"Pass-through" website interception detection and prevention

Question

I face some sort of "MitM" attack type that I don't really know how to search, because I don't really know what it is called, so I am in the dark here, and need some help and advice.

Let's say there is a shopping website: shop.com Customers, after logging in, can browse the items, put them into the shopping cart, and in the end, they can go checkout, where they are redirected to a payment processor, e.g.: paypal. The site itself doesn't handle any payment or credit card, it redirects to a secure site.

Someone makes a fake site: fake-shop.com

When the customer goes to this fake website, it calls the original shop.com and shows the result to the customer, but also injects javascript code into it.

The fake server doesn't care about the customer data, they don't take anything, it just flows through the fake server, it is working basically as a proxy server, and sends the data back and forth between the customer and the real server, and they inject their code in the html, and they are only interested in the checkout.

When the customer wants to checkout and pay for the items, the fake server changes the real checkout.html, where they hide the original paypal selection option, and inject their own form, which asks for credit card details, and when the customer enters those and hits send it will send it to the fake server.

My questions:

1. What is this attack called? Some sort of MitM with replay, but this happens real-time.
2. How can this "attack" be detected on the server side?
3. How can be this prevented? Will CSP inline script blocking be enough and block any js injection?

Answer 1

What is this attack called? Some sort of MitM with replay, but this happens real-time.

I'm not sure it has a special name. It is basically a kind of impersonation of your site using a fake name. That your original site is accessed in the backend of the fake site is just an implementation detail for the impersonation which would not be actually needed to fool the user.

How can this "attack" be detected on the server side?

This depends on how smart the attacker is in rewriting the content. You could build several Javascript-based traps into your code which are triggered if the site name is not what you expect or if you detect manipulations to your DOM. You could try to make the user access a different site in your control and compare the IP addresses used for access. But this all depends on the attacker doing mostly dumb MITM and blindly passing most of your content through. If the attacker instead scrapes your site and rebuilds its own replica from selected scraped content, such detection will not work.

You might try to detect it if the attacker uses specific IP addresses to access your site, i.e. try to visit the impersonated site and see what origin IP you get. An attacker might deter this detection too though by using various proxies.

How can be this prevented? Will CSP inline script blocking be enough and block any js injection?

CSP can be simply removed by the attacker when forwarding the content. In general; if you can reliably detect it, then you can reliably prevent it by simply not serving the expected content. But as seen from the last paragraph, reliable detection is hard to impossible when faced with a smart attacker.