What is the Browser-in-Browser?
A Browser-in-Browser (BiTB) attack uses a faked domain to simulate a login window within a parent browser window to obtain login information. This browser-in the browser phishing tactic uses the Single Sign-On authentication mechanism to deceive users into disclosing sensitive information, primarily their login credentials. Users are presented with a fake pop-up that mimics the appearance and feel of an actual SSO authentication window. Since the SSO authentication mechanism has been used for so long, most users are no longer suspicious of it.
A login prompt window can be imitated using a few lines of HTML and CSS to fake the domain name, interface, and SSL certificate indication. Without batting an eye, the victim enters their login information. As soon as they press Enter on their keyboard, they reveal their entire virtual world and everything associated with it.
Figure 01:- How to identify if the login window is fake?
Genuine login windows behave like browser windows. They can be moved around the screen, maximised, and minimised. False pop-ups are tied to the page on which they appear. They are also free to move around and hide pictures and buttons. That distinction ought to make them easier to identify.
The following guidelines can be used to identify whether the screen’s login form is fake.
Reduce the size of the browser tab where the form appeared. It is a fake if the stated secondary window with the login form also closes. A genuine window needs to remain visible.
Try dragging the login window past the parent window’s edge. A genuine window can pass over quickly, while a false one will become stuck.
You shouldn’t submit your credentials if the login form’s window acts strangely, such as by minimising with another window, stopping under the address bar, or disappearing under it.
The following picture shows what an actual login window for a third-party service looks like:
How is a Browser-in-the-Browser Attack set up?
Since this phishing tactic relies on SSO authentication, the cybercriminal must first set up a false SSO authentication on the target’s end before directing them to the infected website. The target registers using the fake SSO, and the attacker stores the target’s login information in their database.
Although the method appears complex in principle, it is straightforward to automate these processes using a phishing framework and web page templates. The vital component of a BitB attack, templates for Google, Facebook, and Apple login screens, have previously been made public by security experts.
Businesses that provide single sign-on to their customers so they may access all their applications seamlessly are at a higher risk of compromising sensitive customer data by falling to these browsers in browser attacks. To secure their customers’ personal information, the companies that provide SSO capabilities must be aware of the risks involved with SSO and implement strict security measures.
How can we protect ourselves from Browser in Browser Attacks?
The attack is less dangerous than it might initially appear. Even though it can be challenging for humans to recognise a browser-in-browser attack, your computer can still assist. The genuine address, which matters to a security solution, remains the same regardless of what is programmed on a harmful site. Here is some browser in browser attack prevention tips.
Use a password manager for all of your accounts. No matter how authentic a site may appear, it will never submit your credentials into its fields since it verifies the page’s URL.
Install a reliable security program that includes a phishing-prevention module. This solution will also check the URL for you and immediately inform you if a page is hazardous.
Remember to use two-factor authentication. Anywhere you have the option, enable it, including on social media. A one-time code will then be delivered to you, not the attackers, preventing them from accessing your account even if they manage to steal your login information.
Browser in Browser Attack Tutorial or Prevention Tips
These are the general ways to protect from Browser in Browser Attacks. When it comes to businesses, they have a higher risk of exposing to this kind of threat, and the companies should be more aware of methods that help to protect from this kind of threat. Following are some tips to protect your business.
- Incorporating multi-factor authentication (MFA)
MFA, often known as multi-factor authentication, is a multi-layered security mechanism that confirms users’ identities before logins and other transactions. The user account will stay secure by utilising multiple authentication layers, even if one is broken or rendered inoperable. A few instances of multi-factor authentication used in everyday situations include fingerprints, codes generated by smartphone apps, answers to personal security questions, codes delivered to an email address, etc.
By incorporating MFA into your security strategy, you can ensure your users’ identities are protected during browser attacks while providing strong security for your sensitive business data. A very effective method of boosting security against BITB attacks is using software or even hardware tokens for dual identity verification.
- Choosing risk-based authentication (RBA)
RBA is a technique for applying different levels of rigour to authentication procedures based on the risk that access to a particular system could be compromised. Authentication becomes increasingly stringent as the degree of danger rises.
Therefore, RBA automatically adds a second layer of authentication in a high-risk scenario like a BITB attack, protecting the user’s identity. A cloud-based consumer identity and access management (CIAM) platform can implement risk-based authentication, limiting unwanted access even when consumers use single sign-on options.
- Zero trust architecture
The security idea of “zero trust” holds that businesses shouldn’t immediately trust any device or person, whether inside or outside their perimeters and should carefully check everything before providing access.
In brief, the zero trust philosophy is based on the adage “don’t trust anyone.” This architecture disables all access points until sufficient validation and mutual trust have been achieved.
The system must confirm the identity of the person or device requesting access to the IP address, instrument, or storage before access is granted.
We can protect our devices and information from these Browser attacks by relying on the above security methods. In the next topic, what is a man-in-the-browser attack.
