CAPEC-701
Browser in the Middle (BiTM)
2023-01-24
00h00 +00:00
00h00 +00:00
특정 CAPEC 알림
특정 CAPEC의 변경 사항에 대한 정보를 받아보세요.
CAPEC 설명
An adversary exploits the inherent functionalities of a web browser, in order to establish an unnoticed remote desktop connection in the victim's browser to the adversary's system. The adversary must deploy a web client with a remote desktop session that the victim can access.
CAPEC 정보
실행 흐름
1) Explore
[Identify potential targets] The adversary identifies an application or service that the target is likely to use.
기법
- The adversary stands up a server to host the transparent browser and entices victims to use it by using a domain name similar to the legitimate application. In addition to the transparent browser, the adversary could also install a web proxy, sniffer, keylogger, and other tools to assist in their goals.
2) Experiment
[Lure victims] The adversary crafts a phishing campaign to lure unsuspecting victims into using the transparent browser.
기법
- An adversary can create a convincing email with a link to download the web client and interact with the transparent browser.
3) Exploit
[Monitor and Manipulate Data] When the victim establishes the connection to the transparent browser, the adversary can view victim activity and make alterations to what the victim sees when browsing the web.
기법
- Once a victim has established a connection to the transparent browser, the adversary can use installed tools such as a web proxy, keylogger, or additional malicious browser extensions to gather and manipulate data or impersonate the victim.
사전 조건
The adversary must create a convincing web client to establish the connection. The victim then needs to be lured onto the adversary's webpage. In addition, the victim's machine must not use local authentication APIs, a hardware token, or a Trusted Platform Module (TPM) to authenticate.필요 기술
(Level : Medium)필요 리소스
A web application with a client is needed to enable the victim's browser to establish a remote desktop connection to the system of the adversary.완화 방법
Implementation: Use strong, mutual authentication to fully authenticate with both ends of any communications channel관련 약점
| 약점 이름 | |
|---|---|
CWE-294 |
Authentication Bypass by Capture-replay A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). |
CWE-345 |
Insufficient Verification of Data Authenticity The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. |
참고 자료
REF-747
Browser-in-the-Middle (BitM) attackTommasi F., Catalano, C., Taurino I..
https://link.springer.com/article/10.1007/s10207-021-00548-5#citeas
제출
| 이름 | 조직 | 날짜 | 출시일 |
|---|---|---|---|
| Jonas Tzschoppe | Nuremberg Institute of Technology |
