Suppose a hacker creates a Windows application that looks and feels like a legitimate web browser. The user believes he is using, say, Google Chrome. If you simply watched the bits going to and from the computer over the network, it would look like the user in fact was using a legitimate browser ...
Code signing is supposed to mitigate that problem. Adversaries can spread the browser using Google Ads (so it comes up at the top when you search the name). This has historically happened with brave.
A good question, but too narrow. What protects users from fake things of any kind? Fake messaging apps? Fake operating systems? Fake graphics cards? Fake iPhones? Fake Ferraris? Fake Gucci handbags? Fake dollar bills? Fake college diplomas? Fake homework answers? It's all really the same in every case: evaluate the trustworthiness of where you get it from; if the source isn't trustworthy then you can try to verify the authenticity (by your own knowledge, or by looking for hard-to-fake symbols of authenticity, or by consulting a trusted expert). If you can't verify it, don't accept it.
For the specific case of software, "hard-to-fake symbols of authenticity" are often things like digital signatures (though then you have to make sure the signer is who you expect it to be and that the key is trusted)... but you're better off by far just only getting your software from trusted suppliers.
When the user is using a "fake browser", the browser has full access to the local system and can do anything. Due to requesting elevated privileges during installation. The installer can just install a service which records the keystrokes, regardless of which browser the user is actually using.
@sbecker IMHO the more plausible scenario is that the user ends up going to a malicious site which "installs" a look-alike browser. Here the word "install" means "putting & configuring the executable with the user privileges", so it doesn't have system-wide privileges. Obviously if the attacker is able to make the user install something with elevated privileges everything is potentially in the control of the attacker.
Same as a fake anything else: not much. What prevents the user from downloading a program from a site that looks like Chrome's website, but the thing they download is actually just ransomware and nothing to do with browsers at all?
To replace the browser, presumably an attacker would need remote-code-execution on the target's device. While an attacker could get that by directly compromising the user's browser-install-process, it might be a mistake to take that remote-code-execution pathway and the payload of a corrupted-browser together as a package.
Eh, creating a fake browser is already more complex than what exists. I can simply install a keyboard that has a hardware mechanism to capture your keystrokes and send it wirelessly to me, via a mobile SIM card if necessary. There's nothing you can do about it since it is an independent system recording your keys. Or go a step further, just install a video camera recording your keyboard and screen. I just captured all your passwords you used in that session.
@hobbs I would prefer a fake benevolent browser to a genuine malevolent browser.
@Nelson Wouldn't it be easier to set up a TEMPEST device at the StarBucks nearest the target. There is no need to get physical access to the target's machine.
Discussion on question by dshin: What…
Discussion on question by dshin: What…