Caught My WebApp Cheating on Me!
summary
Web applications are routinely altered in the browser: examples include the 2015 Dridex man‑in‑the‑browser theft of at least $50M and a supply‑chain jQuery compromise; the demo shows a malicious banner removed and onsubmit handlers poisoned to exfiltrate credentials and swap transaction destinations. A client‑side agent uses Mutation Observers, integrity checksums and native‑API poisoning detection, sends real‑time webhooks to a backend, applies machine‑learning for false positives and executes countermeasures like DOM healing, redirects and cookie wipes. The agent protects itself with polymorphic JavaScript and debugger detection.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:52Client-side integrity threats
- 7:24Common vulnerabilities overview
- 10:17Malicious browser extensions
- 11:19Man-in-the-browser attacks
- 12:46Limitations of current defenses
- 13:09Real-time monitoring approach
- 17:22Demo setup and compromised profile
- 20:53Demo of real-time monitoring solution
- 27:07Demo results and takeaways
- 29:18Caught our own web app cheating
- 31:06Conclusions and recommendations
- 33:25Q&A on false positives
- 36:25Q&A on tamper-proofing agent
