{"id":45783,"date":"2022-03-18T20:56:23","date_gmt":"2022-03-18T20:56:23","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/this-browser-in-browser-attack-is-perfect-for-phishing\/"},"modified":"2022-03-18T20:56:23","modified_gmt":"2022-03-18T20:56:23","slug":"this-browser-in-browser-attack-is-perfect-for-phishing","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/this-browser-in-browser-attack-is-perfect-for-phishing\/","title":{"rendered":"This browser-in-browser attack is perfect for phishing"},"content":{"rendered":"

A novel way of tricking people out of their passwords has left us wondering if there’s a need to rethink how much we trust our web browsers to protect us and to accelerate efforts to close web security gaps.<\/p>\n

Earlier this week, an infosec researcher known as mr.d0x described a browser-in-the-browser<\/a> (BitB) attack. It’s a way to steal login credentials by simulating the little browser windows that Google, Microsoft, and other authentication service providers pop up that ask you for your username and password to continue. You’ve probably seen these windows: you click on something like a “Sign in with Microsoft” button on a website, and popup appears asking for your credentials to access your account or profile.<\/p>\n

Services like Google Sign-In will display a Google URL in the popup window navigation bar, which offers some reassurance that the login service is actually coming from a trusted company and not an unknown one. And bypassing defenses built into the user’s browser to fool them into trusting a malicious page tends to be difficult in the absence of an exploitable vulnerability, thanks to browser security mechanisms including Content Security Policy<\/a> settings and the Same-origin policy<\/a> security model.<\/p>\n