How to protect browser from API Hooking?

Question

0.00/5 (No votes)

See more:

According to this article , i'm looking for an idea to protect browser from this attack, it's called en.wikipedia.org/wiki/Form_grabbing , the malware hook the API call of the browser when he send the request and before its encrypted with(HTTPS/SSL)..
I don't know if just sandboxing the browser api call, can be a solution for this?

Thanks in advance.

Posted 24-Feb-13 3:31am

marwen109

Updated 24-Feb-13 10:06am

v2

Add a Solution

Comments

Sergey Alexandrovich Kryukov 24-Feb-13 13:36pm

Your link is invalid to a non-existing page.
—SA

marwen109 24-Feb-13 16:07pm

Link corrected, Thank you.

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Sergey Alexandrovich Kryukov · Accepted Answer · 2013-02-24T16:26:00

The sandboxing is not a solution. You can consider a sandbox as a separate system isolated from your host system. If something bad happens to the sandbox, it won't infect the host system or damage it otherwise. In other words, a sandbox is a method to try something risky or questionable without the associated risk. But it you want to do everything in a sandbox, it would defeat its purpose.

For your purpose, this is not enough. If your password is eavesdropped, you don't care where it happens, in a sandbox or not. The only remedy is starting to work from a healthy system and using safety practices ever since. (And yes, sandboxing is one of them, a good one, but only in the sense I described above.) You cannot do much about this, unless you are developing some universal anti-malware tool. But in this field, there are no general recipes. And none of these tools gives you 100% guarantee.

—SA