Starting Letter: M

Malicious actors use various tactics to carry out Man-in-the-browser attacks. In the sections below, we explore each tactic in detail:

• Man-in-the-browser through Trojans.
  

• Man-in-the-browser through browser extensions
  

• Man-in-the-browser through API hooking
  

• Man-in-the-browser through SSL stripping

In this approach, cybercriminals implant a Trojan horse in a would-be victim's PC operating system. In this case, they usually use email phishing as the primary vehicle to trick a user into installing the trojan, which, in turn, allows them to spy on users.

1. A typical operation involves sending users emails with malicious attachments. Upon their clicking, these files attach themselves to a user's PC's system library, which is used by top browsers to access the Internet. In doing so, they enable a malicious actor to read a user's information or change anything on their browser.
   
   An excellent example of such malware is ZeuS, a sneaky Trojan that has led to massive losses since its inception in 2006.
   
   In particular, ZeuS has infected millions of computer systems worldwide, resulting in the loss of billions of dollars. Its other banking variants include the Citadel Trojan, which has affected 11 million companies, leading to a $500 million loss in damages. In comparison, its Emotet Trojan version has led to a loss of $1 million per attack since its introduction.
   
   

2. Another way the malware has been passed around is through drive-by downloads and spam campaigns.
   
   In the first case, an attacker typically sends a malicious file in downloadable form to an unsuspecting user, who then accidentally clicks on the file to spread the malware. Similarly, the latter involves spamming a user's mailbox with unsolicited emails promising differing benefits, for instance, discounts upon clicking on a link leading to an infection.
   
   

3. The third way the ZeuS Trojan is spread across the web is through JavaScript and AJAX.
   
   Most Zeus developers prefer this method since XML, asynchronous JavaScript, or AJAX code work alongside X-Frame option headers. And in so doing, cybercriminals can oversee and command servers to create new forms within banking sites, which allows them to access personal information and user passwords. Besides that, these languages make it difficult for an ordinary user to identify the malware. As such, they are a popular choice when configuring botnets.
   
   Other means through which the Zbot is spread include pay-per-install services, social media messaging services, and instant messengers. The awful thing about the malware is that it mutates an infected system into a bot in a botnet. This makes life easier for bad actors, as they can rent out hacked systems to their associates to continue playing the game.

In this approach, malicious actors use an insecure browser extension or a Browser Helper Object—a malicious user script.

An attacker usually maneuvers malware past a browser's security features to intercept communication between a website and a user. This allows them to alter a user's financial transactions or change their website's appearance, among other malicious actions.

When installing a browser extension, it is common for users to unintentionally accept the broad permissions that modify the browser, the web pages, and their behavior.

Naturally, this level of control and access by third parties can represent significant threats to the security and privacy of users and their organizations; they can inject malicious JavaScript directly into web pages and modify the DOM.

The third way to attack is by using API Hooking.

In this setting, the man-in-the-browser performs the role of middleman between executable applications and their libraries. Notably, the MITB strategically hooks up the internet connect function in winnet.dll. This enables an attacker to change what pops up on a user's browser—the operation mimics HTML rewriting. Even worse, the fraudster can decide to change a user's website to make it appear authentic but with misleading information.

Last but not least, we find Man-in-the-browser attacks that use SSL stripping.

Cybercriminals downgrade a website’s connection from HTTPS to HTTP, making it more vulnerable to attacks. The action makes all the communications unencrypted, setting the stage for Man-in-the-browser attacks.

From an expert standpoint, detecting and preventing Man-in-the-browser attacks is an uphill task. How they spread and operate tells it all.

As an example, it is difficult to stop them by using standard antivirus software or firewalls meant for virus protection. Furthermore, attackers can use extensive resources to launch an attack, giving them an upper hand. They can also develop Man-in-the-browser attacks that spread exponentially, making them difficult to control.

Preventing Man-in-the-browser attacks: strategies for end-users

Given the vast array of tactics that cybercriminals can use to perform Man-in-the-browser attacks, there isn’t much that end-users can do to prevent them.

To protect against SSL stripping attacks, users can always check their browser's address bar. Doing so enables them to spot any connection via an unencrypted HTTP protocol. Alternatively, they can install the HTTPS Everywhere extension, ensuring HTTPS communication round the clock. On top of that, the extension can help prevent third parties from demoting their connections to HTTP.

Advanced users can also ensure that their local area network is free from unauthorized parties and secure. In essence, an SSL breakthrough heavily depends on local network accessibility.

Preventing Man-in-the-browser attacks: strategies for companies

Companies can use several strategies to bolster their defenses against Man-in-the-browser attacks.

First off, they can use Out-of-Band Verification. Here, a different device (such as a phone) can verify what is passed on to a PC. This is not foolproof, though, as the malware can wait to strike at prime time (after authentication), which makes it difficult to stop the infection in the first place. Therefore, companies can integrate a biometric identification system to make the method more effective.

Another way to monitor and intercept such attacks is through behavior analysis. This process involves an in-depth study of user behavior to help identify abnormal account activity. These can allow bank employees to validate transactions, for instance. It also allows for weeding out potential criminal activity or actions that don't match a user's profile.

Companies can also employ an additional line of defense on the client side. Monitoring the client side for malicious activity allows companies to detect and block Man-in-the-browser attacks. It will also help companies achieve a higher security level for their applications. Why? Websites use more and more scripts and third parties on their web pages to help them understand how their website operates and how the users operate their websites, which can increase the security risks for the company and their customers.

Read more about Man-in-The-Browser attacks with Jscrambler’s Case Study about Mitigating Browser Extension Attacks, where you can learn more about the dangers of browser extensions, their attack scenarios, common approaches, and how to mitigate them.

A Man-in-the-Middle (MitM) attack is a type of cyberattack where a malicious actor intercepts communications between two parties and potentially manipulates the messages without either party's knowledge. This type of attack is highly detrimental because an attacker can intercept, modify, or steal sensitive information or even insert malware into a conversation.

Imagine Davis and Joe trying to chat privately. A MitM attacker sits in the middle of them and obstructs their messages. Davis thinks he’s talking to Joe, and Joe thinks he’s talking to Davis, but actually, they’re both talking to the attacker. The intruder can then read, tamper with, or even block the messages before sending them to the intended recipient. Such a violation of privacy and security is detrimental.

Users engaging with unsecured networks for websites, emails, and messaging systems are particularly vulnerable to the risks associated with MitM attacks. This article will discuss how these attacks operate, their various types, and strategies for defending against them.

A MitM attack consists of two main steps:

1. Interception: During this initial stage, the attacker blocks the communication of the two participating parties. The attack is carried out through unsecured network vulnerabilities or by tricking users into unknown WiFi connections, as well as through malware.

2. Decryption and Manipulation: After interception, the attacker gains access to communicate with and alter the collected data. Attackers accomplish their targets by obtaining login information or implementing malware or steering victims toward fraudulent web pages.

MitM attacks can take several forms, each with different methods of execution. Here are some of the most common types:

1. Wi-Fi Eavesdropping: Attackers set up fake Wi-Fi networks with seemingly legitimate names (e.g., “Free Airport Wi-Fi”). When users connect, their data is intercepted, allowing attackers to steal login credentials, credit card numbers, or other sensitive data.

2. Session Hijacking: Attackers steal session cookies, which allow them to impersonate users on websites without requiring a password. This method is often used to take over online accounts, such as banking or social media profiles.

3. DNS Spoofing: Also known as DNS cache poisoning, this attack involves redirecting users to fraudulent websites by manipulating the Domain Name System (DNS). Victims may unknowingly enter their login credentials on a fake website controlled by the attacker.

4. HTTPS Stripping: Some MitM attacks downgrade secure HTTPS connections to less secure HTTP versions. This makes it easier for attackers to intercept and read data that would otherwise be encrypted.

5. Email Hijacking: Cybercriminals intercept communications between businesses and customers, modifying details in financial transactions to redirect payments to fraudulent accounts.

6. ARP Poisoning: This involves manipulating the Address Resolution Protocol (ARP) to associate the attacker's MAC address with the IP address of either the sender or the receiver. This tricks the devices into sending their traffic to the attacker's machine. 

The consequences of a successful MitM attack can be severe:

• Data Theft: Attackers can steal sensitive information like usernames, passwords, credit card details, and personal conversations.  

• Financial Loss: Stolen financial information can lead to direct financial losses, while compromised business data can result in significant damage to a company's reputation and bottom line.  

• Malware Distribution: Attackers can inject malware into the communication stream, infecting the victim's device.  

• Identity Theft: Stolen personal information can be used to commit identity theft, opening fraudulent accounts or making unauthorized purchases.

• Reputational Damage: Compromised communications can damage trust and relationships, both personal and professional.

While MitM attacks can be sophisticated, there are steps you can take to protect yourself:

1. Use Secure Networks: Avoid connecting to public Wi-Fi networks, especially those without passwords. If you must use them, connect through a reliable and well-known Virtual Private Network (VPN) to encrypt your data.

2. Enable HTTPS Everywhere: Ensure that websites use HTTPS instead of HTTP. A browser extension like “HTTPS Everywhere” can force websites to use encryption where possible.

3. Use Strong Encryption and Secure Protocols: Always enable end-to-end encryption in communication apps and use secure email providers that offer encryption.

4. Verify Website Authenticity: Always check the website’s URL and ensure it has a valid SSL/TLS certificate before entering sensitive information.

5. Update Software and Firmware Regularly: Keep your browsers, operating systems, and security software up to date to patch vulnerabilities that could be exploited in MitM attacks.

6. Enable Multi-Factor Authentication (MFA): Using MFA adds an extra layer of security, making it more difficult for attackers to hijack accounts even if they steal login credentials.

7. Be Cautious with Emails and Links: Avoid clicking on suspicious links in emails or messages. Always verify the sender and be cautious of phishing attempts.

Malware is an umbrella term for “malicious software” that describes any software deliberately aimed at harming electronics, networks, or robots and their users. It comprises numerous high-end cyber threats, including viruses, worms, Trojan horses, spyware, and ransomware. As the modern world became more globalized, malware became the ubiquitous cyber scourge targeting homes, companies, and states.

Malware can access systems in numerous ways, including unsolicited email attachments, usual documents retrieved from some native websites, a keyboard and mouse, and downloads of applications used for other purposes. When installed, it enables the criminal, among other things, to commit a theft of information, to lock files and ask for a prize for unlocking, or to abuse the system’s capabilities by employing bulky work processes like crypto-mining.

• Virus: A virus attaches to legitimate programs or files and propagates when an infected program or file is run. Viruses can delete data, destroy files, or cause other systems to fail.

• Worms: Spreading via networks without human interaction (unlike viruses), worms infect a host computer and pinpoint its vulnerabilities to further self-replicate and wreak havoc on others.

• Trojan Horse: Trojans are programs that look like normal software but contain malicious code on the inside. Once they are opened, they can, for example, compromise your computer security and enable the installation of other malware.

• Ransomware: This locks and encrypts your files, rendering them useless. It also requests a certain fee and provisions to unlock the files. Several well-recognized businesses’ ransomware operations have been targeted lately, as well as vital infrastructure systems.

• Spyware: Spyware monitors users' activities without their knowledge. It gathers information like passwords or web browsing habits without asking. Bad actors often sell this data or use it to steal identities.

• Adware: Adware puts annoying ads on your device. It's not always out to get you, but it can invade your privacy and open the door for other nasty software.

• Rootkits: Rootkits give attackers special access to a computer while staying hidden. They're hard to spot and get rid of.

• Keyloggers: Keyloggers write down every key you press to capture sensitive info like login details and credit card numbers.

• Botnets: A botnet is a group of hacked devices under an attacker's control. Attackers often use botnets to launch Distributed Denial of Service (DDoS) attacks or send out spam emails.

Detecting malware early can minimize damage. Common symptoms include:

• Slower device performance.

• Unexpected crashes or system errors.

• Unwanted pop-up ads.

• Unauthorized changes to system settings.

• Unexplained network activity or high data usage.

1. Install Antivirus Software: Use reputable antivirus software to scan, detect, and remove malware.

2. Keep Software Updated: Regularly update your operating system and applications to patch security vulnerabilities.

3. Be Cautious with Emails: Avoid opening email attachments or clicking on links from unknown senders.

4. Use Strong Passwords: Strong, unique passwords reduce the risk of unauthorized access.

5. Enable Firewalls: Firewalls monitor and control incoming and outgoing network traffic to block suspicious activity.

6. Download from Trusted Sources: Only download software and files from legitimate, verified sources.

7. Educate Yourself and Employees: Awareness training can help individuals recognize and avoid malware threats.

If you think your device has malware:

1. Go offline: This stops malware from spreading or sending your data to hackers.

2. Do a Malware Check: Use antivirus or anti-malware programs to find and get rid of bad files.

3. Ask an Expert: For big problems, talk to someone who knows about cybersecurity.

4. Use a Backup: If malware has done a lot of harm, starting over with a recent backup might be your best bet.

Cybercriminals continuously develop new types of malware to exploit emerging technologies and vulnerabilities. Advanced threats like fileless malware, which operates in memory rather than on the hard drive, and polymorphic malware, which changes its code to evade detection, highlight the need for robust security measures.

Malware is a significant and ever-evolving cyber threat. Understanding its various forms, how it operates, and how to protect against it is crucial for maintaining the security of your devices and personal information. Adopting good cybersecurity practices and staying vigilant can reduce the risk of falling victim to malware attacks.

Magecart attacks typically follow one of two approaches: a first-party attack or a third-party attack.

First-party attack

In a first-party attack, malicious actors access the victim’s website and directly place the skimmer on the payment page. Some examples of Magecart attacks that followed the first-party approach include the 2018 attack on British Airways (that leaked over 400,000 credit card details) and the 2022 attack on the Segway online store (whose figures remain undisclosed).

Third-party attack

In a third-party attack, this malicious code is injected through a third-party provider that the victim company is using: an approach known as a supply chain attack. Magecart supply chain attacks are especially critical because they don’t require a first-party server breach or direct access to the company’s website. Even companies with robust Web Application Firewalls and server-side security are susceptible to these attacks because they exploit client-side security weaknesses.

Because modern websites rely, on average, on 35 different pieces of third-party code, each one of them could present attackers with a way into the system.

In a Magecart attack, attackers inject the skimmer (through malicious JavaScript code) into a company’s payment page. This code actively listens to events happening on the page and collects credit card details whenever a user submits them in a form (event hijacking). These details are then sent to attacker-controlled drop servers.

Throughout the process, it’s common for neither the end-user nor the company to be aware that the attack occurred. Because of this, a significant number of Magecart attacks remain active for months before being detected and taken down.

1. British Airways

One of the biggest recent examples of a Magecart attack occurred in 2018 at British Airways, which was specifically targeted.

This attack targeted the payment methods on the website and mobile app, resulting in the personal data leak of nearly 400,000 customers. The attackers copied the Javascript payment forms from the website and modified them, allowing them to send the payment information to a server controlled by the attackers.

This malicious code remained active and undetected for 15 days, and, as a GDPR fine, British Airways had to pay a total of £183 million for not preventing the attack or keeping their customer's data safe.

2. Ticketmaster

In 2018, Ticketmaster announced that payment information had been stolen from its websites.

Upon investigation, it was concluded that the attackers used Magecart operators who placed skimmers on checkout pages through third-party vendors. They also attacked the third parties themselves, which gave the attackers access to more than 800 e-commerce sites.

3. Forbes

In 2019, the renowned US magazine Forbes also suffered a magecart attack. When its users were entering their data on the magazine's subscription page, the attackers used injected web-skimming scripts to access their data: names, addresses, contact numbers, and emails, as well as the credit cards’ expiration dates and CVV/CVC verification codes.

Learn more about the 7 biggest magecart attacks to date and what to learn from them at Jscrambler's blog.

While Magecart has certainly entered the radar of several companies over the past few years, dealing with a new and constantly mutating attack vector is a tough security challenge.

If we put a typical Magecart attack under the microscope, we will find two key problems:

• Problem 1: the inability to detect a web skimmer when it’s running on the client-side;

• Problem 2: the lack of capabilities to mitigate the attack.
  
  

The prevention strategy

As such, the first step in a Magecart prevention strategy must be gaining client-side visibility. Companies can easily achieve this by using webpage inventory technology that actively monitors the client side, looking for signs of malicious behavior. Some examples of typical Magecart behavior are a third-party script tampering with a payment form, payment data being sent out to an unknown domain, etc.

After gaining visibility, companies need the ability to block malicious behavior, ideally without disrupting the customer experience. This is where it can get even trickier, as some novel security approaches are often unstable and can break the entire website.

A proper Magecart mitigation strategy must be able to block the source of the malicious behavior in real-time, regardless of the strategy used by the attackers, ensure that no data is leaked, and keep the user experience intact throughout the whole process.