Man-In-The-Browser: Emerging Attacks Exploit Browser Vulnerabilities

A new form of man-in-the-middle attack, called "man-in-the-browser," has surfaced. These attacks can bypass current browser security mechanisms to read, insert, and modify transaction data. Although actual attacks are rare, the technology for launching this type of attack is readily available. Firms that conduct high-value financial transactions over the Web are particularly at risk. So, what should enterprises do to protect themselves against this new threat? While client security products are not yet equipped to handle this new breed of attack, a number of short-term solutions exist to offer temporary protection. A longer-term solution lies in transaction verification. Organizations that do business online should re-evaluate their solution road maps and incorporate transaction verification as a core component of their overall security strategy.