WHAT IS SPOOFING?

Email spoofing happens when the cybercriminal uses a fake email address to commit a cybercrime. Depending on the email spoofing tactic, the criminal may spoof the email address, email sender name or both. Additionally, the cybercriminal can assume multiple identities, that of the sender, the company, or both.

For example, the sender’s name is joan.smith@xyzwidgets.com but Joan Smith does not work for XYZ Widgets. The recipient works at XYZ Widgets, a large multinational company and does not know that Joan is not an actual person. The recipient trusts the email since it uses the company logo and asks her to do legitimate work-related tasks.

Similar to phishing, the spoofed email uses urgent and convincing language to spur the recipient into immediate action. This sense of urgency does a couple of things – it limits the chance for hesitation and questioning and it convinces the recipient that they are helping and doing the right thing.

Caller ID spoofing is a common tactic that uses a phone number that appears to come from your area code. We are all more likely to answer a call when we see it is a local number.

When their call is answered, cybercriminals use social engineering tactics to keep people on the phone and to trick them into acting. The cybercriminal may pretend be a police officer and because the caller ID looks real, the victim is convinced to pay fines that don’t exist, to provide confidential information, etc. all under the threat of being arrested.

Some cybercriminals go so far as telling the victim to call them back on the number if they don’t trust them. This advanced social engineering technique strengthens the relationship and gives a sense of legitimacy to the call.

Website spoofing uses a fake website that looks legitimate. A spoofed website looks exactly like the real website – the logo, branding, colors, layout, domain name, and contact details are all the same. Without very close inspection of the domain name or looking for small flaws in the text, it’s very difficult to identify a spoofed website.

Cybercriminals use spoofed websites for a range of reasons including collecting login details, stealing credit card information, installing malware, or another malicious act. Often the victim receives a spoofed email first that directs them to the spoofed website.

Text messaging spoofing uses a spoofed phone number to send malicious text messages. The cybercriminal hides behind the phone number, sender name, or both. This type of spoofing relies on advanced research to understand what types of text messages the recipient is likely to receive and respond to.

The text message may include a phone number for the recipient to call or a link to a malicious website that is then used to commit additional cybercrimes. The text message uses social engineering tactics to convince the recipient to respond quickly.

GPS spoofing sends a fake GPS signal to a GPS receiver which then causes all GPS devices in the area to show an incorrect location. Cybercriminals use GPS spoofing to gain control of vehicles, boats, drones, and anyone relying on a navigation system. GPS spoofing is an advanced tactic that can be used to hijack drones or ships and to interfere with military navigation systems.

IP address spoofing hides the true identity and location of the computer or mobile device used by the cybercriminal. Cybercriminals might spoof an IP address for a network that uses IP address authentication, making it easy for them to gain access to the network.

Typically, IP address spoofing is used to commit a denial-of-service attack, thereby overwhelming the network with traffic and ultimately shutting it down. In other scenarios, the cybercriminal simply wants to hide their location from the recipient, this approach can be used with email spoofing or website spoofing to add more legitimacy to the attack.

Address Resolution Protocol or ARP spoofing is an advanced and technical cyber attack that connects the cybercriminal’s Media Access Control (MAC) address to a real IP address. This allows the cybercriminal to intercept and steal data that is intended for the owner of the IP address. ARP spoofing is typically used to steal data, to commit man-in-the-middle attacks, as part of a denial-of-service attack, or during session hijacking.

Doman Name Server or DNS spoofing makes it possible for cybercriminals to redirect traffic from the intended legitimate IP address to a faked IP address. Cybercriminals may use this spoofing tactic to direct victims to websites that install malware.

Extension spoofing disguises the file type, making it easier to convince people to download and install attachments. Cybercriminals know that people have been warned against installing executables. The cybercriminal may disguise a malware executable with a spoofed extension such as doc.exe. The file displays in the email as newfile.doc, and the recipient does not think twice about downloading and installing it.

Facial spoofing is a new type of spoofing that relies on facial recognition software to unlock devices or access a secure building. This type of spoofing is relatively rare but with advances in facial recognition technology and more companies using facial recognition as part of their security system, the risks with facial spoofing will grow. A cybercriminal can use pictures found on social media to build a likeness of an individual and then use this to unlock any security system that uses facial recognition.