Spoofing attack
From Wikipedia, the free encyclopedia
In the context of computer security, a spoofing attack is a situation in which one person or program successfully masquerades as another by falsifying data and thereby gaining an illegitimate advantage.
Contents |
[edit] Man-in-the-middle attack and internet protocol spoofing
An example from cryptography is the man-in-the-middle attack, in which an attacker spoofs Alice into believing they're Bob, and spoofs Bob into believing they're Alice, thus gaining access to all messages in both directions without the trouble of any cryptanalytic effort.
The attacker must monitor the packets sent from Alice to Bob and then guess the sequence number of the packets. Then the attacker knocks out Alice with a SYN attack and injects his own packets, claiming to have the address of Alice. Alice's firewall can defend against some spoof attacks when it has been configured with knowledge of all the IP addresses connected to each of its interfaces. It can then detect a spoofed packet if it arrives at an interface that is not known to be connected to the IP address.
Many carelessly designed protocols are subject to spoof attacks, including many of those used on the Internet. See Internet protocol spoofing
[edit] URL spoofing and phishing
Another kind of spoofing is "webpage spoofing," also known as phishing. In this attack, a legitimate web page such as a bank's site is reproduced in "look and feel" on another server under control of the attacker. The intent is to fool the users into thinking that they are connected to a trusted site, for instance to harvest user names and passwords.
This attack is often performed with the aid of URL spoofing, which exploits web browser bugs in order to display incorrect URLs in the browsers location bar; or with DNS cache poisoning in order to direct the user away from the legitimate site and to the fake one. Once the user puts in their password, the attack-code reports a password error, then redirects the user back to the legitimate site.
[edit] Referer spoofing
Some websites, especially pornographic paysites, allow access to their materials only from certain approved (login-) pages. This is enforced by checking the Referer header of the HTTP request. This referer header however can be changed (known as "Referer spoofing" or "Ref-tar spoofing"), allowing users to gain unauthorized access to the materials.
[edit] Spoofing of file-sharing Networks
"Spoofing" also refers to polluting the illegal file-sharing networks where record labels share files that are mislabeled, distorted or empty to discourage downloading from these sources. The RIAA (Recording Industry Association of America) began “spoofing” the file-sharing servers last summer as part of their defense against music files sharers. They are uploading what appears to be a popular song but actually a loop of a song's chorus or a message from the artist scolding the file sharer. The record companies want to make downloading music more difficult than it is now. The theory is that if a person has to spend a long time to find one good copy of Michael Jackson’s “Smooth Criminal” among hundreds of spoofed copies, then that person will become frustrated enough that he or she would rather pay $0.99 for instant gratification at Apple’s Music store.
[edit] Caller ID spoofing
In public telephone networks, it has for a long while been possible to find out who is calling you by looking at the Caller ID information that is transmitted with the call. There are technologies that transmit this information on landlines, on cellphones and also with VoIP. Unfortunately, there are now technologies (especially associated with VoIP) that allow callers to lie about their identity, and present false names and numbers, which could of course be used as a tool to defraud or harass. Because there are services and gateways that interconnect VoIP with other public phone networks, these false Caller IDs can be transmitted to any phone on the planet. Due to the distributed geographic nature of the Internet, VoIP calls can be generated in a different country to the receiver, which means that it is very difficult to have a legal framework to control those who would use fake Caller IDs as part of a scam.
[edit] E-mail address spoofing
The sender information shown in e-mails (the "From" field) can be spoofed easily, though nowadays many domains have the Sender Policy Framework implemented, which helps prevent the e-mail spoofing. This technique is commonly used by Spammers to hide the origin of their e-mails and leads to problems such as misdirected bounces (i.e. e-mail spam backscatter).
[edit] Login spoofing
The user is presented with an ordinary looking login prompt for username and password, which is actually a malicious program under the control of the attacker.
[edit] References
- "Pirates of the Digital Millennium" by John Gantz & Jack B. Rochester, 2005, FT Prentice Hall, Upper Saddle River, NJ 07458; ISBN 0-13-146315-2.
- http://www.schneier.com/blog/archives/2006/03/caller_id_spoof.html
[edit] See also
- Protocol spoofing, the benign simulating of a protocol in order to use another, more appropriate one.
- Stream cipher attack
