Man in the Browser Attacks

2. Mitb In Terms Of Mitm

Let us begin by exploring the places in which MitB differs from MitM. Firstly, MitM intercepts data using an inserted or compromised piece of hardware that is external to the targeted system. MitB on the other hand gains access through the software configuration on that system, generally by way of a Trojan that targets the web browsers on that computer.

Secondly, MitM either has to deal with messages that have already been protected by whatever security is associated with the connection (and read/alter them mid-flight in both directions of communication), or has to present a plausible reason for the user to create their connection with the attacker’s own server. MitB does not need to bother with the extra work this entails. In the outward-bound direction, it is the author of all compromised messages sent. In the inward-bound direction, it does still have to deal with a fully formed message, but it does not need to be concerned with modifying the message itself so as to conceal its actions. This is because MitB directly controls the browser, and therefore needs only to modify the browser display to be as the user expects. Together this means that it works outside of any client-side and server-side encryption and validation, and therefore does not have to be concerned with increased latency arising from hashing overheads or to provide dummy keys for public key encryption.