Man-in-the-browser

Man-in-the-browser (MITB, MitB, MIB, MiB), a form of Internet <a href="/facts/Threat_(computer)/5RHTbSac">threat</a> related to <a href="/facts/Man-in-the-middle/dx4cojdz">man-in-the-middle</a> (MITM), is a <a href="/facts/Proxy_server/ArhwQE74">proxy</a> <a href="/facts/Trojan_horse_(computing)/FVqh3nDy">Trojan horse</a> that infects a <a href="/facts/Web_browser/2pfyymLs">web browser</a> by taking advantage of vulnerabilities in <a href="/facts/Browser_security/A2zlbTz7">browser security</a> to modify <a href="/facts/Web_pages/5JK7xQLe">web pages</a>, modify transaction content or insert additional transactions, all in a covert fashion invisible to both the user and host <a href="/facts/Web_application/BLkF3BIN">web application</a>. A MitB <a href="/facts/Attack_(computing)/6PSQzq7y">attack</a> will be successful irrespective of whether security mechanisms such as <a href="/facts/Secure_Sockets_Layer/pGy16TnA">SSL</a>/<a href="/facts/Public_key_infrastructure/7fwMLxF4">PKI</a> and/or <a href="/facts/Two-factor_authentication/186gpx8R">two-</a> or <a href="/facts/Multi-factor_authentication/186gpx8R">three-factor authentication</a> solutions are in place. A MitB attack may be countered by using <a href="/facts/Out-of-band_data/K8UX1jR7">out-of-band</a> transaction verification, although <a href="/facts/SMS/kacRfW0X">SMS</a> verification can be defeated by man-in-the-mobile (MitMo) <a href="/facts/Mobile_virus/mANhJ67J">malware</a> infection on the <a href="/facts/Mobile_phone/H3EcqD9h">mobile phone</a>. Trojans may be detected and removed by antivirus software, but a 2011 report concluded that additional measures on top of antivirus software were needed.[needs update]
A related, simpler attack is the boy-in-the-browser (BitB, BITB).
The majority of financial service professionals in a 2014 survey considered MitB to be the greatest threat to <a href="/facts/Online_banking/lYdBsukr">online banking</a>.

Man-in-the-browser open-in-new

Man-in-the-browser