CAPEC-662 Detail

An adversary exploits security vulnerabilities or inherent functionalities of a web browser, in order to manipulate traffic between two endpoints.

Execution Flow

1) Experiment

The adversary tricks the victim into installing the Trojan Horse malware onto their system.

Technique

• Conduct phishing attacks, drive-by malware installations, or masquerade malicious browser extensions as being legitimate.

2) Experiment

The adversary inserts themself into the communication channel initially acting as a routing proxy between the two targeted components.

3) Exploit

The adversary observes, filters, or alters passed data of their choosing to gain access to sensitive information or to manipulate the actions of the two target components for their own purposes.

Prerequisites

The adversary must install or convince a user to install a Trojan.
There are two components communicating with each other.
An attacker is able to identify the nature and mechanism of communication between the two target components.
Strong mutual authentication is not used between the two target components yielding opportunity for adversarial interposition.
For browser pivoting, the SeDebugPrivilege and a high-integrity process must both exist to execute this attack.

Skills Required

Tricking the victim into installing the Trojan is often the most difficult aspect of this attack. Afterwards, the remainder of this attack is fairly trivial.

Mitigations

Ensure software and applications are only downloaded from legitimate and reputable sources, in addition to conducting integrity checks on the downloaded component.
Leverage anti-malware tools, which can detect Trojan Horse malware.
Use strong, out-of-band mutual authentication to always fully authenticate both ends of any communications channel.
Limit user permissions to prevent browser pivoting.
Ensure browser sessions are regularly terminated and when their effective lifetime ends.

Related Weaknesses

References

REF-629

Man-in-the-browser attack
https://owasp.org/www-community/attacks/Man-in-the-browser_attack

REF-630

Oil and Gas Spearphishing Campaigns Drop Agent Tesla Spyware in Advance of Historic OPEC+ Deal
Liviu Arsene.
https://labs.bitdefender.com/2020/04/oil-gas-spearphishing-campaigns-drop-agent-tesla-spyware-in-advance-of-historic-opec-deal/

REF-631

Man-in-the-Mobile Attacks Single Out Android
Amit Klein.
https://securityintelligence.com/man-in-the-mobile-attacks-single-out-android/

REF-632

New 'Boy In The Browser' Attacks On The Rise
Kelly Jackson Higgins.
https://www.darkreading.com/risk/new-boy-in-the-browser-attacks-on-the-rise/d/d-id/1135247

Submission

Modifications