<p>The idea behind a man-in-the-browser attack is that the attacker has access to everything that your browser does, at least for the site you are on.  This is usually accomplished by tricking your browser into running malicious javascript within the context of the domain you are browsing, but may also be the result of malicious or exploitable plugins.  If your browser runs the code that encrypts a key, or uses it to sign something, that means your browser has the unencrypted version of it.  In the case of a MITB attack, the attacker has the unencrypted version too.  This means it doesn't have to steal the private key <em>after</em> it gets encrypted.  It already had it <em>before</em> any encryption.</p>

<p>If your browser has been compromised, nothing you do with it can be considered safe.  From a web security standpoint, a MITB attack is about as bad as it gets.</p>

CC BY-SA 3.0
2016-08-03T18:16:02.767Z
can you provide some material in order to understand how this can be done better
user36877
CC BY-SA 3.0
2016-08-03T18:31:14.593Z
No, not really.  A man in the browser attack will exploit a specific vulnerability on a specific site or browser plugin.  Without you specifying what it is an attacker would be exploiting, there are no details or materials to provide.
Jestin
CC BY-SA 3.0
2016-08-03T16:17:14.237Z
2016-08-03T16:17:14.237Z
Jestin
<p>I was reading that Man-in-the-Browser (MITB) is able to steal credentials data, modify html, and modify out going data. 
Indeed, MITB is one of the big threat of Bitcoin online wallets 
usually, when using online wallet user's private key is encrypted and decrypted using Java script in the user's browser </p>

<p>Now, I am wondering how MITB is able to steal the private key after encrypted it in the browser ?  </p>

CC BY-SA 3.0
2016-10-18T15:00:04.933Z
I recently came from [OWASP AppSec USA](https://2016.appsecusa.org/) in Washington DC and one of the companies was promoting its product for Application Integrity (client side RASP) which not only detects and prevents code tampering and debugging but also is able to detect MitB, providing enough details in real time. This approach enables your server to react blocking user's session or further HTTP requests.
Have a look at [their website](https://jscrambler.com) or drop them a line.
PauloASilva
<bitcoind><bitcoin-core><private-key><wallet-security><bip32-hd-wallets>
Stealing Bitcoin Private key using Man-in-the-Browser
user39213
# Stealing Bitcoin Private key using Man-in-the-Browser

(Asked by: username_0 on 2016-08-03)

I was reading that Man-in-the-Browser (MITB) is able to steal credentials data, modify html, and modify out going data.
Indeed, MITB is one of the big threat of Bitcoin online wallets
usually, when using online wallet user's private key is encrypted and decrypted using Java script in the user's browser

Now, I am wondering how MITB is able to steal the private key after encrypted it in the browser ?

**Tags:** bitcoind, bitcoin-core, private-key, wallet-security, bip32-hd-wallets

> **Comments:**
> **username_1**: I recently came from [OWASP AppSec USA](https://2016.appsecusa.org/) in Washington DC and one of the companies was promoting its product for Application Integrity (client side RASP) which not only detects and prevents code tampering and debugging but also is able to detect MitB, providing enough details in real time. This approach enables your server to react blocking user's session or further HTTP requests. Have a look at [their website](https://jscrambler.com) or drop them a line.  

---

## 1 answers

### Answer by username_2 on 2016-08-03. Score: 1

The idea behind a man-in-the-browser attack is that the attacker has access to everything that your browser does, at least for the site you are on. This is usually accomplished by tricking your browser into running malicious javascript within the context of the domain you are browsing, but may also be the result of malicious or exploitable plugins. If your browser runs the code that encrypts a key, or uses it to sign something, that means your browser has the unencrypted version of it. In the case of a MITB attack, the attacker has the unencrypted version too. This means it doesn't have to steal the private key *after* it gets encrypted. It already had it *before* any encryption.

If your browser has been compromised, nothing you do with it can be considered safe. From a web security standpoint, a MITB attack is about as bad as it gets.

> **Comments:**
> **username_3**: can you provide some material in order to understand how this can be done better  
> **username_2**: No, not really.  A man in the browser attack will exploit a specific vulnerability on a specific site or browser plugin.  Without you specifying what it is an attacker would be exploiting, there are no details or materials to provide.  

---

