Threat hunting in the browser

Threat hunting in the browser

Speakers: Luke Jennings, VP of R&D, Push Security

Conference: 44CON

YouTube: https://www.youtube.com/watch?v=5J3GBQkm3yI

Overview

In this compelling talk, Luke Jennings, VP of R&D at Push Security, articulates a fundamental shift in the cybersecurity landscape: the transition from network and endpoint-centric defenses to an identity perimeter. Jennings argues that traditional security tools, such as Endpoint Detection and Response (EDR) solutions and network proxies, are increasingly ill-equipped to combat the rise of identity attacks, which now represent the primary vector for breaches. These modern threats often bypass the operating system and network layers, instead targeting user identity and directly interacting with applications through the browser.

Jennings makes a strong case for the browser as the new front line in cybersecurity, presenting it as a uniquely powerful vantage point for both detecting and responding to identity-based threats. He demonstrates how browser extensions, often perceived as a security risk in the past, can be leveraged as sophisticated security tools. By operating within the browser's context, these extensions gain unparalleled visibility into user interactions, decrypted network traffic, and application-specific events that are opaque to conventional security controls. The talk not only highlights the problem but also offers practical, code-level examples of how browser extensions can be deployed to counter the most prevalent identity attack techniques, urging security professionals to integrate them into their defensive strategies.

Background

▶ Watch: Introduction to threat hunting in the browser and agenda (0:00)

The evolution of cybersecurity has progressed through distinct eras, each defined by its primary attack surface and corresponding defensive strategies. Luke Jennings outlines this progression, starting with the network perimeter era in the mid-2000s, where the focus was on bypassing firewalls, compromising DMZs, and attacking external-facing services. As defenses matured, the industry shifted to the endpoint perimeter in the 2010s, with attackers targeting endpoints through malware and targeted phishing, aiming for memory-resident implants, command and control (C2) communication, and lateral movement. This era gave rise to the EDR industry, which excelled at OS-level visibility and process monitoring.

However, the 2020s have ushered in the identity perimeter. This shift is driven by the widespread adoption of SaaS applications, cloud-based identity providers (IDPs) for Single Sign-On (SSO), and a remote workforce that often connects directly to applications without traversing traditional network perimeters. Modern organizations, especially those formed in the last five years, increasingly resemble "a fleet of endpoints connecting directly out to a whole bunch of applications," often with a mix of direct SaaS access and IDP-brokered SSO. Larger enterprises frequently operate in a hybrid model, managing both legacy on-premise networks and a growing array of SaaS solutions, including often-unmonitored Shadow SaaS.

The threat landscape has dramatically transformed in response. Identity attacks are no longer emerging; they are the dominant threat. Jennings cites alarming statistics: CrowdStrike reports that 80% of attacks involve identity and compromised credentials, Microsoft notes a tenfold increase in identity attacks, and Verizon's Data Breach Investigations Report consistently identifies stolen credentials as the number one breach vector, affecting 80% of web attacks. Furthermore, an estimated thousand credentials appear online each day. High-profile breaches, including those affecting major identity providers like Okta and Microsoft, and the recent Snowflake account breaches (dubbed "potentially one of the biggest breaches in history," resulting from a "pure and very simple identity attack"), underscore the severity and frequency of this trend. The new attacker mantra, Jennings observes, is "attackers don't hack in, they log in."

This new paradigm sees attackers employing modern variants of established techniques. Attacker-in-the-middle (AiTM) and browser-in-the-middle (BiTM) phishing campaigns are designed to bypass Multi-Factor Authentication (MFA) by stealing session cookies. Info-stealers similarly target credentials or cookies. Credential stuffing has evolved, with attackers now spraying stolen credentials across thousands of disparate SaaS applications instead of just a few known endpoints.

Traditional security controls are inherently limited in this new environment. EDR solutions, while excellent at monitoring OS-level activities like processes, network connections, and file system events, offer "only very light visibility inside the browser." They cannot see decrypted HTTP traffic, monitor user interactions within specific tabs, or understand the context of web application activity. Network proxies, while capable of decrypting traffic, struggle to interpret the complex, dynamic nature of modern web applications, which are often "downloadable thick JavaScript applications" that perform critical actions locally within the browser. Furthermore, many remote workers bypass corporate proxies entirely, and new delivery vectors (personal email, Slack, Teams, LinkedIn, X) circumvent traditional email gateways.

Attackers also employ sophisticated evasion techniques targeting automated link detonation and analysis tools. By leveraging legitimate services like Cloudflare Workers and bot detection mechanisms like Cloudflare Turnstile, and incorporating cryptographic challenges, attackers ensure that security researchers and tools like URLScan see a benign or non-functional page, while the actual malicious payload is only delivered to a legitimate user's browser under specific conditions. This renders external analysis ineffective, reinforcing Jennings's assertion that "the browser sees everything that actually occurs for the user."

While browser extensions have historically been viewed with skepticism due to concerns about lack of visibility and supply chain risks (e.g., hijacked extensions), Jennings highlights their modern capabilities. They can be deployed and managed securely through managed deployments, auto-update seamlessly, and be locked down with browser policies. Critically, from an OS perspective, they run within a highly locked-down sandbox, mitigating some traditional risks. This makes them a powerful, often overlooked, opportunity for security use cases.

Key Findings

▶ Watch: Understanding the modern identity perimeter and infrastructure (2:00)

The central finding of Luke Jennings's talk is the unequivocal shift of the primary attack surface to the identity perimeter, rendering traditional endpoint and network security tools largely ineffective against the most prevalent modern threats. This necessitates a fundamental re-evaluation of defensive strategies.

Jennings demonstrates that browser extensions are not merely a supplemental control but a critical and uniquely positioned tool for security in this new era. They provide granular, context-rich visibility directly within the user's browser, capturing events and data that are completely opaque to EDR agents and network proxies. This deep insight enables the detection of sophisticated identity attack techniques, including browser-in-the-middle phishing, HTML smuggling, and various post-exploitation activities such as the creation of unauthorized SaaS API keys, manipulation of sharing settings, and the establishment of ghost logins. Furthermore, extensions offer the capability for proactive defensive measures, such as real-time warnings against weak passwords or the prevention of credential reuse on phishing sites. The talk effectively positions browser extensions as the essential "EDR for the browser," poised to become the most important component of security in the identity perimeter age.

Technical Deep Dive

▶ Watch: Why identity attacks are now the number one threat (3:20)

Luke Jennings provided a detailed look into the technical architecture and capabilities of browser extensions, positioning them as an indispensable tool for security in the identity perimeter. The core of browser extension development revolves around three key concepts: content scripts, background scripts, and message passing.

Content scripts are JavaScript files that an extension injects into web pages. Developers can precisely define when and where these scripts execute, allowing for targeted monitoring or interaction on specific websites or across all domains. By default, content scripts run in an isolated world, meaning their JavaScript context is separate from the page's native JavaScript and other extensions. This isolation is a critical security feature, preventing malicious page scripts from interfering with or accessing the extension's code and data. However, for scenarios requiring direct interaction with the page's DOM or JavaScript environment, content scripts can be configured to run in the main world. This flexibility allows for both passive monitoring and active intervention within the web page.

Background scripts function much like persistent agents, running continuously in the background of the browser. They are crucial for real-time monitoring of a wide array of browser events, including network requests and responses, tab lifecycle events, and more. This always-on capability allows background scripts to serve as the central processing unit for an extension, aggregating data and performing actions independently of specific web pages.

Message passing facilitates communication between content scripts and background scripts. This mechanism enables content scripts to send specific events or data (e.g., detected phishing indicators, user actions) to the background script for logging, analysis, or further action. Conversely, background scripts can send instructions or data to content scripts in specific tabs, allowing for dynamic control and responsive actions. Jennings illustrated this with simple code examples using chrome.runtime.sendMessage and chrome.runtime.onMessage.addListener, highlighting the ease with which data can be exchanged within the extension's components.

Jennings then delved into specific technical capabilities that browser extensions unlock for security:

1. Extension Enumeration: A background script, with the appropriate permissions, can query the browser's API to list all other installed extensions. This capability is vital for gaining visibility into the browser's ecosystem, identifying potentially malicious or unauthorized extensions that might pose a risk. Jennings demonstrated this using a scheduled task-like mechanism via the alarms API, allowing for periodic checks and reporting of installed extensions.

1. HTML Smuggling Detection: This technique bypasses traditional network and proxy-based filtering by constructing and downloading malicious files locally within the browser using JavaScript. Since the file is generated client-side, no suspicious file-type headers or direct file transfers are observed at the network layer. A browser extension, however, can monitor all file downloads directly from the browser's context. Jennings showed how an extension can detect and even stream the content of such downloads, providing visibility into an attack vector that is invisible to network controls.

1. Malicious Link Tracking and Visual Context: Extensions have full access to the Document Object Model (DOM) and can monitor all user interaction events (clicks, keystrokes). This allows for precise tracking of when a clickable link appears in a page (even if dynamically created) and when it is subsequently clicked. Critically, the browser's API also allows for screenshotting the rendered page at any point. This provides invaluable visual evidence, showing "exactly as the user saw it," which is impossible to reconstruct from raw network traffic or JavaScript code alone. While acknowledging privacy implications, Jennings emphasized the immense power of this capability for incident response.

1. Proactive Monitoring of User Security Data: Many SaaS applications allow users to generate API keys for integration or automation. These keys often grant persistent access and may not be visible to administrators or logged by the SaaS provider, making them an ideal persistence mechanism for attackers. An extension, running in the user's context, can periodically make API calls to the SaaS application (e.g., Shortcut, as demonstrated) to enumerate existing API keys. This enables the detection of unauthorized or malicious API keys that an attacker might have created post-compromise, providing critical visibility where traditional security tools fail.

1. Preventing Weak Passwords: By observing input fields and keystrokes within the DOM, an extension can detect when a user enters a weak or previously compromised password. Jennings demonstrated a real-time pop-up warning the user about a weak password, illustrating the potential for proactive security policy enforcement directly at the point of interaction. This capability can be extended to prevent credential reuse or submission to known phishing domains.

To collect these generated security events, Jennings outlined two primary methods:

• HTTP Communications: The most straightforward approach is to send events via HTTP requests to a security information and event management (SIEM) system, a webhook, or a Slack channel. The main challenge here is securely identifying the source browser or user.
• Native Messaging: For organizations with existing endpoint log collection infrastructure, Chrome's Native Messaging API offers an elegant solution. This API allows the browser extension to communicate with a small, locally running native binary (e.g., a Python script or .NET application). This binary can then write the browser events to the operating system's event log, which can be picked up by existing log collectors (such as Winlogbeat or EDR agents) and forwarded to the SIEM, seamlessly integrating browser telemetry into the broader security monitoring framework.

Jennings firmly concludes that while EDR was the key control for the endpoint perimeter, browser extensions are poised to become the most important component for the identity perimeter, offering capabilities that are simply unattainable through other means.

Demo / Proof of Concept

▶ Watch: Key types of modern identity attacks explained (4:50)

Luke Jennings's talk was heavily supported by compelling demonstrations, first illustrating the efficacy and stealth of modern identity attacks, and then showcasing how browser extensions can effectively detect and mitigate these very threats.

The first set of demonstrations focused on an identity attack chain, starting with initial access and progressing through post-exploitation techniques:

1. Initial Access via Browser-in-the-Middle (BiTM) Phishing:

Jennings used a tool called Evil NoVNC, a BiTM technique that proxies the victim's connection through the attacker's browser. The victim, interacting with a malicious phishing domain like definitelynotfishing.com, believes they are logging into their legitimate Okta tenant. The attacker, on a separate screen, sees a mirrored view of the victim's interaction. As the victim enters their credentials and completes the MFA challenge (e.g., using the Okta Verify app), the attacker's browser session is authenticated to the real Okta tenant. Critically, the attacker captures the victim's session cookies, enabling session hijacking, and also logs the password and one-time password entered. Once the session is established, the attacker can cut off the victim, leaving the attacker with a fully authenticated session. This technique effectively bypasses MFA and leaves the victim interacting with their actual Okta tenant, reducing suspicion.

1. Post-Exploitation: Persistence and Lateral Movement:

Once the Okta session is compromised, Jennings demonstrated several identity-centric post-exploitation techniques:

• Establishing Multiple Sessions: The attacker immediately logs into various downstream SaaS applications (e.g., Shortcut, Google Drive, Expensify) from the compromised Okta session. This creates multiple active sessions that must be individually terminated by incident responders, even if the primary Okta account is suspended.
• API Key Persistence: Within a ticket management system like Shortcut, the attacker, operating as a standard user, creates a new API key. This key provides persistent, decoupled access to the application, allowing the attacker to bypass Okta or any subsequent password resets. Jennings highlighted that many SaaS apps allow user-level API key creation, and often, these are not visible to administrators.
• Sharing Link Persistence: From a compromised finance user's Google Drive account, the attacker creates a public sharing link for sensitive documents. This enables future access to the data without needing to re-authenticate to the user's account.
• Ghost Logins: In a SaaS application like Expensify, the attacker adds a secondary authentication mechanism, such as a personal Gmail account, to the victim's profile. This creates a "ghost login" that allows the attacker to log in directly, bypassing the organization's primary SAML SSO and remaining undetected by traditional identity monitoring.
• SAML Jacking for Lateral Movement: Jennings demonstrated a more technical lateral movement technique. Assuming the compromised finance user is an application owner (admin) within Expensify, the attacker modifies the SAML SSO settings. Specifically, the attacker changes the SAML redirect URL from the legitimate Okta instance to their Evil NoVNC phishing server. This transforms Expensify into a watering hole: any subsequent user attempting to log into Expensify (either directly or via Okta) will be redirected to the attacker's phishing page, enabling further user compromise.

The second set of demonstrations showcased the power of a custom browser extension developed by Jennings for defensive purposes:

1. Extension Enumeration: The custom extension's background script, running in the browser's developer console, automatically enumerated all installed extensions, including the "Push Security" extension and others, providing immediate visibility into the browser's installed components.

1. HTML Smuggling Detection: Jennings presented a test page with a button that, when clicked, executed JavaScript to locally construct and download a .docm file. Crucially, no network request for a file was made. The custom browser extension, however, immediately detected and logged the download event in the console, including the file name and the ability to stream its content, demonstrating its ability to see attacks that bypass network proxies.

1. Malicious Link Tracking and Screenshotting: Simulating a malicious link shared via LinkedIn Instant Messenger (on a Chat GPT-generated page), the extension demonstrated its capabilities. It first logged an "observation event" when the malicious link appeared in the DOM. Upon the user clicking the link, a "link click event" was logged. At both points, the extension took a full screenshot of the browser page, providing exact visual context of "what the user saw" for incident response.

1. Monitoring Security Data (Shortcut API Keys): To address the persistence technique of creating unauthorized API keys, Jennings showed the extension's background script performing periodic checks for Shortcut API tokens. After simulating an attacker creating an API key, a forced periodic check by the extension immediately detected and reported the new API token in the console, demonstrating how an organization could gain visibility into backdoors that are otherwise invisible to central IT.

1. Preventing Weak Passwords: A final demonstration showed the extension's ability to proactively protect users. As a user typed a "password" into a login field, the extension immediately displayed a pop-up warning on the side, indicating "weak password detected" and firing a corresponding event. This illustrated the potential for real-time user guidance and policy enforcement.

These demos collectively highlighted the critical gap left by traditional security tools and the unique, powerful capabilities that browser extensions bring to threat hunting and defense in the identity perimeter.

Defensive Implications

▶ Watch: Live demo: Browser-in-the-middle phishing for initial access (5:58)

The insights and demonstrations provided by Luke Jennings carry profound implications for defensive security strategies, necessitating a significant re-evaluation of current approaches.

Firstly, organizations must acknowledge and prioritize the shift to the identity perimeter. This means moving beyond a sole focus on endpoint and network security, recognizing that attackers are increasingly "logging in" rather than "hacking in." Security budgets and efforts need to be reallocated to address identity-centric attack vectors.

Secondly, browser-level visibility is no longer a luxury but a critical requirement. Traditional security controls, like EDR and network proxies, are fundamentally limited in their ability to see what happens inside the browser. Defenders must implement solutions that provide deep insight into user interactions, decrypted HTTP traffic, and application-specific events within the browser's context. This includes monitoring for the appearance and clicking of malicious links, regardless of their source (corporate email, personal email, social media, IM).

Thirdly, organizations should actively consider deploying and managing browser extensions for security purposes. These extensions offer proactive detection and response capabilities against a range of identity attacks:

• Phishing Detection: Extensions can detect and alert on sophisticated phishing attempts, including browser-in-the-middle attacks, by analyzing page content, URLs, and user interactions in real-time.
• HTML Smuggling Prevention: By monitoring all file downloads within the browser, extensions can identify and potentially block files delivered via HTML smuggling, which bypasses network-level content filters.
• Unauthorized Persistence Detection: Extensions can be configured to periodically query SaaS application APIs (in the user's context) to detect the creation of unauthorized API keys, ghost logins, or modifications to sharing settings (e.g., public links in Google Drive). This provides visibility into backdoors that are often invisible to central IT or even the SaaS provider's logs.
• SAML Jacking Prevention: Monitoring changes to SAML SSO configurations within SaaS applications can help detect attempts at SAML jacking, preventing an application from being turned into a watering hole for further compromise.

Fourthly, enhanced incident response capabilities are a direct benefit. The ability to capture screenshots "exactly as the user saw it" provides invaluable visual context during an incident, accelerating investigation and understanding of attacker actions. Furthermore, access to granular browser telemetry and application-specific data (like API keys) from the user's perspective significantly aids in containment and remediation in SaaS environments.

Fifthly, proactive user protection can be implemented directly at the point of interaction. Browser extensions can warn users about weak or reused passwords, prevent the submission of credentials to known phishing sites, or enforce other security policies in real-time. This shifts some defensive responsibility to the user's immediate environment.

Finally, security teams, particularly advanced blue teams, should explore developing custom browser extensions tailored to their specific organizational needs. Jennings emphasizes that it's "easier than writing your own EDR" and provides a GitHub repository with example code to facilitate experimentation. Integrating browser-generated events into existing SIEMs through HTTP communications or Native Messaging (via local binaries writing to OS event logs) is crucial for centralized monitoring and analysis. The managed deployment capabilities and inherent sandboxing of modern browser extensions address many traditional concerns, making them a viable and powerful addition to the security toolset.

Key Takeaways

• Identity attacks are the predominant threat: Attackers have shifted from "hacking in" to "logging in," making compromised credentials and session hijacking the primary vectors for breaches.
• Traditional security tools are insufficient: EDR and network proxies lack the deep, granular visibility within the browser required to detect and respond effectively to identity-centric attacks.
• Browser extensions offer unique visibility: Operating directly within the browser, extensions provide unparalleled insight into user interactions, decrypted HTTP traffic, and application-specific events that are otherwise opaque.
• Extensions enable powerful defensive capabilities: They can detect sophisticated phishing (including BiTM), HTML smuggling, unauthorized persistence (e.g., API keys, ghost logins), and lateral movement (e.g., SAML jacking).
• Proactive protection and enhanced IR: Extensions allow for real-time user warnings (e.g., weak passwords), policy enforcement, and provide invaluable visual context (screenshots) for incident investigations.
• Managed extensions are a strategic imperative: Organizations should leverage modern browser management capabilities to deploy security-focused extensions as a critical component of their defense in the identity perimeter.

About the Speaker(s)

Luke Jennings is the VP of R&D at Push Security, a company specializing in identity attacks and SaaS security. His professional journey began in offensive security, where he focused on red teaming, penetration testing, and security research at NWR Labs. This background provided him with deep insights into attacker methodologies.

He later transitioned into the defensive space, contributing to the design of EDR solutions and conducting threat hunting research for Counters, a managed security response service. This diverse experience across both offensive and defensive disciplines uniquely positioned him to understand the evolving threat landscape. At Push Security, Jennings now concentrates specifically on identity attacks and SaaS security research, a domain that required him to "throw away almost everything I already knew from the endpoint and network attack eras" to adapt to the new challenges. He is also known for releasing a SaaS Attack Matrix, inspired by the MITRE ATT&CK framework, which details how to compromise an organization without touching the endpoint.