Crafting the next-generation Man-in-the-Browser Trojan
summary
A proof-of-concept MITB is implemented as a Chrome extension (built from Zeus code) that uses the webRequest API to remove headers (CSP/HPKP/HSTS), injects dynamic and polymorphic JavaScript via dynamic content scripts to perform webinjects and form grabbing, captures screenshots, and talks to distributed encrypted C2s; response bodies can’t be rewritten so DOM mutation is used instead. Infection relies on side-loading or phishing, AVs miss polymorphic JS, and detection is proposed as real-time DOM monitoring with whitelisting, automated reactions and machine learning to reduce false positives.
AI-written summary · about
chapters (40)
- 0:00Introduction
- 0:50What are ManintheBrowser attacks
- 1:47History of JEN
- 2:59Timba
- 3:23Trojan Capabilities
- 4:07Top 10 Trojan Variants
- 4:24Financial Losses
- 5:34Content Security Policy
- 6:54HTTP Public Key Pinning
- 8:25SSL Transport Security
- 8:50Headers
- 9:56Trojan
- 10:56Starting point
- 12:50Extensions are dangerous
- 14:42Requirements
- 16:19C2 Requirements
- 17:00Web Requests API
- 18:55Can you modify the response body
- 19:47Debugging the browser
- 20:06Changing the DOM
- 20:32Architecture
- 21:21Demos
- 21:44Testing
- 26:23Grabber
- 30:26Dumb Taming
- 32:41Strategy
- 34:12Polymorphism
- 34:55Our thoughts
- 35:40Other solutions
- 36:44Realtime monitoring
- 37:58Final demo
- 41:51Wrapping up
- 43:44Conclusion
- 44:15How easy is it
- 45:00Traditional approach
- 45:47Who can be tricked
- 46:26Extension icons
- 47:59Missing
- 48:29Mozilla
- 52:00CSP in Meta Tags
related talks
53mProtecting Crypto Exchanges From A New Wave Of MitB Attacks
40mHostile JavaScript: Attacking and Defending the Browser
44mWhen you can't afford 0days: Client-side exploitation for the masses
29mUnraveling the Threat of Chrome Based Malware
48mA Weakness In Chrome & A New Hacking Technique
38mCaught My WebApp Cheating on Me!
45mThe evil friend in your browser
31mBuilding your first malicious chrome extension 😈