21

Suppose a hacker creates a Windows application that looks and feels like a legitimate web browser. The user believes they are using, say, Google Chrome. If you simply watched the bits going to and from the computer over the network, it would look like the user in fact was using a legitimate browser like Google Chrome.

However, on the client side, this fake browser records all keystrokes entered by the user, and from that data, deduces the user's website/password-manager passwords. In the background, this data is continuously transmitted to the hacker.

Alternatively, this fake browser could act like a legitimate browser for all URL's entered by the user except for some specific exceptions. Perhaps for a banking URL like chase.com, the browser does a phony DNS-resolution and serves up content from a different site owned by the hacker, fooling the user into entering login credentials or other sensitive info.

Are attacks like these possible? If not, what mechanisms are in place to thwart such attempts?

I tried googling for phrases like "fake browser hack" but have not found anything that seems to resemble this.

Improve this question
3
  • 11
    Code signing is supposed to mitigate that problem. Adversaries can spread the browser using Google Ads (so it comes up at the top when you search the name). This has historically happened with brave.
    – belkarx
    Apr 19, 2022 at 23:23
  • 33
    A good question, but too narrow. What protects users from fake things of any kind? Fake messaging apps? Fake operating systems? Fake graphics cards? Fake iPhones? Fake Ferraris? Fake Gucci handbags? Fake dollar bills? Fake college diplomas? Fake homework answers? It's all really the same in every case: evaluate the trustworthiness of where you get it from; if the source isn't trustworthy then you can try to verify the authenticity (by your own knowledge, or by looking for hard-to-fake symbols of authenticity, or by consulting a trusted expert). If you can't verify it, don't accept it.
    – CBHacking
    Apr 20, 2022 at 0:31
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Rory Alsop ♦
    Apr 22, 2022 at 21:49

6 Answers 6

Reset to default
67

Are attacks like these possible?

Yes. A hacker just needs to download the Firefox source code, recompile it, and distribute it.

If not, what mechanisms are in place to thwart such attempts?

A user could download browsers from their official sites, not third party sites. They could also use package managers or app stores that are associated with many operating systems.

Improve this answer
18
  • 2
    Download from official sites + verify the key.
    – gerrit
    Apr 20, 2022 at 12:16
  • 34
    @gerrit The kind of people that manually verify signatures on stuff they download are not the type of people who these attacks are likely to be aimed at.
    – Radvylf Programs
    Apr 20, 2022 at 13:56
  • 4
    @RadvylfPrograms Unless they have a billion dollar bitcoin wallet, perhaps?
    – gerrit
    Apr 20, 2022 at 13:56
  • 8
    @gerrit Possibly, but if you have people targeting you individually, that's a totally different situation, and as far as I can tell, far from the scope of this question.
    – Radvylf Programs
    Apr 20, 2022 at 13:58
  • 8
    @gerrit - If I verify the checksum against the same website where I download the file, how does it add security?
    – Vilx-
    Apr 20, 2022 at 17:10
23

The challenge the attacker would face would be duping users into installing the malicious web browser on their system.

Windows has a security feature called User Account Control (UAC) specifically for the purpose of mitigating this threat. When a user attempts to install a new program on a Microsoft Windows system, Windows checks that the installation file is digitally signed using a certificate that Windows trusts. If the program is not signed using a trusted certificate, then the user is presented with a warning like the one below:

Alt text

Improve this answer
7
  • 4
    +1, I believe MacOS also has an equivalent feature.
    – nobody
    Apr 19, 2022 at 23:27
  • 6
    Thanks. I imagine the bigger threats are installation on a public computer by a malicious administrator, or installation on a user’s personal device via unauthorized physical access.
    – dshin
    Apr 19, 2022 at 23:53
  • 2
    The screenshot doesn't work for me; my browser believes that it's unsafe to connect to the site that's hosting it.
    – ruakh
    Apr 20, 2022 at 14:38
  • 4
    @dshin If your threat model includes public computers with unscrupulous admins or unauthorized physical access to your machine, there are a dozen better ways to surreptitiously install keyloggers on such machines that don't involve someone hijacking your browser. For example, if your computer has a Bluetooth dongle, they could replace it with a keylogging model.
    – Nzall
    Apr 20, 2022 at 17:59
  • 3
    @dshin: Using a public computer means fully trusting its admins with the security of any information you type into it. Both trust to not be malicious themselves, and trust to have successfully locked-down the computer to prevent previous non-admin users from having installed malware. And keeping up with security updates to prevent that, unless one of those previous users knows about a 0-day exploit they can point a browser at to get control of a locked-down public machine.
    – Peter Cordes
    Apr 20, 2022 at 22:53
10

Yes, it is completely possible to create such a browser. Given that chromium is open-source, it is easy to make minor modifications and produce a browser that, on the surface, appears to be Google Chrome, but is in fact a malicious knock-off.

The difficult part is distributing this browser to users. Any sane user would install Chrome by going to Google's website and downloading the official installer. It helps that googling anything like "install Chrome" naturally leads to Google's website as the first link. Thus, normal users will end up with the official version of Chrome and not your knock-off.

Improve this answer
8
  • 27
    @dshin Of course you should always assume an untrusted computer is untrusted. It could be running a malicious browser, or a real browser but with a keylogger installed, or have a hardware keylogger installed, or no keylogger but a custom certificate installed to allow MITM... In short, there are any number of ways a public computer can be compromised. Never do anything sensitive on it.
    – nobody
    Apr 19, 2022 at 21:26
  • 38
    Isn't chrome already a malicious knockoff of chromium? :P
    – qwr
    Apr 20, 2022 at 6:03
  • 1
    @dshin normally public computers have restricted users. The users can not install anything. But the best way to use these computers is to not use them.
    – J_rite
    Apr 20, 2022 at 12:40
  • 2
    @Jungkook While that is generally true, it is also true that public computers usually have poor security, meaning an attacker often does not face any significant difficulty in escalating privileges. So best to avoid them altogether.
    – nobody
    Apr 20, 2022 at 13:53
  • 1
    @Jungkook public computers have an administrator. Someone has to install the software on them. You probably don't know who the admin is or what they installed. Don't trust it.
    – Seth R
    Apr 20, 2022 at 14:47
9

Faking a complete browser is not necessary for most attacks. There are phishing lures which fake a single browser window displaying a Facebook/Gmail login page in the attempt to collect usernames and passwords. Some of these lures are javascript applets running in your real browser (google "Browser in the browser attack"). This has a big advantage of having access to passwords stored in the real browser: users who would have installed a complete fake browser would be suspicious if they find that there is no stored password for Facebook in it.

Improve this answer
1
  • 1
    The password manager won't autofill the user's ID&Password to a spoof site - this useful warning that something dodgy is going on
    – CSM
    Apr 21, 2022 at 6:35
1

Administrators creating user accounts without administrative access to the computer is a very strong deterrent for these sorts of attacks because it requires an administrator to install new software. It also prevents a broad range of other attacks that users fall prey to.

For use cases outside of an administrated network, there is little to protect users from themselves. They can and frequently do install operating systems from unauthorized sources.

The best way to protect against these threats is simply to try and teach people about the most basic methods to protect themselves.

Improve this answer
2
  • 1
    Very few people install operating systems from anywhere, and on a private computer, there is nobody but the user themselves to decide what is "unauthorized". Probably you meant to say "They can and frequently do install applications from untrustworthy sources."
    – IMSoP
    Apr 20, 2022 at 15:27
  • 2
    I have several friend who were getting pirated copies of Windows from Pirate Bay. I would link to the very well seeded images, but I suspect SE doesn't like that.
    – Paul
    Apr 20, 2022 at 15:44
1

I believe the answer is that anti-virus software could potentially pick it up as malicious based on "heuristic analysis" -- that is, modern AV software has an understanding of common malicious hooks and suspicious actions and can flag programs based on that, even if it has never seen that particular program before. This is why sometimes innocent programs end up getting flagged by antivirus: they were doing something that may not have been intended as malicious but fit some recognized pattern.

Alternatively, the heuristics never catch it but eventually it gets found out, and added specifically to AV software as "known malicious".

Disclaimer: I'm no expert on what, precisely, heuristic AV is looking for, or what you can get away with without setting it off, but no one else has mentioned it.

More info: https://usa.kaspersky.com/resource-center/definitions/heuristic-analysis

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .