An adversary exploits security vulnerabilities or inherent functionalities of a web browser, in order to manipulate traffic between two endpoints.
This attack first requires the adversary to trick the victim into installing a Trojan Horse application on their system, such as a malicious web browser plugin, which the adversary then leverages to mount the attack. The victim interacts with a web application, such as a banking website, in a normal manner and under the assumption that the connection is secure. However, the adversary can now alter and/or reroute traffic between the client application (e.g., web browser) and the coinciding endpoint, while simultaneously displaying intended transactions and data back to the user. The adversary may also be able to glean cookies, HTTP sessions, and SSL client certificates, which can be used to pivot into an authenticated intranet. Identifying AITB is often difficult because these attacks are successful even when security mechanisms such as SSL/PKI and multifactor authentication are present, since they still function as intended during the attack.
| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf | M | 94 | Adversary in the Middle (AiTM) |
| CanFollow | S | 185 | Malicious Software Download |
| CanFollow | S | 542 | Targeted Malware |
The adversary tricks the victim into installing the Trojan Horse malware onto their system.
The adversary tricks the victim into installing the Trojan Horse malware onto their system.
| Technique |
|---|
| Conduct phishing attacks, drive-by malware installations, or masquerade malicious browser extensions as being legitimate. |
The adversary inserts themself into the communication channel initially acting as a routing proxy between the two targeted components.
The adversary inserts themself into the communication channel initially acting as a routing proxy between the two targeted components.
| Technique |
|---|
The adversary observes, filters, or alters passed data of their choosing to gain access to sensitive information or to manipulate the actions of the two target components for their own purposes.
The adversary observes, filters, or alters passed data of their choosing to gain access to sensitive information or to manipulate the actions of the two target components for their own purposes.
| Technique |
|---|
Tricking the victim into installing the Trojan is often the most difficult aspect of this attack. Afterwards, the remainder of this attack is fairly trivial.
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| Integrity | N/A | Modify Data | N/A |
| ConfidentialityAccess ControlAuthorization | N/A | Gain Privileges | N/A |
| Confidentiality | N/A | Read Data | N/A |
| Taxonomy Name | Entry ID | Entry Name |
|---|---|---|
| ATTACK | 1185 | Man in the Browser |
| OWASP Attacks | N/A | Man-in-the-browser attack |