Man-in-the-browser




Man-in-the-browser (MITB, MitB, MIB, MiB), a form of Internet threat related to man-in-the-middle (MITM), is a proxy Trojan horse[1] that infects a web browser by taking advantage of vulnerabilities in browser security to modify web pages, modify transaction content or insert additional transactions, all in a completely covert fashion invisible to both the user and host web application. A MitB attack will be successful irrespective of whether security mechanisms such as SSL/PKI and/or two or three-factor Authentication solutions are in place. A MitB attack may be countered by using out-of-band transaction verification, although SMS verification can be defeated by man-in-the-mobile (MitMo) malware infection on the mobile phone. Trojans may be detected and removed by antivirus software[2] with a 23% success rate against Zeus in 2009,[3] and still low rates in 2011.[4] The 2011 report concluded that additional measures on top of antivirus were needed.[4] A related, simpler attack is the boy-in-the-browser (BitB, BITB). The majority of financial service professionals in a survey considered MitB to be the greatest threat to online banking and Microsoft Outlook.




Contents






  • 1 Description


  • 2 Examples


  • 3 Protection


    • 3.1 Antivirus


    • 3.2 Hardened software


    • 3.3 Out-of-band transaction verification


      • 3.3.1 Man-in-the-Mobile




    • 3.4 Web fraud detection




  • 4 Related attacks


    • 4.1 Proxy trojans


    • 4.2 Man-in-the-middle


    • 4.3 Boy-in-the-browser


    • 4.4 Clickjacking




  • 5 See also


  • 6 References


  • 7 External links





Description


The MitB threat was demonstrated by Augusto Paes de Barros in his 2005 presentation about backdoor trends "The future of backdoors - worst of all worlds".[5] The name "Man-in-the-Browser" was coined by Philipp Gühring on 27 January 2007.[6]


A MitB Trojan works by using common facilities provided to enhance browser capabilities such as Browser Helper Objects (a feature limited to Internet Explorer), browser extensions and user scripts (for example in JavaScript) etc.[6]Antivirus software can detect some of these methods.[2]


In a nutshell example exchange between user and host, such as an Internet banking funds transfer, the customer will always be shown, via confirmation screens, the exact payment information as keyed into the browser. The bank, however, will receive a transaction with materially altered instructions, i.e. a different destination account number and possibly amount. The use of strong authentication tools simply creates an increased level of misplaced confidence on the part of both customer and bank that the transaction is secure. Authentication, by definition, is concerned with the validation of identity credentials. This should not be confused with transaction verification.



Examples


Examples of MitB threats on different operating systems and web browsers:






























































































































Man-in-the-Browser examples
Name Details Operating system
Browser

Agent.DBJP[7]
 Windows IE, Firefox

Bugat[8]
 Windows IE, Firefox
Carberp targets Facebook users redeeming e-cash vouchers[9]
 Windows IE, Firefox

ChromeInject*[10]
Greasemonkey impersonator[11]
 Windows Firefox

Clampi[12]
 Windows IE

Gozi[1]
 Windows IE, Firefox

Nuklus[2][11]
 Windows IE

OddJob[13]
 keeps bank session open Windows IE, Firefox

Silentbanker[14]
 Windows IE, Firefox

Silon[15]
 Windows IE

SpyEye[16]
 successor of Zeus, widespread, low detection Windows IE, Firefox

Sunspot[17]
 widespread, low detection Windows IE, Firefox

Tatanga[18]
 Windows IE, Firefox, Chrome, Opera, Safari, Maxthon, Netscape, Konqueror

Tiny Banker Trojan[19]
 Smallest banking Trojan detected in wild at 20KB Windows IE, Firefox

Torpig**[15]
 Windows IE, Firefox

URLZone****[1]
 Windows IE, Firefox, Opera

Weyland-Yutani BOT[20]
crimeware kit similar to Zeus, not widespread[20][21]
 Mac OS X Firefox

Yaludle[15]
 Windows IE

Zeus***[12]
 widespread, low detection Windows IE, Firefox













Key
Windows: IE
Windows: IE & Firefox or Firefox
Windows: other
Mac OS X: any
*ChromeInject a.k.a. ChromeInject.A, ChromeInject.B, Banker.IVX, Inject.NBT, Bancos-BEX, Drop.Small.abw[10]
**Torpig a.k.a. Sinowal, Anserin[1]
***Zeus a.k.a. ZeuS, Zbot,[22] Wsnpoem,[23][24] NTOS,[3] PRG,[3] Kneber,[25] Gorhax[25]
****URLZone a.k.a. Bebloh!IK, Runner.82176, Monder, ANBR, Sipay.IU, Runner.fq, PWS.y!cy, Zbot.gen20, Runner.J, BredoPk-B, Runner.EQ


Protection



Antivirus


Known Trojans may be detected, blocked and removed by antivirus software.[2] In a 2009 study, the effectiveness of antivirus against Zeus was 23%,[3] and again low success rates were reported in a separate test in 2011.[4] The 2011 report concluded that additional measures on top of antivirus were needed.[4]



Hardened software



  • Browser security software: MitB attacks may be blocked by in-browser security software such as Trusteer Rapport for Microsoft Windows and Mac OS X which blocks the APIs from browser extensions and controls communication.[11][12][15]

  • Alternative software: Reducing or eliminating the risk of malware infection by using portable applications or using alternatives to Microsoft Windows like Mac OS X, Linux, or mobile OSes Android, iOS, Chrome OS, Windows Mobile, Symbian etc., and/or browsers Chrome, Opera.[26] Further protection can be achieved by running this alternative OS, like Linux, from a non-installed live CD, or Live USB.[27]

  • Secure Web Browser: Several vendors can now provide a two-factor security solution where a Secure Web Browser is part of the solution[citation needed]. In this case MitB attacks are avoided as the user executes a hardened browser from their two-factor security device rather than executing the "infected" browser from their own machine.



Out-of-band transaction verification


A theoretically effective method of combating any MitB attack is through an out-of-band (OOB) transaction verification process. This overcomes the MitB trojan by verifying the transaction details, as received by the host (bank), to the user (customer) over a channel other than the browser; for example an automated telephone call, SMS, or a dedicated mobile app with graphical cryptogram.[28] OOB transaction verification is ideal for mass market use since it leverages devices already in the public domain (e.g. landline, mobile phone, etc.) and requires no additional hardware devices yet enables three-factor authentication (using voice biometrics), transaction signing (to non-repudiation level) and transaction verification. The downside is that the OOB transaction verification adds to the level of the end-user's frustration with more and slower steps.



Man-in-the-Mobile


Mobile phone mobile Trojan spyware man-in-the-mobile (MitMo)[29] can defeat OOB SMS transaction verification.[30]




  • ZitMo (Zeus-In-The-Mobile) is not a MitB Trojan itself (although it performs a similar proxy function on the incoming SMSes), but is mobile malware suggested for installation on a mobile phone by a Zeus infected computer. By intercepting all incoming SMSes, it defeats SMS-based banking OOB two-factor authentication on Windows Mobile, Android, Symbian, BlackBerry.[30] ZitMo may be detected by Antivirus running on the mobile device.


  • SpitMo (SpyEye-In-The-Mobile, SPITMO), is similar to ZitMo.[31]



Web fraud detection


Web Fraud Detection can be implemented at the bank to automatically check for anomalous behaviour patterns in transactions.[32]



Related attacks



Proxy trojans


Keyloggers are the most primitive form of proxy trojans, followed by browser-session recorders which capture more data, and lastly MitBs are the most sophisticated type.[1]



Man-in-the-middle


Main article: Man-in-the-middle

SSL/PKI etc. may offer protection in a man-in-the-middle attack, but offers no protection in a man-in-the-browser attack.



Boy-in-the-browser


A related attack that is simpler and quicker for malware authors to set up is termed boy-in-the-browser (BitB or BITB). Malware is used to change the client's computer network routing to perform a classic man-in-the-middle attack. Once the routing has been changed, the malware may completely remove itself, making detection more difficult.[33]



Clickjacking


Main article: Clickjacking

Clickjacking tricks a web browser user into clicking on something different from what the user perceives, by means of malicious code in the webpage.



See also




  • Browser security

  • Form grabbing

  • IT risk

  • Threat (computer)

  • Timeline of computer viruses and worms

  • Online banking

  • Security token

  • Transaction authentication number

  • DNS hijacking



References





  1. ^ abcde Bar-Yosef, Noa (2010-12-30). "The Evolution of Proxy Trojans". Retrieved 2012-02-03..mw-parser-output cite.citation{font-style:inherit}.mw-parser-output q{quotes:"""""""'""'"}.mw-parser-output code.cs1-code{color:inherit;background:inherit;border:inherit;padding:inherit}.mw-parser-output .cs1-lock-free a{background:url("//upload.wikimedia.org/wikipedia/commons/thumb/6/65/Lock-green.svg/9px-Lock-green.svg.png")no-repeat;background-position:right .1em center}.mw-parser-output .cs1-lock-limited a,.mw-parser-output .cs1-lock-registration a{background:url("//upload.wikimedia.org/wikipedia/commons/thumb/d/d6/Lock-gray-alt-2.svg/9px-Lock-gray-alt-2.svg.png")no-repeat;background-position:right .1em center}.mw-parser-output .cs1-lock-subscription a{background:url("//upload.wikimedia.org/wikipedia/commons/thumb/a/aa/Lock-red-alt-2.svg/9px-Lock-red-alt-2.svg.png")no-repeat;background-position:right .1em center}.mw-parser-output .cs1-subscription,.mw-parser-output .cs1-registration{color:#555}.mw-parser-output .cs1-subscription span,.mw-parser-output .cs1-registration span{border-bottom:1px dotted;cursor:help}.mw-parser-output .cs1-hidden-error{display:none;font-size:100%}.mw-parser-output .cs1-visible-error{font-size:100%}.mw-parser-output .cs1-subscription,.mw-parser-output .cs1-registration,.mw-parser-output .cs1-format{font-size:95%}.mw-parser-output .cs1-kern-left,.mw-parser-output .cs1-kern-wl-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right,.mw-parser-output .cs1-kern-wl-right{padding-right:0.2em}


  2. ^ abcd F-Secure (2007-02-11). "Threat Description: Trojan-Spy:W32/Nuklus.A". Retrieved 2012-02-03.


  3. ^ abcd Trusteer (2009-09-14). "Measuring the in-the-wild effectiveness of Antivirus against Zeus" (PDF). Archived from the original (PDF) on November 6, 2011. Retrieved 2012-02-05.


  4. ^ abcd Quarri Technologies, Inc (2011). "Web Browsers: Your Weak Link in Achieving PCI Compliance" (PDF). Retrieved 2012-02-05.


  5. ^ Paes de Barros, Augusto (15 September 2005). "O futuro dos backdoors - o pior dos mundos" (PDF) (in Portuguese). Sao Paulo, Brazil: Congresso Nacional de Auditoria de Sistemas, Segurança da Informação e Governança - CNASI. Archived from the original (PDF) on July 6, 2011. Retrieved 2009-06-12.


  6. ^ ab Gühring, Philipp (27 January 2007). "Concepts against Man-in-the-Browser Attacks" (PDF). Retrieved 2008-07-30.


  7. ^ Dunn, John E (2010-07-03). "Trojan Writers Target UK Banks With Botnets". Retrieved 2012-02-08.


  8. ^ Dunn, John E (2010-10-12). "Zeus not the only bank Trojan threat, users warned". Retrieved 2012-02-03.


  9. ^ Curtis, Sophie (2012-01-18). "Facebook users targeted in Carberp man-in-the-browser attack". Retrieved 2012-02-03.


  10. ^ ab Marusceac Claudiu Florin (2008-11-28). "Trojan.PWS.ChromeInject.B Removal Tool". Retrieved 2012-02-05.


  11. ^ abc Nattakant Utakrit, School of Computer and Security Science, Edith Cowan University (2011-02-25). "Review of Browser Extensions, a Man-in-theBrowser Phishing Techniques Targeting Bank Customers". Retrieved 2012-02-03.CS1 maint: Multiple names: authors list (link)


  12. ^ abc Symantec Marc Fossi (2010-12-08). "ZeuS-style banking Trojans seen as greatest threat to online banking: Survey". Retrieved 2012-02-03.


  13. ^ Ted Samson (2011-02-22). "Crafty OddJob malware leaves online bank accounts open to plunder". Retrieved 2012-02-06.


  14. ^ Symantec Marc Fossi (2008-01-23). "Banking with Confidence". Retrieved 2008-07-30.


  15. ^ abcd Trusteer. "Trusteer Rapport". Retrieved 2012-02-03.


  16. ^ CEO of Trusteer Mickey Boodaei (2011-03-31). "Man-in-the-Browser attacks target the enterprise". Retrieved 2012-02-03.


  17. ^ www.net-security.org (2011-05-11). "Explosive financial malware targets Windows". Retrieved 2012-02-06.


  18. ^ Jozsef Gegeny; Jose Miguel Esparza (2011-02-25). "Tatanga: a new banking trojan with MitB functions". Retrieved 2012-02-03.


  19. ^ "Tiny 'Tinba' Banking Trojan Is Big Trouble". msnbc.com. Retrieved 2016-02-28.


  20. ^ ab Borean, Wayne (2011-05-24). "The Mac OS X Virus That Wasn't". Retrieved 2012-02-08.


  21. ^ Fisher, Dennis (2011-05-02). "Crimeware Kit Emerges for Mac OS X". Archived from the original on September 5, 2011. Retrieved 2012-02-03.


  22. ^ F-secure. "Threat DescriptionTrojan-Spy:W32/Zbot". Retrieved 2012-02-05.


  23. ^ Hyun Choi; Sean Kiernan (2008-07-24). "Trojan.Wsnpoem Technical Details". Symantec. Retrieved 2012-02-05.


  24. ^ Microsoft (2010-04-30). "Encyclopedia entry: Win32/Zbot - Learn more about malware - Microsoft Malware Protection Center". Symantec. Retrieved 2012-02-05.


  25. ^ ab Richard S. Westmoreland (2010-10-20). "Antisource - ZeuS". Archived from the original on 2012-01-20. Retrieved 2012-02-05.


  26. ^ Horowitz, Michael (2012-02-06). "Online banking: what the BBC missed and a safety suggestion". Retrieved 2012-02-08.


  27. ^ Purdy, Kevin (2009-10-14). "Use a Linux Live CD/USB for Online Banking". Retrieved 2012-02-04.


  28. ^ Finextra Research (2008-11-13). "Commerzbank to deploy Cronto mobile phone-based authentication technology". Retrieved 2012-02-08.


  29. ^ Chickowski, Ericka (2010-10-05). "'Man In The Mobile' Attacks Highlight Weaknesses In Out-Of-Band Authentication". Retrieved 2012-02-09.


  30. ^ ab Schwartz, Mathew J. (2011-07-13). "Zeus Banking Trojan Hits Android Phones". Retrieved 2012-02-04.


  31. ^ Balan, Mahesh (2009-10-14). "Internet Banking & Mobile Banking users beware – ZITMO & SPITMO is here !!". Retrieved 2012-02-05.


  32. ^ Sartain, Julie (2012-02-07). "How to protect online transactions with multi-factor authentication". Retrieved 2012-02-08.


  33. ^ Imperva (2010-02-14). "Threat Advisory Boy in the Browser". Retrieved 2015-03-12.




External links



  • Virus attack on HSBC Transactions with OTP Device

  • Virus attack on ICICI Bank Transactions

  • Virus attack on Citibank Transactions


  • Hackers outwit online banking identity security systems BBC Click


  • Antisource - ZeuS A summary of ZeuS as a Trojan and Botnet, plus vector of attacks


  • Man-In-The-Browser Video on YouTube Entrust President and CEO Bill Conner


  • Zeus: King of crimeware toolkits Video on YouTube The Zeus toolkit, Symantec Security Response


  • How safe is online banking? Audio BBC Click


  • Boy-in-the-Browser Cyber Attack Video on YouTube Imperva











-

Popular posts from this blog

Lambaréné

Image
Place in Moyen-Ogooué, Gabon Lambaréné Street in Lambaréné Lambaréné Location in Gabon Coordinates: 0°41′18″S 10°13′55″E  /  0.68833°S 10.23194°E  / -0.68833; 10.23194 Coordinates: 0°41′18″S 10°13′55″E  /  0.68833°S 10.23194°E  / -0.68833; 10.23194 Country   Gabon Province Moyen-Ogooué Population (2013 census)  • Total 38,775 Lambaréné is a town and the capital of Moyen-Ogooué in Gabon. With a population of 38,775 as of 2013, it is located 75 kilometres south of the equator. Lambaréné is based in the Central African Rainforest at the river Ogooué. This river divides the city into 3 districts: Rive Gauche, Ile Lambaréné and Rive Droite. The Albert Schweitzer Hospital and the districts Adouma and Abongo are located on Rive Droite. The districts Atongowanga, Sahoty, Dakar, Grand Village, Château, Lalala and Bordamur build the Ile Lambaréné. The majority of the people in Lambaréné live in the district Isaac located on Rive Gauche. This distr
Read more

維納斯堡 (華盛頓州)

Image
body.skin-minerva .mw-parser-output table.infobox caption{text-align:center} 維納斯堡 Venersborg （英文） CDP Venersborg, Washington 維納斯堡位置圖 坐标： 45°46′58″N 122°27′43″W  /  45.7828°N 122.462°W  / 45.7828; -122.462 國家   美國 州 華盛頓州 郡 克拉克县 面积  •  总计 27.8 平方公里（10.7 平方英里）  • 陸地 27.8 平方公里（10.7 平方英里）  • 水域 0.0 平方公里（0.0 平方英里） 海拔 155 米（509 英尺） 人口 （2000年）  • 總計 3,274  • 密度 118.0/平方公里（305.6/平方英里） 时区 PST （UTC-8）  • 夏时制 PDT（UTC-7） FIPS碼 53-74585 [1] GNIS編號 1527695 [2] 維納斯堡 （ 英语： Venersborg ）是美国华盛顿州克拉克县的一個普查规定居民点（CDP），2000年美國人口普查時人口為2,085人。 最初為瑞典人聚居地。 參見 維納什堡 参考資料 ^ American FactFinder. United States Census Bureau. [ 2008-01-31 ] .   ^ US Board on Geographic Names. United States Geological Survey. 2007-10-25 [ 2008-01-31 ] .   查 论 编 克拉克县 行政區劃 郡治 ： 溫哥華 市 巴特爾格朗德 | 卡默斯 | 拉申特 | 里奇菲尔德 | 溫哥華 | 瓦休戈 | 林地市‡ 鎮 亞科爾特 CDP 安波伊 | 巴伯頓 | 布拉什普雷里 | 櫻桃樹叢區 |
Read more

Mononymous person

Image
Plato, the Greek philosopher, is universally known by a single name. A mononymous person is an individual who is known and addressed by a single name, or mononym. [a] [b] In some cases, that name has been selected by the individual, who may have originally been given a polynym ("multiple name"). In other cases, it has been determined by the custom of the country [c] or by some interested segment. In the case of historical figures, it may be the only one of the individual's names that has survived and is still known today. Contents 1 Antiquity 2 Medieval uses 2.1 Europe 2.2 The Americas 3 Post-medieval uses 3.1 France 3.2 Other Europe 3.3 North America 4 Royalty 5 Modern times 5.1 Mononym-normal 5.2 Asia 5.3 The West 6 Gallery 7 See also 8 Notes 9 References 10 Bibliography 11 External links Antiquity Narmer The structure of persons' names has varied across ti
Read more