CAPEC-701 Browser in the Middle (BiTM)

An adversary exploits the inherent functionalities of a web browser, in order to establish an unnoticed remote desktop connection in the victim's browser to the adversary's system. The adversary must deploy a web client with a remote desktop session that the victim can access.

Unlike Adversary in the Browser, the victim does not need to install a malicious application. Browser in the Middle uses the inherent functionalities of a web browser to convince the victim they are browsing normally under the assumption that the connection is secure. All the actions performed by the victim in the open window are actually performed on the machine of the adversary. These victim-authenticated sessions are available to the adversary to use. All entered data such as passwords and usernames can be logged by the adversary and the content displayed to the victim can be altered arbitrarily. Varieties of multifactor authentication which rely solely on user input and do not use a form of hardware-based secret exchange are vulnerable to browser in the middle.

1. [Explore] [Identify potential targets] The adversary identifies an application or service that the target is likely to use. 2. [Experiment] [Lure victims] The adversary crafts a phishing campaign to lure unsuspecting victims into using the transparent browser. 3. [Exploit] [Monitor and Manipulate Data] When the victim establishes the connection to the transparent browser, the adversary can view victim activity and make alterations to what the victim sees when browsing the web.

• The adversary must create a convincing web client to establish the connection. The victim then needs to be lured onto the adversary's webpage. In addition, the victim's machine must not use local authentication APIs, a hardware token, or a Trusted Platform Module (TPM) to authenticate.

• [Medium]

• Confidentiality, Access Control, Authentication: Gain Privileges • Confidentiality, Authorization: Read Data • Integrity: Modify Data

• Implementation: Use strong, mutual authentication to fully authenticate with both ends of any communications channel