Man‑in‑the‑Middle (MitM) vs. Man‑in‑the‑Browser (MitB) Man‑in‑the‑Middle (MitM) An attacker intercepts or manipulates communication between the user and the server at the network layer. Techniques include connecting to fake Wi-Fi hotspots, intercepting ARP or DNS traffic, or stripping SSL/TLS encryption. Common tactics: ARP poisoning, DNS spoofing, SSL stripping, and session hijacking via spoofed certificates. Man‑in‑the‑Browser (MitB) Attack Chains and Flow An attacker compromises the user’s web browser inside the device, typically via a Trojan or malicious extension. It intercepts or alters sessions in real-time, after SSL and any 2FA, without causing noticeable anomalies in the network. MitM attack flow: User → (ARP/DNS spoof via network) → Attacker relays/manipulates traffic → Destination server • Interception happens before data encryption. An attacker may eavesdrop, replay, or modify data in transit. MitB attack flow: User → Browser (already compromised via local Trojan) → Malicious code injects or modifies forms/DOM → Secure server sees manipulated data. • Happens inside the browser, fully after TLS encryption; invisible to network security tools. MitM vs. MitB Aspects Location Encryption impact Visibility Detection Notable tools MitM Between devices (network layer) Bypass or downgrade encryption Can leave traces: latency, cert warnings, IDS alerts Possible by monitoring brokering anomalies or cert mismatches ARP/DNS spoof tools, SSL strip proxies MitB Within the browser (application layer) Unaffected by encryption; operates post-TLS No network anomalies; stealthy and invisible Detection relies on endpoint heuristics or antivirus (often fails) Banking Trojans: Zeus, SpyEye, Tinba, etc. Warning Signals and Detection Clues For MitM: • Browser warnings about invalid TLS certificates or HTTP-only fallbacks. • Abnormal TCP/IP delays, suspicious high-latency DNS resolutions. • ARP cache inconsistencies, e.g., identical MAC addresses for different IPs. For MitB: • Browser slowdown, unusual GUI behavior, phantom popups, or input fields during transactions. • Endpoint antivirus might not detect the attack; network traffic looks normal. • Users can complete a valid login and 2FA, but the transaction is silently altered. Defense Strategies and Mitigations MitM Hardening: • Enforce HTTPS via HSTS, strong TLS configurations, and certificate pinning. • Avoid public/untrusted Wi-Fi; require VPN or authenticated WPA3 or better. • Deploy ARP/DNS monitoring and static ARP entries to spot cache poisoning. MitB Defense Measures: • Restrict browser extensions to verified vendors; whitelist only necessary add-ons. • Deploy sandboxed or hardened browsers (e.g., Trusteer Rapport), isolating sensitive sessions. • Use out-of-band transaction verification (e.g., a cryptogram on a banking app) to thwart form-injection even after TLS. SMS OTP is vulnerable to MitMo variants. • Maintain up-to-date OS, browser, and endpoint detection tools; restrict local install rights (principle of least privilege).