A Survey on Countermeasures Against Man-in-the-Browser Attacks

1. Almeshekah, M.H., Atallah, M.J., Spafford, E.H.: Enhancing passwords security using deceptive covert communication. In: IFIP International Information Security and Privacy Conference, pp. 159–173. Springer, Cham (2015)

   Google Scholar 

2. Biedermann, S., Ruppenthal, T., Katzenbeisser, S.: Data-centric phishing detection based on transparent virtualization technologies. In: 2014 Twelfth Annual International Conference on Privacy, Security and Trust, pp. 215–223. IEEE (2014)

   Google Scholar 

3. Blom, A., de Koning Gans, G., Poll, E., De Ruiter, J., Verdult, R.: Designed to fail: a USB-connected reader for online banking. In: Nordic Conference on Secure IT Systems, pp. 1–16. Springer, Cham (2012)

   Google Scholar 

4. Buescher, A., Leder, F., Siebert, T.: Banksafe information stealer detection inside the web browser. In: International Workshop on Recent Advances in Intrusion Detection, pp. 262–280. Springer, Cham (2011)

   Google Scholar 

5. Chow, Y.W., Susilo, W., Yang, G., Au, M.H., Wang, C.: Authentication and transaction verification using QR codes with a mobile device. In: International Conference on Security, Privacy and Anonymity in Computation, Communication and Storage, pp. 437–451. Springer, Cham (2016)

   Google Scholar 

6. Dmitrienko, A., Liebchen, C., Rossow, C., Sadeghi, A.R.: On the (in)security of mobile two-factor authentication. In: Christin, N., Safavi-Naini, R. (eds.) Financial Cryptography and Data Security, pp. 365–383. Springer, Heidelberg (2014)

   Google Scholar 

7. Dougan, T., Curran, K.: Man in the browser attacks. Int. J. Ambient Comput. Intell. (IJACI) 4(1), 29–39 (2012)

   Article  Google Scholar 

8. Entrust: Defeating man-in-the-browser malware – how to prevent the latest malware attacks against consumer and corporate banking. White paper (2014)

   Google Scholar 

9. Garcia-Cervigon, M., Llinàs, M.M.: Browser function calls modeling for banking malware detection. In: 2012 7th International Conference on Risks and Security of Internet and Systems (CRiSIS), pp. 1–7. IEEE (2012)

   Google Scholar 

10. Gezer, A., Warner, G., Wilson, C., Shrestha, P.: A flow-based approach for trickbot banking trojan detection. Comput. Secur. 84, 179–192 (2019)

    Google Scholar 

11. Goyal, P., Bansal, N., Gupta, N.: Averting man in the browser attack using user-specific personal images. In: 3rd IEEE International Advance Computing Conference (IACC), pp. 1283–1286. IEEE (2013)

    Google Scholar 

12. Guha, A., Fredrikson, M., Livshits, B., Swamy, N.: Verified security for browser extensions. In: IEEE Symposium on Security and Privacy. IEEE 2011, pp. 115–130 (2011)

    Google Scholar 

13. Gühring, P.: Concepts against man-in-the-browser attacks. Technical report (2006)

    Google Scholar 

14. Jia, Y., Chen, Y., Dong, X., Saxena, P., Mao, J., Liang, Z.: Man-in-the-browser-cache: persisting https attacks via browser cache poisoning. Comput. Secur. 55, 62–80 (2015)

    Article  Google Scholar 

15. Konoth, R.K., van der Veen, V., Bos, H.: How anywhere computing just killed your phone-based two-factor authentication. In: International Conference on Financial Cryptography and Data Security, pp. 405–421. Springer, Cham (2016)

    Google Scholar 

16. Liu, L., Zhang, X., Yan, G., Chen, S., et al.: Chrome extensions: threat analysis and countermeasures. In: NDSS (2012)

    Google Scholar 

17. Marouf, S., Shehab, M.: Towards improving browser extension permission management and user awareness. In: 8th International Conference on Collaborative Computing: Networking, Applications and Worksharing (CollaborateCom), pp. 695–702. IEEE (2012)

    Google Scholar 

18. Nor, F.B.M., Jalil, K.A., et al.: An enhanced remote authentication scheme to mitigate man-in-the-browser attacks. In: Proceedings Title: 2012 International Conference on Cyber Security, Cyber Warfare and Digital Forensic (CyberSec), pp. 271–276. IEEE (2012)

    Google Scholar 

19. Rauti, S., Leppänen, V.: Man-in-the-browser attacks in modern web browsers. In: Emerging Trends in ICT Security, pp. 469–480. Elsevier (2014)

    Google Scholar 

20. Rauti, S., Parisod, H., Aromaa, M., Salanterä, S., Hyrynsalmi, S., Lahtiranta, J., Smed, J., Leppänen, V.: A proxy-based security solution for web-based online ehealth services. In: International Conference on Well-Being in the Information Society, pp. 168–176. Springer, Cham (2014)

    Google Scholar 

21. Rautila, M., Suomalainen, J.: Secure inspection of web transactions. Int. J. Internet Technol. Secur. Trans. 4(4), 253–271 (2012)

    Article  Google Scholar 

22. Ronchi, C., Zakhidov, S.: Hardened client platforms for secure internet banking. In: ISSE 2008 Securing Electronic Business Processes, pp. 367–379. Springer, Cham (2009)

    Google Scholar 

23. SafeNet: Safenet etoken 3500 (2011). https://www.pronew.com.tw/download/doc/eToken3500_PB_(EN)_web.pdf

24. Saisudheer, A., Tech, M.: Smart phone as software token for generating digital signature code for signing in online banking transaction. Int. J. Comput. Eng. Sci. 3(12), 1–4 (2013)

    Google Scholar 

25. Ståhlberg, M.: The trojan money spinner. In: Virus Bulletin Conference, vol. 4 (2007)

    Google Scholar 

26. Ter Louw, M., Lim, J.S., Venkatakrishnan, V.N.: Enhancing web browser security against malware extensions. J. Comput. Virol. 4(3), 179–195 (2008)

    Article  Google Scholar 

27. Toreini, E., Shahandashti, S.F., Mehrnezhad, M., Hao, F.: Domtegrity: ensuring web page integrity against malicious browser extensions. Int. J. Inf. Secur. 18, 1–14 (2019)

    Article  Google Scholar 

28. Tsai, K.: Addressing new NIST authentication guidelines with symantec VIP (2016). https://www.symantec.com/connect/blogs/addressing-new-nist-authentication-guidelines-symantec-vip

29. Tsuchiya, T., Fujita, M., Takahashi, K., Kato, T., Magata, F., Teshigawara, Y., Sasaki, R., Nishigaki, M.: Secure communication protocol between a human and a bank server for preventing man-in-the-browser attacks. In: International Conference on Human Aspects of Information Security, Privacy, and Trust, pp. 77–88. Springer, Cham (2016)

    Google Scholar 

30. Utakrit, N.: Review of browser extensions, a man-in-the-browser phishing techniques targeting bank customers (2009)

    Google Scholar 

31. Van Acker, S., Nikiforakis, N., Desmet, L., Piessens, F., Joosen, W.: Monkey-in-the-browser: malware and vulnerabilities in augmented browsing script markets. In: Proceedings of the 9th ACM Symposium on Information, Computer and Communications Security, pp. 525–530. ACM (2014)

    Google Scholar 

32. Wang, L., Xiang, J., Jing, J., Zhang, L.: Towards fine-grained access control on browser extensions. In: International Conference on Information Security Practice and Experience, pp. 158–169. Springer, Cham (2012)

    Google Scholar 

33. Weigold, T., Kramp, T., Hermann, R., Höring, F., Buhler, P., Baentsch, M.: The Zurich trusted information channel–an efficient defence against man-in-the-middle and malicious software attacks. In: International Conference on Trusted Computing, pp. 75–91. Springer, Cham (2008)

    Google Scholar 

34. Zhang, P., He, Y., Chow, K.: Fraud track on secure electronic check system. Int. J. Digital Crime Forensics 10(2), 137–144 (2018)

    Article  Google Scholar 

Download references