Spoofing attack

In the context of information security, and especially network security, a spoofing attack is a situation in which a person or program successfully identifies as another by falsifying data, to gain an illegitimate advantage.

Contents

Spoofing and TCP/IP[edit]

Main articles: IP address spoofing and ARP spoofing

Many of the protocols in the TCP/IP suite do not provide mechanisms for authenticating the source or destination of a message, and are thus vulnerable to spoofing attacks when extra precautions are not taken by applications to verify the identity of the sending or receiving host. IP spoofing and ARP spoofing in particular may be used to leverage man-in-the-middle attacks against hosts on a computer network. Spoofing attacks which take advantage of TCP/IP suite protocols may be mitigated with the use of firewalls capable of deep packet inspection or by taking measures to verify the identity of the sender or recipient of a message.

Referrer spoofing[edit]

Main article: Referer spoofing

Some websites, especially pornographic paysites, allow access to their materials only from certain approved (login-) pages. This is enforced by checking the referrer header of the HTTP request. This referrer header however can be changed (known as “referrer spoofing” or “Ref-tar spoofing”), allowing users to gain unauthorized access to the materials.

Poisoning of file-sharing networks[edit]

Main article: spoofing (anti-piracy measure)

Spoofing” can also refer to copyright holders placing distorted or unlistenable versions of works on file-sharing networks.

Caller ID spoofing[edit]

Main article: Caller ID spoofing

Public telephone networks often provide caller ID information, which includes the caller’s number and sometimes the caller’s name, with each call. However, some technologies (especially in Voice over IP (VoIP) networks) allow callers to forge caller ID information and present false names and numbers. Gateways between networks that allow such spoofing and other public networks then forward that false information. Since spoofed calls can originate from other countries, the laws in the receiver’s country may not apply to the caller. This limits laws’ effectiveness against the use of spoofed caller ID information to further a scam.[1][ failed verification ]

E-mail address spoofing[edit]

Main article: e-mail spoofing

The sender information shown in e-mails (the From: field) can be spoofed easily. This technique is commonly used by spammers to hide the origin of their e-mails and leads to problems such as misdirected bounces (i.e. e-mail spam backscatter).

E-mail address spoofing is done in quite the same way as writing a forged return address using snail mail. As long as the letter fits the protocol, (i.e. stamp, postal code) the SMTP protocol will send the message. It can be done using a mail server with telnet.[2]

Geolocation spoofing[edit]

Main article: Geolocation spoofing

Geolocation spoofing occurs when a user applies technologies to make them appear to be located somewhere other than where they are actually located. The most common geolocation spoofing is through the use of a Virtual Private Network (VPN) or DNS Proxy in order for the user to appear to be located in a different country, state or territory other than where they are actually located. According to a study by GlobalWebIndex, 49% of global VPN users utilize VPNs primarily to access territorially restricted entertainment content.[3] This type of geolocation spoofing is also referred to as geo-piracy, since the user is illicitly accessing copyrighted materials via geolocation spoofing technology. Another example of geolocation spoofing occurred when an online poker player in California used geolocation spoofing techniques to play online poker in New Jersey, in contravention of both California and New Jersey state law.[4] Forensic geolocation evidence proved the geolocation spoofing and the player forfeited more than $90,000 in winnings.

GPS spoofing[edit]

A GPS spoofing attack attempts to deceive a GPS receiver by broadcasting fake GPS signals, structured to resemble a set of normal GPS signals, or by rebroadcasting genuine signals captured elsewhere or at a different time. These spoofed signals may be modified in such a way as to cause the receiver to estimate its position to be somewhere other than where it actually is, or to be located where it is but at a different time, as determined by the attacker. One common form of a GPS spoofing attack, commonly termed a carry-off attack, begins by broadcasting signals synchronized with the genuine signals observed by the target receiver. The power of the counterfeit signals is then gradually increased and drawn away from the genuine signals. It has been suggested that the capture of a Lockheed RQ-170 drone aircraft in northeastern Iran in December, 2011 was the result of such an attack.[5] GPS spoofing attacks had been predicted and discussed in the GPS community previously, but no known example of a malicious spoofing attack has yet been confirmed.[6][7][8] A “proof-of-concept” attack was successfully performed in June, 2013, when the luxury yacht White Rose of Drachs was misdirected with spoofed GPS signals by a group of aerospace engineering students from the Cockrell School of Engineering at the University of Texas in Austin. The students were aboard the yacht, allowing their spoofing equipment to gradually overpower the signal strengths of the actual GPS constellation satellites, altering the course of the yacht.[9][10][11]

Russian GPS spoofing[edit]

In June 2017, approximately twenty ships in the Black Sea complained of GPS anomalies, showing vessels to be transpositioned miles from their actual location, in what Professor Todd Humphreys believed was most likely a spoofing attack.[11][12] GPS anomalies around Putin’s Palace and the Moscow Kremlin have led researchers to believe that Russian authorities use GPS spoofing wherever Vladimir Putin is located, affecting maritime traffic.[11][13] There were additional incidents involving Russian GPS spoofing including Norway spoofing during NATO exercise that lead to ship collision (unconfirmed by authorities) [14] and spoofing from Syria by the Russian military that affected Israeli main airport in Tel Aviv. [15]

GPS Spoofing with SDR[edit]

Since the advent of Software Defined Radio, GPS simulator applications have been made available to the general public. This has made GPS spoofing much more accessible, meaning it can be performed at limited expense and with a modicum of technical knowledge.[16]

Preventing GPS spoofing[edit]

There are different ways to prevent GPS spoofing. Some hardware and some software-based systems already exist. A simplified approach to improve the resiliency of GPS equipment against spoofing attacks that does not require changes to the hardware and is agnostic to the varying GPS receivers and architecture of each system is using anti-spoofing software. An anti-spoofing software, similar to an anti-virus solution, can be added to any part of a system where GPS data is processed. Such a seamless anti-spoofing technology is able to detect false GPS signals and can warn or stop a system from using the fabricated input for further processing. A software-based detection functionality can prevent effects of spoofing attacks without manually modifying GPS equipment hardware such as antennas. Additionally a connected software solution allows regular updates in order to stay up-to-date, just like an anti-virus, with ever evolving attack methods. The Department of Homeland Security, in collaboration with the National Cybersecurity and Communications Integration Center (NCCIC) and the National Coordinating Center for Communications (NCC), released a paper which lists methods to prevent this type of spoofing. Some of the most important and most recommended to use are:[17]

  1. Obscure antennas. Install antennas where they are not visible from publicly accessible locations or obscure their exact locations by introducing impediments to hide the antennas.
  2. Add a sensor/blocker. Sensors can detect characteristics of interference, jamming, and spoofing signals, provide local indication of an attack or anomalous condition, communicate alerts to a remote monitoring site, and collect and report data to be analyzed for forensic purposes [1].
  3. Extend data spoofing whitelists to sensors. Existing data spoofing whitelists have been and are being implemented in government reference software, and should also be implemented in sensors.
  4. Use more GPS signal types. Modernized civil GPS signals are more robust than the L1 signal and should be leveraged for increased resistance to interference, jamming, and spoofing.
  5. Reduce latency in recognition and reporting of interference, jamming, and spoofing. If a receiver is misled by an attack before the attack is recognized and reported, then backup devices may be corrupted by the receiver before hand-over.

These installation and operation strategies and development opportunities described herein can significantly enhance the ability of GNSS receivers and associated equipment to defend against a range of interference, jamming, and spoofing attacks. A system and receiver agnostic detection software offers applicability as cross-industry solution. Software implementation can be performed in different places within the system, depending on where the GPS data is being used, for example as part of the device’s firmware, operating system, or on the application level.

A method proposed by researchers from the Department of Electrical and Computer Engineering at the University of Maryland, College Park and the School of Optical and Electronic Information at Huazhong University of Science and Technology that aims to help mitigate the affects of GPS spoofing attacks by using data from a vehicles controller area network (CAN) bus. The information would be compared to that of received GPS data and compared in order to detect the occurrence of a spoofing attack and to reconstruct the driving path of the vehicle using that collected data. Properties such as the vehicles speed and steering angle would be amalgamated and regression modeled in order to achieve a minimum error in position of 6.25 meters.[18] Similarly, a method outlined by researchers in a 2016 IEEE Intelligent Vehicles Symposium conference paper discuss the idea of using cooperative adaptive cruise control (CACC) and vehicle to vehicle (V2V) communications in order to achieve a similar goal. In this method, the communication abilities of both cars and radar measurements are used to compare against the supplied GPS position of both cars to determine the distance between the two cars which is then compared to the radar measurements and checked to make sure they match. If the two lengths match within a threshold value, then no spoofing has occurred, but above this threshold, the user is alarmed so that they can take action.[19]

See also[edit]

2020-01-23_044148

Website spoofing

Website spoofing is the act of creating a website, as a hoax, with the intention of misleading readers that the website has been created by a different person or organization. Normally, the spoof website will adopt the design of the target website and sometimes has a similar URL.[1] A more sophisticated attack results in an attacker creating a “shadow copy” of the World Wide Web by having all of the victim’s traffic go through the attacker’s machine, causing the attacker to obtain the victim’s sensitive information.[2]

Another technique is to use a ‘cloaked’ URL.[3] By using domain forwarding, or inserting control characters, the URL can appear to be genuine while concealing the address of the actual website.

The objective may be fraudulent, often associated with phishing or e-mail spoofing, or to criticize or make fun of the person or body whose website the spoofed site purports to represent. Because the purpose is often malicious, “spoof” (an expression whose base meaning is innocent parody) is a poor term for this activity so that more accountable organisations such as government departments and banks tend to avoid it, preferring more explicit descriptors such as “fraudulent” or “phishing”.[4]

As an example of the use of this technique to parody an organisation, in November 2006 two spoof websites, www.msfirefox.com and www.msfirefox.net, were produced claiming that Microsoft had bought Firefox and released “Microsoft Firefox 2007.”[5]

Contents

Prevention Tools[edit]

Anti-Phishing Software[edit]

Spoofed websites predominate in efforts developing anti-phishing software though there are concerns about their effectiveness. A majority of efforts are focused on the PC market leaving mobile devices lacking You can see from the table below that few user studies have been run against the current tools in the market. [6]

A comparison of anti-phishing tools in 2004.[6] show

DNS Filtering[edit]

DNS is the layer at which botnets control drones. In 2006, OpenDNS began offering a free service to prevent users from entering website spoofing sites. Essentially, OpenDNS has gathered a large database from various anti-phishing and anti-botnet organizations as well as its own data to compile a list of known website spoofing offenders. When a user attempts to access one of these bad websites, they are blocked at the DNS level. APWG statistics show that most phishing attacks use URLs, not domain names, so there would be a large amount of website spoofing that OpenDNS would be unable to track. At the time of release, OpenDNS is unable to prevent unnamed phishing exploits that sit on Yahoo, Google etc.[7]

See also[edit]

References[edit]

  1. ^ “Spoof website will stay online”, BBC News, 29 July 2004
  2. ^ http://www.cs.princeton.edu/sip/pub/spoofing.pdf
  3. ^ Anti-Phishing Technology", Aaron Emigh, Radix Labs, 19 January 2005
  4. ^ See e.g. [1] or [2]
  5. ^ “Fake Sites Insist Microsoft Bought Firefox”, Gregg Keizer, InformationWeek, 9 November 2006
  6. ^ Jump up to: a b “Phishing environments, techniques, and countermeasures: A survey”. Computers & Security . 68 (4): 280. July 2017. doi:10.1016/s0167-4048(04)00129-4. ISSN 0167-4048.
  7. ^ “Dark Reading | Security | Protect The Business - Enable Access”. Dark Reading . Retrieved 2018-06-29.

https://www.adacic1033.online/post/2062_https-steemit-com-story-defango-the-great-ai-war-1-1-101-quinn-michaels-or-crowd.html

https://www.adacic1033.online/post/2064_https-www-flashradio-info-shoutcast-electronic-435842.html

2020-01-24_030142