ManโinโtheโMiddle (MitM) vs. ManโinโtheโBrowser (MitB) ManโinโtheโMiddle (MitM) An attacker intercepts or manipulates communication between the user and the server at the network layer. Techniques include connecting to fake Wi-Fi hotspots, intercepting ARP or DNS traffic, or stripping SSL/TLS encryption. Common tactics: ARP poisoning, DNS spoofing, SSL stripping, and session hijacking via spoofed certificates. ManโinโtheโBrowser (MitB) Attack Chains and Flow An attacker compromises the userโs web browser inside the device, typically via a Trojan or malicious extension. It intercepts or alters sessions in real-time, after SSL and any 2FA, without causing noticeable anomalies in the network. MitM attack flow: User โ (ARP/DNS spoof via network) โ Attacker relays/manipulates traffic โ Destination server โข Interception happens before data encryption. An attacker may eavesdrop, replay, or modify data in transit. MitB attack flow: User โ Browser (already compromised via local Trojan) โ Malicious code injects or modifies forms/DOM โ Secure server sees manipulated data. โข Happens inside the browser, fully after TLS encryption; invisible to network security tools. MitM vs. MitB Aspects Location Encryption impact Visibility Detection Notable tools MitM Between devices (network layer) Bypass or downgrade encryption Can leave traces: latency, cert warnings, IDS alerts Possible by monitoring brokering anomalies or cert mismatches ARP/DNS spoof tools, SSL strip proxies MitB Within the browser (application layer) Unaffected by encryption; operates post-TLS No network anomalies; stealthy and invisible Detection relies on endpoint heuristics or antivirus (often fails) Banking Trojans: Zeus, SpyEye, Tinba, etc. Warning Signals and Detection Clues For MitM: โข Browser warnings about invalid TLS certificates or HTTP-only fallbacks. โข Abnormal TCP/IP delays, suspicious high-latency DNS resolutions. โข ARP cache inconsistencies, e.g., identical MAC addresses for different IPs. For MitB: โข Browser slowdown, unusual GUI behavior, phantom popups, or input fields during transactions. โข Endpoint antivirus might not detect the attack; network traffic looks normal. โข Users can complete a valid login and 2FA, but the transaction is silently altered. Defense Strategies and Mitigations MitM Hardening: โข Enforce HTTPS via HSTS, strong TLS configurations, and certificate pinning. โข Avoid public/untrusted Wi-Fi; require VPN or authenticated WPA3 or better. โข Deploy ARP/DNS monitoring and static ARP entries to spot cache poisoning. MitB Defense Measures: โข Restrict browser extensions to verified vendors; whitelist only necessary add-ons. โข Deploy sandboxed or hardened browsers (e.g., Trusteer Rapport), isolating sensitive sessions. โข Use out-of-band transaction verification (e.g., a cryptogram on a banking app) to thwart form-injection even after TLS. SMS OTP is vulnerable to MitMo variants. โข Maintain up-to-date OS, browser, and endpoint detection tools; restrict local install rights (principle of least privilege).