In the context of
information security
Information security, sometimes shortened to InfoSec, is the practice of protecting information by mitigating information risks. It is part of information risk management. It typically involves preventing or reducing the probability of unauthorize ...
, and especially
network security
Network security consists of the policies, policies, processes and practices adopted to prevent, detect and monitor unauthorized access, Abuse, misuse, modification, or denial of a computer network and network-accessible resources. Network securi ...
, a spoofing attack is a situation in which a person or program successfully identifies as another by falsifying
data
In the pursuit of knowledge, data (; ) is a collection of discrete values that convey information, describing quantity, quality, fact, statistics, other basic units of meaning, or simply sequences of symbols that may be further interpreted ...
, to gain an illegitimate advantage.
Internet
Spoofing and TCP/IP
Many of the protocols in the TCP/IP suite do not provide mechanisms for
authenticating
Authentication (from ''authentikos'', "real, genuine", from αὐθέντης ''authentes'', "author") is the act of proof (truth), proving an Logical assertion, assertion, such as the Digital identity, identity of a computer system user. In ...
the source or destination of a message, leaving them vulnerable to spoofing attacks when extra precautions are not taken by applications to verify the identity of the sending or receiving host. IP spoofing and
ARP spoofing
In computer networking, ARP spoofing, ARP cache poisoning, or ARP poison routing, is a technique by which an attacker sends ( spoofed) Address Resolution Protocol (ARP) messages onto a local area network. Generally, the aim is to associate the a ...
in particular may be used to leverage
man-in-the-middle attack
In cryptography and computer security, a man-in-the-middle, monster-in-the-middle, machine-in-the-middle, monkey-in-the-middle, meddler-in-the-middle, manipulator-in-the-middle (MITM), person-in-the-middle (PITM) or adversary-in-the-middle (AiTM) ...
s against hosts on a
computer network
A computer network is a set of computers sharing resources located on or provided by network nodes. The computers use common communication protocols over digital interconnections to communicate with each other. These interconnections are ...
. Spoofing attacks which take advantage of TCP/IP suite protocols may be mitigated with the use of
firewalls capable of
deep packet inspection
Deep packet inspection (DPI) is a type of data processing that inspects in detail the data being sent over a computer network, and may take actions such as alerting, blocking, re-routing, or logging it accordingly. Deep packet inspection is oft ...
or by taking measures to verify the identity of the sender or recipient of a message.
Domain name spoofing
The term 'Domain name spoofing' (or simply though less accurately, 'Domain spoofing') is used generically to describe one or more of a class of
phishing
Phishing is a type of social engineering where an attacker sends a fraudulent (e.g., spoofed, fake, or otherwise deceptive) message designed to trick a person into revealing sensitive information to the attacker or to deploy malicious softwar ...
attacks that depend on falsifying or misrepresenting an internet
domain name
A domain name is a string that identifies a realm of administrative autonomy, authority or control within the Internet. Domain names are often used to identify services provided through the Internet, such as websites, email services and more. As ...
. These are designed to persuade unsuspecting users into visiting a web site other than that intended, or opening an email that is not in reality from the address shown (or apparently shown). Although website and email spoofing attacks are more widely known, any service that relies on
domain name resolution
In computer systems, name resolution refers to the retrieval of the underlying numeric values corresponding to computer hostnames, account user names, group names, and other named entities.
Computer operating systems commonly employ multiple key ...
may be compromised.
Referrer spoofing
Some websites, especially pornographic
paysite
A paysite or pay site, in the adult entertainment industry, is a website that charges money to become a member and view its content, and often produces original adult content. They can be contrasted with "free-sites", which do not charge a members ...
s, allow access to their materials only from certain approved (login-) pages. This is enforced by checking the
referrer
In HTTP, "" (a misspelling of Referrer) is an optional HTTP header field that identifies the address of the web page (i.e., the URI or IRI), from which the resource has been requested. By checking the referrer, the server providing the new web ...
header of the
HTTP
The Hypertext Transfer Protocol (HTTP) is an application layer protocol in the Internet protocol suite model for distributed, collaborative, hypermedia information systems. HTTP is the foundation of data communication for the World Wide Web, ...
request. This referrer header, however, can be changed (known as "
referrer spoofing" or "Ref-tar spoofing"), allowing users to gain unauthorized access to the materials.
Poisoning of file-sharing networks
"
Spoofing" can also refer to
copyright
A copyright is a type of intellectual property that gives its owner the exclusive right to copy, distribute, adapt, display, and perform a creative work, usually for a limited time. The creative work may be in a literary, artistic, education ...
holders placing distorted or unlistenable versions of works on
file-sharing
File sharing is the practice of distributing or providing access to digital media, such as computer programs, multimedia (audio, images and video), documents or electronic books. Common methods of storage, transmission and dispersion include ...
networks.
E-mail address spoofing
The sender information shown in
e-mail
Electronic mail (email or e-mail) is a method of exchanging messages ("mail") between people using electronic devices. Email was thus conceived as the electronic ( digital) version of, or counterpart to, mail, at a time when "mail" meant ...
s (the
From:
field) can be spoofed easily. This technique is commonly used by
spammers
This is a list of individuals and organizations noteworthy for engaging in bulk electronic spamming, either on their own behalf or on behalf of others. It is not a list of all spammers, only those whose actions have attracted substantial independen ...
to hide the origin of their e-mails and leads to problems such as misdirected
bounces (i.e. e-mail spam
backscatter
In physics, backscatter (or backscattering) is the reflection of waves, particles, or signals back to the direction from which they came. It is usually a diffuse reflection due to scattering, as opposed to specular reflection as from a mirror, a ...
).
E-mail address spoofing is done in quite the same way as writing a forged return address using
snail mail
The mail or post is a system for physically transporting postcards, letters, and parcels. A postal service can be private or public, though many governments place restrictions on private systems. Since the mid-19th century, national postal sy ...
. As long as the letter fits the protocol, (i.e. stamp, postal code) the
Simple Mail Transfer Protocol (SMTP) will send the message. It can be done using a mail server with
telnet
Telnet is an application protocol used on the Internet or local area network to provide a bidirectional interactive text-oriented communication facility using a virtual terminal connection. User data is interspersed in-band with Telnet control i ...
.
Geolocation
Geolocation
Geopositioning, also known as geotracking, geolocalization, geolocating, geolocation, or geoposition fixing, is the process of determining or estimating the geographic position of an object.
Geopositioning yields a set of Geographic coordinate s ...
spoofing occurs when a user applies technologies to make their device appear to be located somewhere other than where it is actually located. The most common geolocation spoofing is through the use of a
Virtual Private Network
A virtual private network (VPN) extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. The be ...
(VPN) or
DNS
The Domain Name System (DNS) is a hierarchical and distributed naming system for computers, services, and other resources in the Internet or other Internet Protocol (IP) networks. It associates various information with domain names assigned to ...
Proxy in order for the user to appear to be located in a different country, state or territory other than where they are actually located. According to a study by GlobalWebIndex, 49% of global VPN users utilize VPNs primarily to access territorially restricted entertainment content. This type of geolocation spoofing is also referred to as geo-piracy, since the user is illicitly accessing copyrighted materials via geolocation spoofing technology. Another example of geolocation spoofing occurred when an online poker player in California used geolocation spoofing techniques to play online poker in New Jersey, in contravention of both California and New Jersey state law. Forensic geolocation evidence proved the geolocation spoofing and the player forfeited more than $90,000 in winnings.
Telephony
Caller ID spoofing
Public telephone networks often provide
caller ID
Caller identification (Caller ID) is a telephone service, available in analog and digital telephone systems, including voice over IP (VoIP), that transmits a caller's telephone number to the called party's telephone equipment when the call is ...
information, which includes the caller's number and sometimes the caller's name, with each call. However, some technologies (especially in
Voice over IP (VoIP) networks) allow callers to forge caller ID information and present false names and numbers. Gateways between networks that allow such spoofing and other public networks then forward that false information. Since spoofed calls can originate from other countries, the laws in the receiver's country may not apply to the caller. This limits laws' effectiveness against the use of spoofed caller ID information to further a
scam
A confidence trick is an attempt to defraud a person or group after first gaining their trust. Confidence tricks exploit victims using their credulity, naïveté, compassion, vanity, confidence, irresponsibility, and greed. Researchers have def ...
.
Global navigation satellite system spoofing
![Figure 2 Potential results of a GPS spoofing attack on a naval vessel (51169854742)](https://upload.wikimedia.org/wikipedia/commons/5/5f/Figure_2_Potential_results_of_a_GPS_spoofing_attack_on_a_naval_vessel_%2851169854742%29.jpg)
A
global navigation satellite system
A satellite navigation or satnav system is a system that uses satellites to provide autonomous geo-spatial positioning. It allows satellite navigation devices to determine their location (longitude, latitude, and altitude/elevation) to high pr ...
(GNSS) spoofing attack attempts to deceive a GNSS receiver by broadcasting fake GNSS signals, structured to resemble a set of normal GNSS signals, or by rebroadcasting genuine signals captured elsewhere or at a different time. These spoofed signals may be modified in such a way as to cause the receiver to estimate its position to be somewhere other than where it actually is, or to be located where it is but at a different time, as determined by the attacker. One common form of a GNSS spoofing attack, commonly termed a carry-off attack, begins by broadcasting signals synchronized with the genuine signals observed by the target receiver. The power of the counterfeit signals is then gradually increased and drawn away from the genuine signals. It has been suggested that the
capture of a Lockheed RQ-170 drone aircraft in northeastern
Iran
Iran, officially the Islamic Republic of Iran, and also called Persia, is a country located in Western Asia. It is bordered by Iraq and Turkey to the west, by Azerbaijan and Armenia to the northwest, by the Caspian Sea and Turkmeni ...
in December, 2011 was the result of such an attack. GNSS spoofing attacks had been predicted and discussed in the GNSS community previously, but no known example of a malicious spoofing attack has yet been confirmed. A "proof-of-concept" attack was successfully performed in June, 2013, when the luxury yacht ''White Rose of Drachs'' was misdirected with spoofed GPS signals by a group of aerospace engineering students from the Cockrell School of Engineering at the University of Texas in Austin. The students were aboard the yacht, allowing their spoofing equipment to gradually overpower the signal strengths of the actual GPS constellation satellites, altering the course of the yacht.
Russian GPS spoofing
In June 2017, approximately twenty ships in the
Black Sea
The Black Sea is a marginal mediterranean sea of the Atlantic Ocean lying between Europe and Asia, east of the Balkans, south of the East European Plain, west of the Caucasus, and north of Anatolia. It is bounded by Bulgaria, Georgia, Roma ...
complained of (US) GPS anomalies, showing vessels to be transpositioned miles from their actual location, in what Professor Todd Humphreys believed was most likely a spoofing attack.
GPS anomalies around
Putin's Palace and the
Moscow Kremlin
The Kremlin ( rus, Московский Кремль, r=Moskovskiy Kreml', p=ˈmɐˈskofskʲɪj krʲemlʲ, t=Moscow Kremlin) is a fortified complex in the center of Moscow founded by the Rurik dynasty. It is the best known of the kremlins (R ...
have led researchers to believe that Russian authorities use GPS spoofing wherever
Vladimir Putin
Vladimir Vladimirovich Putin; (born 7 October 1952) is a Russian politician and former intelligence officer who holds the office of president of Russia. Putin has served continuously as president or prime minister since 1999: as prime min ...
is located, affecting maritime traffic.
There were additional incidents involving Russian GPS spoofing including Norway spoofing during NATO exercise that lead to ship collision (unconfirmed by authorities) and spoofing from Syria by the Russian military that affected Israeli main airport in Tel Aviv.
GPS Spoofing with SDR
Since the advent of
Software Defined Radio
Software-defined radio (SDR) is a radio communication system where components that have been traditionally implemented in analog hardware (e.g. mixers, filters, amplifiers, modulators/demodulators, detectors, etc.) are instead implemented by ...
, GPS simulator applications have been made available to the general public. This has made GPS spoofing much more accessible, meaning it can be performed at limited expense and with a modicum of technical knowledge. Whether this technology applies to other GNS systems remains to be demonstrated.
Preventing GNSS spoofing
The Department of Homeland Security, in collaboration with the National Cybersecurity and Communications Integration Center (
NCCIC) and the National Coordinating Center for Communications (
NCC), released a paper which lists methods to prevent this type of spoofing. Some of the most important and most recommended to use are:
#Obscure
antennas
In radio engineering, an antenna or aerial is the interface between radio waves propagating through space and electric currents moving in metal conductors, used with a transmitter or receiver. In transmission, a radio transmitter supplies a ...
. Install antennas where they are not visible from publicly accessible locations or obscure their exact locations by introducing impediments to hide the antennas.
#Add a sensor/blocker. Sensors can detect characteristics of interference,
jamming, and spoofing signals, provide local indication of an attack or anomalous condition, communicate alerts to a remote monitoring site, and collect and report data to be analyzed for forensic purposes.
#Extend data spoofing whitelists to sensors. Existing data spoofing whitelists have been and are being implemented in government reference software, and should also be implemented in sensors.
#Use more GNSS signal types. Modernized civil GPS signals are more robust than the L1 signal and should be leveraged for increased resistance to interference, jamming, and spoofing.
#Reduce latency in recognition and reporting of interference, jamming, and spoofing. If a receiver is misled by an attack before the attack is recognized and reported, then backup devices may be corrupted by the receiver before hand-over.
These installation and operation strategies and development opportunities can significantly enhance the ability of GPS receivers and associated equipment to defend against a range of interference, jamming, and spoofing attacks.
A system and receiver agnostic detection software offers applicability as cross-industry solution. Software implementation can be performed in different places within the system, depending on where the GNSS data is being used, for example as part of the device's firmware, operating system, or on the application level.
A method proposed by researchers from the Department of Electrical and Computer Engineering at the
University of Maryland, College Park
The University of Maryland, College Park (University of Maryland, UMD, or simply Maryland) is a public land-grant research university in College Park, Maryland. Founded in 1856, UMD is the flagship institution of the University System of Mary ...
and the School of Optical and Electronic Information at Huazhong University of Science and Technology that aims to help mitigate the effects of GNSS spoofing attacks by using data from a vehicles controller area network (CAN) bus. The information would be compared to that of received GNSS data and compared in order to detect the occurrence of a spoofing attack and to reconstruct the driving path of the vehicle using that collected data. Properties such as the vehicles speed and steering angle would be amalgamated and regression modeled in order to achieve a minimum error in position of 6.25 meters. Similarly, a method outlined by researchers in a 2016
IEEE
The Institute of Electrical and Electronics Engineers (IEEE) is a 501(c)(3) professional association for electronic engineering and electrical engineering (and associated disciplines) with its corporate office in New York City and its operation ...
Intelligent Vehicles Symposium conference paper discuss the idea of using cooperative adaptive cruise control (CACC) and vehicle to vehicle (V2V) communications in order to achieve a similar goal. In this method, the communication abilities of both cars and radar measurements are used to compare against the supplied GNSS position of both cars to determine the distance between the two cars which is then compared to the radar measurements and checked to make sure they match. If the two lengths match within a threshold value, then no spoofing has occurred, but above this threshold, the user is alarmed so that they can take action.
Voice spoofing
Information technology plays an increasingly large role in today’s world, and different authentication methods are used for restricting access to informational resources, including voice biometrics. Examples of using
speaker recognition
Speaker recognition is the identification of a person from characteristics of voices. It is used to answer the question "Who is speaking?" The term voice recognition can refer to ''speaker recognition'' or speech recognition. Speaker verification ...
systems include internet banking systems, customer identification during a call to a call center, as well as passive identification of a possible criminal using a preset ”blacklist”.
Technologies related to the synthesis and modeling of speech are developing very quickly, allowing you to create voice recordings almost indistinguishable from real ones. Such services are called
Text-to-Speech
Speech synthesis is the artificial production of human speech. A computer system used for this purpose is called a speech synthesizer, and can be implemented in software or hardware products. A text-to-speech (TTS) system converts normal languag ...
(TTS) or
Style transfer services. The first one aimed at creating a new person. The second one aimed at identifies as another in voice identification systems.
A large number of scientists are busy developing algorithms that would be able to distinguish the synthesized voice of the machine from the real one. On the other hand, these algorithms need to be thoroughly tested to make sure that the system really works.
See also
*
Domain name spoofingclass of phishing attacks that depend on falsifying or misrepresenting an internet domain name
**
**
**
** , mixing letters from different alphabets to trick an unsuspecting user into trusting and clicking on a link, also known as "script spoofing".
**
* using spoofed network packets
*
* (most often by telephone or email).
*
Standard facilities that might be subverted
* (in order to use another, more appropriate one).
References
{{Scams and confidence tricks
Computer network security
Types of cyberattacks