\u00ed osobn\u00edch \u00fadaj\u016f na str\u00e1nku.\n<li class=\"l\"> Nastaven\u00ed pr\u016fhlednosti pro webov\u00fd formul\u00e1\u0159 (&#171;opacity: 0.001&#187; v CSS).\n<li class=\"l\"> Pou\u017eit\u00ed metody focus() pro nastaven\u00ed zaost\u0159en\u00ed na pole ve formul\u00e1\u0159i, co\u017e vede k aktivaci dialogu pro automatick\u00e9 dopln\u011bn\u00ed mana\u017eera hesel.\n<li class=\"l\"> Vyhled\u00e1n\u00ed zobrazen\u00e9ho dialogu mana\u017eera hesel v DOM a nastaven\u00ed jeho pr\u016fhlednosti.\n<li class=\"l\"> O\u010dek\u00e1v\u00e1n\u00ed kliknut\u00ed u\u017eivatele na z\u0159ejm\u00e9m ru\u0161iv\u00e9m prvku na str\u00e1nce, kter\u00fd p\u0159i spr\u00e1vn\u00e9m zkombinov\u00e1n\u00ed viditeln\u00fdch a neviditeln\u00fdch prvk\u016f povede k stisknut\u00ed tla\u010d\u00edtka v pr\u016fhledn\u00e9m dialogu a vypln\u011bn\u00ed pol\u00ed mana\u017eerem hesel.\n<li class=\"l\"> Vytahov\u00e1n\u00ed dat z vypln\u011bn\u00e9ho webov\u00e9ho formul\u00e1\u0159e a jejich odesl\u00e1n\u00ed na server \u00fato\u010dn\u00edka.  <\/ul>\n<p>Jeliko\u017e automatick\u00e9 vypl\u0148ov\u00e1n\u00ed parametr\u016f autentizace v mana\u017eeru hesel se aktivuje pouze pro weby, na nich\u017e byly tyto parametry ulo\u017eeny, pro realizaci \u00fatoku je nutn\u00e9 m\u00edt mo\u017enost spustit sv\u016fj JavaScriptov\u00fd k\u00f3d na napaden\u00e9m webu nebo v subdom\u00e9n\u011b. Pro \u00fatok je tedy zapot\u0159eb\u00ed bu\u010f z\u00edskat subdom\u00e9nu v t\u00e9\u017ee dom\u00e9n\u011b jako napaden\u00fd web, nebo naj\u00edt XSS zranitelnost na str\u00e1nce, kter\u00e1 umo\u017en\u00ed vlo\u017een\u00ed vlastn\u00edho k\u00f3du do v\u00fdstupn\u00edho obsahu u\u017eivateli.    <\/p>\n<p>Je zn\u00e1mo, \u017ee mnoz\u00ed u\u017eivatel\u00e9 pou\u017e\u00edvaj\u00ed jeden mana\u017eer hesel jak pro ukl\u00e1d\u00e1n\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f, tak pro generov\u00e1n\u00ed jednor\u00e1zov\u00fdch hesel pro dvoufaktorovou autentizaci, co\u017e umo\u017e\u0148uje vyu\u017eit\u00ed tohoto \u00fato\u010dn\u00e9ho metody p\u0159i automatick\u00e9m vypln\u011bn\u00ed jednor\u00e1zov\u00fdch hesel. Jako p\u0159\u00edklad byla demonstrov\u00e1na \u00fatok na web issuetracker.google.com, obsahuj\u00edc\u00ed XSS zranitelnost. Pro z\u00edsk\u00e1n\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f a k\u00f3du pro dvoufaktorovou autentizaci sta\u010d\u00ed u\u017eivateli poslat odkaz, kter\u00fd vyu\u017e\u00edv\u00e1 XSS zranitelnost, a zajistit t\u0159i kliknut\u00ed prost\u0159ednictv\u00edm nahrazen\u00ed fiktivn\u00edmi ru\u0161iv\u00fdmi dotazy (povolen\u00ed zpracov\u00e1n\u00ed cookie, povolen\u00ed personalizace a souhlas s politikou ochrany soukrom\u00ed).        <center>  <video controls=\"\" style=\"width: 700px; height: 400px; max-width:100%\"><source src=\"https:\/\/marektoth.com\/video\/dom-extension-clickjacking-demo7.mp4\" type=\"video\/mp4\"><\/video>  <\/center>    <\/p>\n<p>Krom\u011b webov\u00fdch str\u00e1nek s XSS zranitelnostmi m\u016f\u017ee b\u00fdt \u00fatok zam\u011b\u0159en na slu\u017eby, kter\u00e9 nab\u00edzej\u00ed subdom\u00e9ny ka\u017ed\u00e9mu z\u00e1jemci \u2014 v\u011bt\u0161ina spr\u00e1vc\u016f hesel ve v\u00fdchoz\u00edm nastaven\u00ed prov\u00e1d\u00ed automatick\u00e9 vypln\u011bn\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f nejen pro hlavn\u00ed dom\u00e9nu, ale i pro subdom\u00e9ny.      <\/p>\n<p>\u00datok m\u016f\u017ee b\u00fdt tak\u00e9 pou\u017eit k ur\u010den\u00ed ulo\u017een\u00fdch osobn\u00edch \u00fadaj\u016f u\u017eivatele a \u00fadaj\u016f o kreditn\u00edch kart\u00e1ch ve spr\u00e1vci hesel. P\u0159itom k \u00faniku t\u011bchto \u00fadaj\u016f nen\u00ed pot\u0159eba vykon\u00e1vat JavaScriptov\u00fd k\u00f3d v kontextu ciz\u00edho webu, sta\u010d\u00ed p\u0159il\u00e1kat ob\u011b\u0165 na str\u00e1nku na webu \u00fato\u010dn\u00edka \u2014 v p\u0159\u00edpad\u011b osobn\u00edch \u00fadaj\u016f se vypl\u0148uj\u00ed webov\u00e9 formul\u00e1\u0159e na z\u00e1klad\u011b jejich typu (adresa, \u010d\u00edslo kreditn\u00ed karty, jm\u00e9no), bez vazby na <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/domain\/\"   title=\"domain\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"1242\">domain<\/a>. Nejnebezpe\u010dn\u011bj\u0161\u00ed je \u00fanik \u00fadaj\u016f o kreditn\u00edch kart\u00e1ch, proto\u017ee spr\u00e1vci hesel dopl\u0148uj\u00ed nejen \u010d\u00edslo karty, ale tak\u00e9 datum vypr\u0161en\u00ed platnosti a kontroln\u00ed k\u00f3d.    <\/p>\n<p>V\u00fdzkumn\u00edk, kter\u00fd probl\u00e9m odhalil, otestoval 11 roz\u0161\u00ed\u0159en\u00ed prohl\u00ed\u017ee\u010de se spr\u00e1vci hesel, kter\u00e1 za spole\u010dn\u011b \u010din\u00ed 39,7 milionu aktivn\u00edch instalac\u00ed, a v\u0161echny byly vystaveny tomuto typu \u00fatok\u016f. N\u011bkte\u0159\u00ed v\u00fdrobci vydali aktualizace (NordPass 5.13.24, ProtonPass 1.31.6, RoboForm 9.7.6, Dashlane 6.2531.1, Keeper 17.2.0, Enpass 6.11.6, Bitwarden 2025.8.1), v nich\u017e se pokusili obch\u00e1zkov\u00fdm zp\u016fsobem zablokovat prov\u00e1d\u011bn\u00ed \u00fatoku. Jin\u00e1 roz\u0161\u00ed\u0159en\u00ed (KeePassXC-Browser, 1Password, iCloud Passwords, Enpass, LastPass, LogMeOnce) zat\u00edm z\u016fst\u00e1vaj\u00ed neopravena. Pro ov\u011b\u0159en\u00ed projev\u016f zranitelnosti v r\u016fzn\u00fdch spr\u00e1vc\u00edch hesel byl zve\u0159ejn\u011bn soubor testovac\u00edch str\u00e1nek.  <center><img decoding=\"async\" alt=\"\u00datok na prohl\u00ed\u017ee\u010dov\u00e9 dopl\u0148ky s ochranou hesel vyu\u017e\u00edvaj\u00edc\u00ed clickjacking.\" src=\"\/wp-content\/uploads\/2025\/08\/abdf3d7673c340401721d85f7e7856c6.png\" style=\"display:block;margin: 0 auto;\" \/><\/center>    <center><img decoding=\"async\" alt=\"\u00datok na prohl\u00ed\u017ee\u010dov\u00e9 dopl\u0148ky s ochranou hesel vyu\u017e\u00edvaj\u00edc\u00ed clickjacking.\" src=\"\/wp-content\/uploads\/2025\/08\/3a9691b4707e6d5bfe9a2604868c896a.png\" style=\"display:block;margin: 0 auto;\" \/><\/center>    <\/p>\n<p>Postoj v\u00fdvoj\u00e1\u0159\u016f 1Password, kte\u0159\u00ed nevydali opravu, spo\u010d\u00edv\u00e1 v tom, \u017ee zranitelnost je z\u00e1kladn\u00ed a nen\u00ed p\u0159\u00edmo spojena s konkr\u00e9tn\u00edm prohl\u00ed\u017ee\u010dov\u00fdm roz\u0161\u00ed\u0159en\u00edm, tak\u017ee pokusy o jej\u00ed odstran\u011bn\u00ed na stran\u011b roz\u0161\u00ed\u0159en\u00ed pouze blokuj\u00ed jednotliv\u00e9 vektory \u00fatoku, ale neodstra\u0148uj\u00ed samotn\u00fd probl\u00e9m, kter\u00fd je pot\u0159eba \u0159e\u0161it v prohl\u00ed\u017ee\u010di nebo \u017e\u00e1dost\u00ed o samostatn\u00e9 potvrzen\u00ed p\u0159ed automatick\u00fdm vypln\u011bn\u00edm pol\u00ed. Bylo zm\u00edn\u011bno, \u017ee v 1Password ji\u017e podporuj\u00ed zobrazen\u00ed potvrzovac\u00edho po\u017eadavku p\u0159ed automatick\u00fdm vypln\u011bn\u00edm \u00fadaj\u016f o platb\u00e1ch a v dal\u0161\u00edm vyd\u00e1n\u00ed bude p\u0159id\u00e1na mo\u017enost pro zobrazen\u00ed takov\u00e9ho po\u017eadavku pro v\u0161echny typy automaticky vypl\u0148ovan\u00fdch dat (kv\u016fli sn\u00ed\u017een\u00ed u\u017eivatelsk\u00e9ho komfortu nebude tato mo\u017enost ve v\u00fdchoz\u00edm nastaven\u00ed aktivov\u00e1na).         <\/p>\n<p>Mezi metodami ochrany, kter\u00e9 uv\u00e1d\u00ed autor v\u00fdzkumu, se zmi\u0148uje sledov\u00e1n\u00ed zm\u011bn styl\u016f prvk\u016f vkl\u00e1dan\u00fdch na str\u00e1nku pomoc\u00ed API MutationObserver, blokov\u00e1n\u00ed zm\u011bn prost\u0159ednictv\u00edm Shadow DOM v re\u017eimu &#171;closed&#187;, monitorov\u00e1n\u00ed nastaven\u00ed pr\u016fhlednosti prvk\u016f, vyu\u017e\u00edv\u00e1n\u00ed API Popover pro zobrazen\u00ed dialogov\u00fdch oken, kontrola p\u0159ekr\u00fdv\u00e1n\u00ed vrstev a do\u010dasn\u00e9 vypnut\u00ed zpracov\u00e1n\u00ed ud\u00e1lost\u00ed ukazatele (pointer-events:none) ve v\u0161ech plovouc\u00edch prvc\u00edch b\u011bhem zobrazen\u00ed dialogu spr\u00e1vce hesla. P\u0159itom pro \u00fapln\u00e9 zablokov\u00e1n\u00ed popsan\u00e9 t\u0159\u00eddy <a href=\"https:\/\/prohoster.info\/cs\/zhashchita-ot-ddos\/\"  data-wpil-monitor-id=\"6\">se doporu\u010duje na \u00farovni prohl\u00ed\u017ee\u010de implementovat zvl\u00e1\u0161tn\u00ed API pro ochranu<\/a> proti clickjacking.    <\/p>\n<p>Jako univerz\u00e1ln\u00ed metoda ochrany se u\u017eivatel\u016fm prohl\u00ed\u017ee\u010d\u016f zalo\u017een\u00fdch na enginu Chromium doporu\u010duje povolit re\u017eim potvrzen\u00ed p\u0159\u00edstupu dopl\u0148ku k webu (Nastaven\u00ed dopl\u0148ku &#8594; &#171;site access&#187; &#8594; &#171;on click&#187;), kdy dopln\u011bk z\u00edsk\u00e1 p\u0159\u00edstup k webov\u00e9 str\u00e1nce pouze po kliknut\u00ed na ikonu v prav\u00e9 \u010d\u00e1sti adresn\u00edho \u0159\u00e1dku. Jako alternativn\u00ed ochrann\u00e9 opat\u0159en\u00ed je tak\u00e9 zm\u00edn\u011bno zak\u00e1z\u00e1n\u00ed automatick\u00e9ho vypl\u0148ov\u00e1n\u00ed formul\u00e1\u0159\u016f a manu\u00e1ln\u00ed kop\u00edrov\u00e1n\u00ed hesel p\u0159es schr\u00e1nku, ale v tomto p\u0159\u00edpad\u011b vznik\u00e1 probl\u00e9m s \u00fanikem \u00fadaj\u016f z ve\u0159ejn\u00e9 schr\u00e1nky a nebezpe\u010d\u00ed nepov\u0161imnut\u00ed pokusu o phishing.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=63754\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON 33 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043d\u044b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435 \u0441\u0432\u043e\u0438 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u044b \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 \u0432 \u043f\u0440\u043e\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u043c\u0443\u044e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443. \u041f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0430\u0442\u0430\u043a\u0438 \u043a \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f\u043c \u0441 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430\u043c\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0445\u0440\u0430\u043d\u0438\u043c\u043e\u0439 \u0432 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430\u0445 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0442\u0430\u043a\u043e\u0439 \u043a\u0430\u043a \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u043a\u0440\u0435\u0434\u0438\u0442\u043d\u044b\u0445 \u043a\u0430\u0440\u0442, \u043f\u0435\u0440\u0441\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438 \u043e\u0434\u043d\u043e\u0440\u0430\u0437\u043e\u0432\u044b\u0435 \u043f\u0430\u0440\u043e\u043b\u0438 \u0434\u043b\u044f \u0434\u0432\u0443\u0445\u0444\u0430\u043a\u0442\u043e\u0440\u043d\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u044b \u043f\u0430\u0440\u043e\u043b\u0435\u0439, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":141440,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-141439","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON 33 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043d\u044b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435 \u0441\u0432\u043e\u0438 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u044b \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 \u0432 \u043f\u0440\u043e\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u043c\u0443\u044e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-na-brauzernye-dopolneniya-s-menedzherami-parolej-ispolzuyushhaya-klikdzheking\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043d\u044b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430\u043c\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0430\u044f \u043a\u043b\u0438\u043a\u0434\u0436\u0435\u043a\u0438\u043d\u0433 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON 33 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043d\u044b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435 \u0441\u0432\u043e\u0438 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u044b \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 \u0432 \u043f\u0440\u043e\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u043c\u0443\u044e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-na-brauzernye-dopolneniya-s-menedzherami-parolej-ispolzuyushhaya-klikdzheking\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-08-24T09:11:59+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-01-24T15:56:45+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00datok na prohl\u00ed\u017ee\u010dov\u00e1 roz\u0161\u00ed\u0159en\u00ed spr\u00e1vc\u016f hesel, vyu\u017e\u00edvaj\u00edc\u00ed clickjacking | ProHoster","description":"Na konferenci DEF CON 33 byla p\u0159edstavena metoda \u00fatoku na prohl\u00ed\u017ee\u010dov\u00e1 roz\u0161\u00ed\u0159en\u00ed, kter\u00e1 p\u0159id\u00e1vaj\u00ed sv\u00e9 u\u017eivatelsk\u00e9 prvky na zobrazenou str\u00e1nku.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-na-brauzernye-dopolneniya-s-menedzherami-parolej-ispolzuyushhaya-klikdzheking","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043d\u044b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430\u043c\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0430\u044f \u043a\u043b\u0438\u043a\u0434\u0436\u0435\u043a\u0438\u043d\u0433 | ProHoster","og:description":"\u041d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEF CON 33 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043d\u044b\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f, \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435 \u0441\u0432\u043e\u0438 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u044b \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 \u0432 \u043f\u0440\u043e\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u043c\u0443\u044e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-na-brauzernye-dopolneniya-s-menedzherami-parolej-ispolzuyushhaya-klikdzheking","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-08-24T09:11:59+00:00","article:modified_time":"2026-01-24T15:56:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"141439","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 15:55:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 14:25:19","updated":"2026-02-09 15:55:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/141439","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=141439"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/141439\/revisions"}],"predecessor-version":[{"id":158486,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/141439\/revisions\/158486"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/141440"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=141439"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=141439"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=141439"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}