Man-in-the-middle attacks
An attacker who has access to any point in a network connection between a user and sensitive websites (a "man in the middle") has the opportunity to observe and modify traffic as it passes between the browser and the Web server(s). Websites that use TLS (sites whose addresses start with "https") help defeat this, because an attacker of this type has a very hard time faking the cryptographic certificate used by the server to authenticate itself to the browser. However, attackers know that a lot of users have been conditioned to just click through warnings when they appear, and so they can use an invalid/forged certificate and in many cases users will ignore the browser's warnings.
Ways to avoid: Don't ignore browser warnings. When in doubt, try a different machine or Internet connection, or just wait to conduct your sensitive transaction later.
Top Five Vulnerabilities Attackers Use Against Browsers
Top Five Vulnerabilities Attackers Use Against Browsers
Web browsers are the primary target for many attackers these days, because so much sensitive data passes through them. From casual shopping to enterprise management systems to military operations, browsers have become the primary vehicle people use to access network-connected systems. Unfortunately, browsers have a long and storied history of vulnerabilities that have provided attackers with a lucrative and near-endless supply of victims upon which to prey. Quarri Technologies, Inc., a Web information security software company, has identified some of the top vulnerabilities attackers use against browsers.
Note: This slideshow is focused on browser vulnerabilities, not website vulnerabilities (SQL injection attacks, XSS, XSRF, et al). The distinction is subtle but important.
