Web Browser Attacks & How To Combat Them

Until only recently, most of us knew work as a place where you went. As children, our parents would leave the house and return nine hours later, having physically ‘gone to work’. Today, however, work isn’t a place you go, but something you do.  We’re no longer tied to an office or worksite in the new normal. Today, many of us have the freedom to log onto our company network as it suits us - from the office, at home, or on the go.  

Widespread shifts to more flexible working that we saw take hold during the pandemic and prevail post-Covid have seen organisations shift their operating models and IT infrastructure to the cloud, paving the way for the browser to become one of the most critical business tools. 

Almost all work is now carried out on the internet. Indeed, Google has reported that end users spend an average of 75 percent of their workday using a web browser. From a greater work life balance to boosted productivity and improved staff retention, both employees and employers have seen the benefits of remote and hybrid models. However, this shift has also presented a series of new and evolving risks that companies are now faced with managing and mitigating. 

Where users can use the internet to access sensitive data within applications and SaaS platforms using a variety of devices in a variety of locations, the web browser has become the biggest attack surface available to threat actors, who are actively leveraging and exploiting it. 

Indeed, many attackers have been adapting their methods in order to capitalise on a series of new opportunities.  

At Menlo, we’ve witnessed a significant ramp up in the deployment of techniques specifically designed to evade traditional layers of detection, such as firewalls, secure web gateways (SWGs), malware analysis engines, and phishing detection tools, enabling the efforts of threat attackers to slip under the radar.  
Here we outline four browser-based attack methods that we’re frequently observing.  

1.    HTML Smuggling

HTML smuggling and/or JavaScript trickery is often used within browser environments as a means of bypassing content inspection engines, enabling attacks to deliver malicious payloads to target endpoints. This technique relies upon the malicious file being dynamically constructed inside the browser to ensure there are no resource requests for a remote file that can be inspected. Significantly, even file types that would typically be blocked by SWG engines can still make it to the endpoint without any user interaction. 

2.    Malicious Links

Malicious links are a common tactic used by threat actors, sent not just via email but equally through social media, SMS messages, shared documents and more. When these methods are used in combination with HTML smuggling, content inspection engines become blind to any risk, incapable of identifying the dynamic generation of a file within the browser beyond typical network security perimeter controls. 

 3.    ‘Good2Bad’ Websites

‘Good2Bad’ websites are a third technique that see attackers leveraging benign websites for malicious activities to circumvent web categorisation. Specifically, these are used to support malicious intent for brief periods before reverting to their original benign state. Notably, between 2019 and 2021, Menlo Labs identified a massive 958% increase in the use of Good2Bad sites.  

 4.    Evasive HTTP Traffic Inspection Techniques

Fourthly, several browser exploits such as phishing kit code, crypto-mining code and the impersonation of brand logos can be generated using JavaScript in the browser to avoid detection from static signatures that typically examine web page source code and HTTP traffic. Such methods again render traditional detection tools that are deployed prior to web page execution largely useless. 

Defending Against Browser-Based Threats 

Attackers are finding new ways to bypass legacy security solutions that are simply not equipped for modern ways of working.  Indeed, the most common tools used in current security stacks were created in the era before De-perimeterisation, when work was a place that could be walled off from malicious actors and aren’t fit for modern cloud- and browser-led operating environments. 

Today, we’re seeing web content of all kinds is evolving at rapid speed. New websites are being spun up faster than they can be categorised by URL filters, and threat intelligence can’t keep up with the amount of content being created and compromised by attackers. Even those solutions leveraging artificial intelligence and machine learning need reputational evidence to detect malicious activity, and by then it’s often too late. 

Some vendors are working to respond by adding security controls directly within the browser. Google and Microsoft, for example, are providing built-in controls inside Chrome and Edge to secure at the browser level rather than the network edge.  

However, with attackers developing new evasive attack methods like HTTP Smuggling at increasing rates, new approaches are needed. 

For this reason, it is vital that organisations take a Zero Trust approach to security to stop 0-day malware and credential phishing sites in their tracks and avoid false positives that can drain IT resources and disrupt productivity. 

In achieving Zero Trust in the truest sense, remote browser isolation is a logical option, preventing all content - be it good or bad  - from executing on a local device. 

Indeed, keeping potentially malicious code away from the endpoint is the only way to stop browser-based attacks with certainty. If malicious content cannot be delivered, threat actors can’t traverse the network and execute attacks.  

Jonathan Lee is Senior Product Manager at Menlo Security 

You Might Also Read: 

Credentials Phishing Attacks:

 

« Why We Should Worry About A War On Cybercrime
Cybersecurity: Prepare For The Year Ahead »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Securezoo

Securezoo

Securezoo's mission is to simplify and enhance information security by providing trusted security guidance, products, and information to small and mid-sized businesses and security professionals.

Q-CERT

Q-CERT

Q-CERT is the National Computer Security Emergency Team of Qatar.

Research Institute in Trustworthy Industrial Control Systems (RITICS)

Research Institute in Trustworthy Industrial Control Systems (RITICS)

RITICS is one of three Research Institutes formed as part of the UK National Cyber Security Strategy.

BitSight Technologies

BitSight Technologies

BitSight transforms how companies manage information security risk with objective, verifiable and actionable Security Ratings.

Chronicle

Chronicle

Chronicle products combine intelligence about global threats in the wild, threats inside your network, and unique signals about both.

Cyber-Physical Systems Security Institute (CPSSI)

Cyber-Physical Systems Security Institute (CPSSI)

CPSSI is a non-profit, by-invitation-only research and educational organization focused on practical and theoretical solutions to the cybersecurity challenges facing Cyber-Physical Systems.

MONITORAPP

MONITORAPP

MONITORAPP is responsible for complete web security. Protect your business environment with Application Security Solutions from MONTORAPP.

Clone Systems

Clone Systems

Clone Systems is an award winning global cloud based managed security as a service provider.

Kinetic Investments

Kinetic Investments

Kinetic Investments is a venture capital firm dedicated to early-stage companies that are transforming the digital landscape.

Swissbit

Swissbit

Swissbit AG is the leading European manufacturer of storage, security and embedded IoT solutions for demanding applications.

Abertay cyberQuarter

Abertay cyberQuarter

The Abertay cyberQuarter is a cybersecurity research and development centre housed within Abertay University.

Acora

Acora

Acora provide a range of best-in-class managed services, Microsoft-centric business software, and cloud solutions designed to help mid-market organisations succeed in the digital economy.

Guardz

Guardz

Guardz helps small and growing businesses to go from zero or low cyber protection to having comprehensive security – in the quickest and most straightforward way.

Marlink

Marlink

Marlink smartly integrates hybrid, future-ready network solutions so you can benefit from the best available connectivity and IT to accelerate your digitalisation and empower your remote operations.

HaystackID

HaystackID

HaystackID provides industry-leading computer forensics, eDiscovery, and attorney document review experts to help with complex, data-intensive investigations and litigation.

Frenos

Frenos

The Frenos Platform helps enterprises understand their most probable attack paths while highlighting the most effective risk mitigations to deter and defend against today’s adversaries.