Log In / Register

Search FAQ

* Search

• Frequently Asked Questions:
  • Browser Attack Questions:

What is a Man In The Browser Attack?

Protect your sensitive information from Man-in-the-Browser (MITB) attacks with 3rdKey.com. This security solution safeguards against hidden browser vulnerabilities that intercept online communication, often without user detection. By integrating a third key, we ensure an extra layer of security, making online transactions safer. With no cross-tab communication and transaction validation options, your data is always secure, even if attackers target your browser. Take control of your digital security—use 3rdKey.com to enable the protection you need.

• Man-in-the-Browser (MITB) attacks are unlike other attacks, in that the browser itself has been changed through a virus, browser help object, user script, or Active X control.
• The "virus" is downloaded by the end user, it then "infects" the browser, and then the browser looks for specific web sites and intercepts the communication between the user and the web site.
• There is no way for the server to detect a MITB attack.
• The end user can only detect a MITB attack if they notice a difference in the normal behaviour of the web site. Unfortunately, since the end user will normally trust the site, like their bank, and sites often change their look and feel, its very difficult to detect when a MITB attack is occuring.
• The conventional way to intercept MITB attacks is for the server to use another device for confirmation of the transaction details.
• For example, if you enter a money transfer into your bank site, the bank should send you an SMS message with the amount and account number of the transfer, and you must reply to that SMS to validate the transfer.
• Reference: entrust.com March 2014 pdf
• Unfortunately, you often are using the same device for both the transaction and the verification. Most people, for example will be using their phone to validate the transaction which they are trying to perform on their phone.
• To truly get another method of verification, 3rdkey.com uses the 3rd key, which only you know, in combination with unique session information, to prove that you are who you say you are, rather than the physical device which might have fallen into the wrong hands.

---

• Browser Attack Questions

---