Skip to main content
SpringerLink
Log in

A Survey on Countermeasures Against Man-in-the-Browser Attacks

  • Conference paper
  • First Online:
Hybrid Intelligent Systems (HIS 2019)

Part of the book series: Advances in Intelligent Systems and Computing ((AISC,volume 1179))

Included in the following conference series:

Abstract

Man-in-the-browser (MitB) attacks can modify the contents of a web page or alter data in messages exchanged over the network without the communicating parties (the user and the web service) noticing anything out of ordinary. In this paper, we present a systematic survey of countermeasures against man-in-the-browser attacks. While no countermeasure seems to be completely foolproof (and still usable) against these attacks, combining a set of solutions and more effectively enforcing them in real-world systems should greatly mitigate this threat in the future.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 129.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 169.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Almeshekah, M.H., Atallah, M.J., Spafford, E.H.: Enhancing passwords security using deceptive covert communication. In: IFIP International Information Security and Privacy Conference, pp. 159–173. Springer, Cham (2015)

    Google Scholar 

  2. Biedermann, S., Ruppenthal, T., Katzenbeisser, S.: Data-centric phishing detection based on transparent virtualization technologies. In: 2014 Twelfth Annual International Conference on Privacy, Security and Trust, pp. 215–223. IEEE (2014)

    Google Scholar 

  3. Blom, A., de Koning Gans, G., Poll, E., De Ruiter, J., Verdult, R.: Designed to fail: a USB-connected reader for online banking. In: Nordic Conference on Secure IT Systems, pp. 1–16. Springer, Cham (2012)

    Google Scholar 

  4. Buescher, A., Leder, F., Siebert, T.: Banksafe information stealer detection inside the web browser. In: International Workshop on Recent Advances in Intrusion Detection, pp. 262–280. Springer, Cham (2011)

    Google Scholar 

  5. Chow, Y.W., Susilo, W., Yang, G., Au, M.H., Wang, C.: Authentication and transaction verification using QR codes with a mobile device. In: International Conference on Security, Privacy and Anonymity in Computation, Communication and Storage, pp. 437–451. Springer, Cham (2016)

    Google Scholar 

  6. Dmitrienko, A., Liebchen, C., Rossow, C., Sadeghi, A.R.: On the (in)security of mobile two-factor authentication. In: Christin, N., Safavi-Naini, R. (eds.) Financial Cryptography and Data Security, pp. 365–383. Springer, Heidelberg (2014)

    Google Scholar 

  7. Dougan, T., Curran, K.: Man in the browser attacks. Int. J. Ambient Comput. Intell. (IJACI) 4(1), 29–39 (2012)

    Article  Google Scholar 

  8. Entrust: Defeating man-in-the-browser malware – how to prevent the latest malware attacks against consumer and corporate banking. White paper (2014)

    Google Scholar 

  9. Garcia-Cervigon, M., Llinàs, M.M.: Browser function calls modeling for banking malware detection. In: 2012 7th International Conference on Risks and Security of Internet and Systems (CRiSIS), pp. 1–7. IEEE (2012)

    Google Scholar 

  10. Gezer, A., Warner, G., Wilson, C., Shrestha, P.: A flow-based approach for trickbot banking trojan detection. Comput. Secur. 84, 179–192 (2019)

    Google Scholar 

  11. Goyal, P., Bansal, N., Gupta, N.: Averting man in the browser attack using user-specific personal images. In: 3rd IEEE International Advance Computing Conference (IACC), pp. 1283–1286. IEEE (2013)

    Google Scholar 

  12. Guha, A., Fredrikson, M., Livshits, B., Swamy, N.: Verified security for browser extensions. In: IEEE Symposium on Security and Privacy. IEEE 2011, pp. 115–130 (2011)

    Google Scholar 

  13. Gühring, P.: Concepts against man-in-the-browser attacks. Technical report (2006)

    Google Scholar 

  14. Jia, Y., Chen, Y., Dong, X., Saxena, P., Mao, J., Liang, Z.: Man-in-the-browser-cache: persisting https attacks via browser cache poisoning. Comput. Secur. 55, 62–80 (2015)

    Article  Google Scholar 

  15. Konoth, R.K., van der Veen, V., Bos, H.: How anywhere computing just killed your phone-based two-factor authentication. In: International Conference on Financial Cryptography and Data Security, pp. 405–421. Springer, Cham (2016)

    Google Scholar 

  16. Liu, L., Zhang, X., Yan, G., Chen, S., et al.: Chrome extensions: threat analysis and countermeasures. In: NDSS (2012)

    Google Scholar 

  17. Marouf, S., Shehab, M.: Towards improving browser extension permission management and user awareness. In: 8th International Conference on Collaborative Computing: Networking, Applications and Worksharing (CollaborateCom), pp. 695–702. IEEE (2012)

    Google Scholar 

  18. Nor, F.B.M., Jalil, K.A., et al.: An enhanced remote authentication scheme to mitigate man-in-the-browser attacks. In: Proceedings Title: 2012 International Conference on Cyber Security, Cyber Warfare and Digital Forensic (CyberSec), pp. 271–276. IEEE (2012)

    Google Scholar 

  19. Rauti, S., Leppänen, V.: Man-in-the-browser attacks in modern web browsers. In: Emerging Trends in ICT Security, pp. 469–480. Elsevier (2014)

    Google Scholar 

  20. Rauti, S., Parisod, H., Aromaa, M., Salanterä, S., Hyrynsalmi, S., Lahtiranta, J., Smed, J., Leppänen, V.: A proxy-based security solution for web-based online ehealth services. In: International Conference on Well-Being in the Information Society, pp. 168–176. Springer, Cham (2014)

    Google Scholar 

  21. Rautila, M., Suomalainen, J.: Secure inspection of web transactions. Int. J. Internet Technol. Secur. Trans. 4(4), 253–271 (2012)

    Article  Google Scholar 

  22. Ronchi, C., Zakhidov, S.: Hardened client platforms for secure internet banking. In: ISSE 2008 Securing Electronic Business Processes, pp. 367–379. Springer, Cham (2009)

    Google Scholar 

  23. SafeNet: Safenet etoken 3500 (2011). https://www.pronew.com.tw/download/doc/eToken3500_PB_(EN)_web.pdf

  24. Saisudheer, A., Tech, M.: Smart phone as software token for generating digital signature code for signing in online banking transaction. Int. J. Comput. Eng. Sci. 3(12), 1–4 (2013)

    Google Scholar 

  25. Ståhlberg, M.: The trojan money spinner. In: Virus Bulletin Conference, vol. 4 (2007)

    Google Scholar 

  26. Ter Louw, M., Lim, J.S., Venkatakrishnan, V.N.: Enhancing web browser security against malware extensions. J. Comput. Virol. 4(3), 179–195 (2008)

    Article  Google Scholar 

  27. Toreini, E., Shahandashti, S.F., Mehrnezhad, M., Hao, F.: Domtegrity: ensuring web page integrity against malicious browser extensions. Int. J. Inf. Secur. 18, 1–14 (2019)

    Article  Google Scholar 

  28. Tsai, K.: Addressing new NIST authentication guidelines with symantec VIP (2016). https://www.symantec.com/connect/blogs/addressing-new-nist-authentication-guidelines-symantec-vip

  29. Tsuchiya, T., Fujita, M., Takahashi, K., Kato, T., Magata, F., Teshigawara, Y., Sasaki, R., Nishigaki, M.: Secure communication protocol between a human and a bank server for preventing man-in-the-browser attacks. In: International Conference on Human Aspects of Information Security, Privacy, and Trust, pp. 77–88. Springer, Cham (2016)

    Google Scholar 

  30. Utakrit, N.: Review of browser extensions, a man-in-the-browser phishing techniques targeting bank customers (2009)

    Google Scholar 

  31. Van Acker, S., Nikiforakis, N., Desmet, L., Piessens, F., Joosen, W.: Monkey-in-the-browser: malware and vulnerabilities in augmented browsing script markets. In: Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security, pp. 525–530. ACM (2014)

    Google Scholar 

  32. Wang, L., Xiang, J., Jing, J., Zhang, L.: Towards fine-grained access control on browser extensions. In: International Conference on Information Security Practice and Experience, pp. 158–169. Springer, Cham (2012)

    Google Scholar 

  33. Weigold, T., Kramp, T., Hermann, R., Höring, F., Buhler, P., Baentsch, M.: The Zurich trusted information channel–an efficient defence against man-in-the-middle and malicious software attacks. In: International Conference on Trusted Computing, pp. 75–91. Springer, Cham (2008)

    Google Scholar 

  34. Zhang, P., He, Y., Chow, K.: Fraud track on secure electronic check system. Int. J. Digital Crime Forensics 10(2), 137–144 (2018)

    Article  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. University of Turku, Turku, Finland

    Sampsa Rauti

Authors
  1. Sampsa Rauti
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Sampsa Rauti .

Editor information

Editors and Affiliations

  1. Scientific Network for Innovation and Research Excellence, Machine Intelligence Research Labs (MIR), Auburn, WA, USA

    Ajith Abraham

  2. School of Computer Science and Engineering, VIT Bhopal University, Bhopal, Madhya Pradesh, India

    Shishir K. Shandilya

  3. Area of Project Engineering, University of Cordoba, Córdoba, Spain

    Laura Garcia-Hernandez

  4. Escola de Engenharia, Universidade do Minho, Guimarães, Portugal

    Maria Leonilde Varela

Rights and permissions

Reprints and permissions

Copyright information

© 2021 The Editor(s) (if applicable) and The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Rauti, S. (2021). A Survey on Countermeasures Against Man-in-the-Browser Attacks. In: Abraham, A., Shandilya, S., Garcia-Hernandez, L., Varela, M. (eds) Hybrid Intelligent Systems. HIS 2019. Advances in Intelligent Systems and Computing, vol 1179. Springer, Cham. https://doi.org/10.1007/978-3-030-49336-3_40

Download citation

Publish with us

Policies and ethics

Search

Navigation