Protecting Crypto Exchanges From A New Wave Of MitB Attacks
summary
Crypto exchanges face real Man‑in‑the‑Browser campaigns (Zeus Panda Ramnit Trickbot) that inject a one‑line first‑stage script into every endpoint, grab credentials, then prompt users to hand over 2FA and downgrade security. The demo uses a local proxy and a fake C2 to reproduce the flow, shows CSP and X‑Frame mistakes, and proves SMS/Google Auth are bypassable. A JavaScript real‑time monitoring agent leveraging Mutation Observers and checksums reports tampering to a backend and supports DOM healing; the proof‑of‑concept detects injections in seconds and can block or freeze risky actions.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:44What is a MitB
- 4:15Browser MitBs
- 6:08How secure are crypto exchanges
- 6:41Crypto changes
- 14:10CSP
- 16:23Main Topic
- 19:11Attack
- 22:00Demo
- 26:26Insights
- 29:31Application RealTime Monitoring
- 38:54Cryptic Changes
- 44:07Questions
related talks
54mCrafting the next-generation Man-in-the-Browser Trojan
40mHostile JavaScript: Attacking and Defending the Browser
43mBypassing Malware Detection Mechanisms in Online Banking
24mBitcoin Web Application Security
52mFlying Under the Radar - New Security Evasion Techniques
38mCaught My WebApp Cheating on Me!
46mExploiting CORS Misconfigurations for Bitcoins and Bounties
50mBots have gone phishing, but all they get is the boot