The theft of personal or sensitive data is one of the biggest threats to online business. This danger, data exfiltration or data extrusion, comes from a wide variety of attack vectors. These include physical theft of devices, insider attacks within a corporate network and phishing, malware or third-party scripts. The risk for regular website users that an attacker will steal their personal and sensitive data without their knowledge increases every day.
There are several ways attackers can covertly exfiltrate data from unaware website visitors. These include basic attacks like phishing, which lure victims with crafted emails to click fraudulent links that redirect users to malicious websites. More complex attacks include using scripts on websites to secretly steal users’ credentials, financial information and even medical data.
Usually, websites implement third-party scripts for advertisement or analytic purposes. In recent studies, researchers have found that third-party scripts are hijacking websites more often. As a visitor, it is often difficult to recognize fraudulent behavior.
There are five areas where malicious third-party scripts try to escalate privileges:
Browser login manager and auto-fill misuse
Social data exfiltration
Document object model (DOM) exfiltration
Data exfiltration in cloud environments
Data exfiltration of mobile phone sensors.
Browser Login Manager and Auto-Fill Misuse
Many internet users store their credentials or other personal information in browser login managers and auto-fill tools. These fill login forms on websites without the need to type them in. In most cases, this can increase the security of users because they don’t need to type in credentials.
Many third-party scripts make use of these by adding hidden login forms on websites. The user doesn’t recognize these malicious forms. Rather, the browser login manager fills ..
Support the originator by clicking the read the rest link below.
