When Browsers Become the Attack Surface: Rethinking Security for Scattered Spider

Very interesting report. One tool they highlight is Seraphic's BrowserTotal. While I'm anxious & interested to try it (on my production machine/environment - ran it in sandbox already), I don't see many posts from folks who have tried it ---> which makes me hesitant. Anyone care to comment?

 

Iconic Coolwebsearch never died. It simply waited and then evolved spawning millions of newer tentacles.

 

New? Browsers were always #1 target, a browser is always allowed, it is like an opened window in a castle, thus locking it down is basics. I have no extensions, everything disabled, site permission blocked, only TCP port 443 allowed.

It is paid to see, so ... It reports 10 Failed, but logs are hidden, I have only managed to glance at some errors like that XSS was loaded, the browser did not recent SSL and that is it.

 

Not impressed with this test since its using badssl.com for its SSL tests;