SPOOFING

Spoofing is a cyber-attack where a malicious actor disguises themselves as a trusted entity which may be a person, device, website or network to steal data, bypass security or cause harm.

There are several types of spoofing and they are; IP, Email, DNS cache poisoning, ARP, website/URL, caller ID, GPS, MAC, BGP hijacking and biometric spoofing.

IP (internet protocol) spoofing , the hacker sends packets with fake IP address to access restricted network. The hacker puts the victims IP as the sender, so when the DNS/NTP (domain name system/network time protocol) servers receive the packets, they send their large responses to the victim, not the attacker. This creates massive DDoS (distributed denial of service) floods with no direct connection to the victim. Example includes Github DDoS (2018), Dyn DNS attack (2016), spamhauss 300Gbps (2013) etc.

Email spoofing exploits the SMTPs (simple mail transfer protocol) lack of native authentication to forge the from: header. SMTPs has two separate “ sender” fields, the invisible envelope address and the visible From: header. The attacker sets the display header to ceo@yourcompany.com while sending from their own server. Without DMARC (Domain based message authentication reporting and conformance) configured the email lands in the inbox looking perfectly legitimate. Example includes; Toyota boshoku (2019), Barbara Corcoran (2020), Puerto Rico government (2020) etc.

DNS (Domain Name system) spoofing, the hacker corrupts the DNS cache, redirecting users to phishing site. The hacker fraudulently injects DNs records into a resolver cache, silently redirecting users to malicious servers. Examples include; Brazilian bank (2016),Kaminsky vulnerability (2008), sea turtle APT (2017-19) etc.

ARP (address resolution protocol), in this case the hacker intercept LAN traffic by associating own MAC (media access control) with the victims IP (internet protocol). The hacker sends fake ARP replies on a LAN to associate the hackers MAC with a legitimate IP (usually the gateway) enabling full man in the middle interception. It requires local network access. Examples includes; dark hotel APT (2007-2014), UK university student (2014), US corporate contractor (2017) etc.

URL/website spoofing clones legitimate websites using lookalike domains and subdomains tricks. Example includes; Apple IDN Homograph (2017), operation Phisp Phry (2009), EvilginX2MFA Bypass (2022-2023) etc.

Caller ID spoofing, manipulates the SIP (session initiation protocol) protocol’s From header, the field that becomes the displayed caller ID. VOIP (voice over internet protocol). providers that don’t validate this field pass any number into the phone network. Hackers set it to the IRS, Bank hotlines or government agencies. Example includes; SSA impersonation (2022), Apple support Vishing (2020-2021), Wangiri callback fraud (ongoing) etc.

GPS spoofing the hacker transmits counterfeit satellite signals at slightly higher power than the real GPS satellites to override the real GPS, thereby manipulating reported position, speed or time. Example includes; Black sea ships (2017), Iran captures US Drone (2011), Shanghai phantom ships (2019) etc.

MAC (media access control) spoofing the hacker simply changes a devices advertised hardware address with a single operating system (OS) command to bypass MAC-based access controls or evade tracking. Example includes; TJX breach (2005-2007), University Wi-Fi Bypass (2015), Airport Wi-Fi cloning (2019) etc.

BGP (border gateway protocol) hijacking spoofing, In this case the hacker makes false BGP route announcements to reroute global internet traffic through attacker controlled networks. Examples includes; Amazon route 53 (2018), China Telecom (2010), Pakistan Telecom VS YouTube etc.

Biometric spoofing defeats face, fingerprint, iris and voice authentication using photos, silicone molds or AI deep fakes. Example includes; Hong Kong deep fake call (2024), CCC gummy finger (2013), CEO voice clone (2019) etc.

The advantages of spoofing are; it enables ethical hackers to use spoofing techniques to simulate real-world attacks, thereby helping to discover vulnerabilities and prepare adequate defenses against them. It helps to protect users from surveillance, tracking and censorship especially in repressive regimes. GPS and radar spoofing are used defensively to mislead enemy drones, missiles or surveillance systems. Engineers spoof IP address, DNS response or user agents to test how systems behave under edge case conditions without needing real traffic at scales. Also CGI, deep fakes technology ( a form of identity spoofing) and voice synthesis are used in films and gaming to create realistic characters, dub foreign content or resurrect historical figures for documentaries.

The disadvantages of spoofing are; email spoofing and caller ID spoofing are used by fraudsters to impersonate banks, government agencies or executives to steal. ARP spoofing, DNS spoofing and IP spoofing enables man in the middle attacks allowing criminals to intercept, alter or redirect sensitive information. Spoofing GPS signals can misdirect ships, aircrafts or autonomous vehicles with potentially catastrophic consequences. Widespread spoofing is capable in undermining confidence in digital communications. Identity spoofing with the aid of AI generated audio/video is used by bad actors to commit numerous atrocities.

The application of spoofing is as follows; spoofing is used widely in cyber security for attacks and penetration testing. Spoofing is used telecommunications for fraud and robocalls. Spoofing is used in the military for electronic warfare. Spoofing is used in finance for business email compromise. Spoofing is used the media for disinformation and entertainment. Spoofing is used IoT/automotive application for vehicle and drone manipulation.

The future of spoofing depends on the advances and development of the following technologies; AI powered attacks, quantum and cryptographic defenses enhancing of autonomous vehicle , Biometric and other vulnerabilities against spoofing. However the future will be a race between increasing sophisticated spoofing techniques and authentication systems designed to defeat them.

SOURCES:

• The dark art and science of GPS spoofing by Gareth Thomas.
• Detection of spoofing, jamming or failure of a global positioning system (GPS) by Juan R. Vasquez.
• The art of deception by Kelvin Mitnick and William L. Simon.
• Hacking: the art of exploitation by Jon Erickson.
• Future crimes by Marc Goodman.