Man-in-the-Browser Targets Enterprise Employees
Tunnelling in via employees' browsers exploits the weakest link in the security chain.
A new security threat sees attackers able to penetrate enterprise computer systems simply by exploiting the weakest link in the security chain. The "Man-in-the-Browser" (MitB) attack method has attackers tunnelling in via employees' browsers. As reported on IDG, MitB enables attackers to silently steal anything from login credentials to account numbers or financial information as browser sessions often containing the logon details for email systems, VPNs and cloud services.
"This modern malware is designed to slip under the radar of traditional antivirus solutions and bypass strong authentication technologies like tokens or network access control (NAC) systems. It then captures all data processed by that browser and transmits it back to the criminals. All this can be achieved without setting off alarms.
"We recently decrypted an attack on the popular Citrix Access Gateway by the Zeus Trojan that illustrates how criminals are trying to stay one step ahead of security controls."
