Spoofing attack
In the context of information security, and especially network security, a spoofing attack is a situation in which a person or program successfully masquerades as another by falsifying data, to gain an illegitimate advantage.
Spoofing and TCP/IP
Many of the protocols in the TCP/IP suite do not provide mechanisms for authenticating the source or destination of a message, and are thus vulnerable to spoofing attacks when extra precautions are not taken by applications to verify the identity of the sending or receiving host. IP spoofing and ARP spoofing in particular may be used to leverage man-in-the-middle attacks against hosts on a computer network. Spoofing attacks which take advantage of TCP/IP suite protocols may be mitigated with the use of firewalls capable of deep packet inspection or by taking measures to verify the identity of the sender or recipient of a message.
Referrer spoofing
Some websites, especially pornographic paysites, allow access to their materials only from certain approved (login-) pages. This is enforced by checking the referrer header of the HTTP request. This referrer header however can be changed (known as "referrer spoofing" or "Ref-tar spoofing"), allowing users to gain unauthorized access to the materials.
Poisoning of file-sharing networks
"Spoofing" can also refer to copyright holders placing distorted or unlistenable versions of works on file-sharing networks.
Caller ID spoofing
Public telephone networks often provide caller ID information, which includes the caller's number and sometimes the caller’s name, with each call. However, some technologies (especially in Voice over IP (VoIP) networks) allow callers to forge caller ID information and present false names and numbers. Gateways between networks that allow such spoofing and other public networks then forward that false information. Since spoofed calls can originate from other countries, the laws in the receiver's country may not apply to the caller. This limits laws' effectiveness against the use of spoofed caller ID information to further a scam.[1][failed verification]
E-mail address spoofing
The sender information shown in e-mails (the "From" field) can be spoofed easily. This technique is commonly used by spammers to hide the origin of their e-mails and leads to problems such as misdirected bounces (i.e. e-mail spam backscatter).
E-mail address spoofing is done in quite the same way as writing a forged return address using snail mail. As long as the letter fits the protocol, (i.e. stamp, postal code) the SMTP protocol will send the message. It can be done using a mail server with telnet.[2]
GPS spoofing
A GPS spoofing attack attempts to deceive a GPS receiver by broadcasting incorrect GPS signals, structured to resemble a set of normal GPS signals, or by rebroadcasting genuine signals captured elsewhere or at a different time. These spoofed signals may be modified in such a way as to cause the receiver to estimate its position to be somewhere other than where it actually is, or to be located where it is but at a different time, as determined by the attacker. One common form of a GPS spoofing attack, commonly termed a carry-off attack, begins by broadcasting signals synchronized with the genuine signals observed by the target receiver. The power of the counterfeit signals is then gradually increased and drawn away from the genuine signals. It has been suggested that the capture of a Lockheed RQ-170 drone aircraft in northeastern Iran in December, 2011 was the result of such an attack.[3] GPS spoofing attacks had been predicted and discussed in the GPS community previously, but no known example of a malicious spoofing attack has yet been confirmed.[4][5][6] A "proof-of-concept" attack was successfully performed in June, 2013, when the luxury yacht White Rose of Drachs was misdirected with spoofed GPS signals by a group of aerospace engineering students from the Cockrell School of Engineering at the University of Texas in Austin. The students were aboard the yacht, allowing their spoofing equipment to gradually overpower the signal strengths of the actual GPS constellation satellites, altering the course of the yacht.[7][8][9]
Russian GPS spoofing
In June 2017, approximately twenty ships in the Black Sea complained of GPS anomalies, showing vessels to be transpositioned miles from their actual location, in what Professor Todd Humphreys believed was most likely a spoofing attack.[9][10] GPS anomalies around Putin's Palace and the Moscow Kremlin have led researchers to believe that Russian authorities use GPS spoofing wherever Vladimir Putin is located, affecting maritime traffic.[9][11]
GPS Spoofing with SDR
Since the advent of Software Defined Radio, GPS simulator applications have been made available to the general public. This has made GPS spoofing much more accessible, meaning it can be performed at limited expense and with a modicum of technical knowledge.[12]
Preventing GPS spoofing
There are different ways to prevent GPS spoofing. The Department of Homeland Security, in collaboration with the National Cybersecurity and Communications Integration Center (NCCIC) and the National Coordinating Center for Communications (NCC), released a paper which lists methods to prevent this type of spoofing. Some of the most important and most recommended to use are:[13]
- Obscure antennas. Install antennas where they are not visible from publicly accessible locations or obscure their exact locations by introducing impediments to hide the antennas.
- Add a sensor/blocker. Sensors can detect characteristics of interference, jamming, and spoofing signals, provide local indication of an attack or anomalous condition, communicate alerts to a remote monitoring site, and collect and report data to be analyzed for forensic purposes[1].
- Extend data spoofing whitelists to sensors. Existing data spoofing whitelists have been and are being implemented in government reference software, and should also be implemented in sensors.
- Use more GPS signal types. Modernized civil GPS signals are more robust than the L1 signal and should be leveraged for increased resistance to interference, jamming, and spoofing.
- Reduce latency in recognition and reporting of interference, jamming, and spoofing. If a receiver is misled by an attack before the attack is recognized and reported, then backup devices may be corrupted by the receiver before hand over.
These installation and operation strategies and development opportunities described herein can significantly enhance the ability of GNSS receivers and associated equipment to defend against a range of interference, jamming, and spoofing attacks.
See also
- DNS spoofing
- IP address spoofing
- LAND attack
- MAC spoofing
- Phishing
- IDN homograph attack, mixing letters from different alphabets to trick an unsuspecting user into trusting and clicking on a link, also known as "script spoofing".
- Protocol spoofing, the benign simulating of a protocol in order to use another, more appropriate one.
- Stream cipher attack
- Website spoofing
References
- ^ Schneier, Bruce (3 March 2006). "Caller ID Spoofing". schneier.com. Retrieved 16 January 2011.
- ^ Gantz, John; Rochester, Jack B. (2005). Pirates of the Digital Millennium. Upper Saddle River, NJ 07458: Prentice Hall. ISBN 0-13-146315-2.
{{cite book}}: CS1 maint: location (link) - ^ Scott Peterson; Payam Faramarzi (December 15, 2011). "Exclusive: Iran hijacked US drone, says Iranian engineer". Christian Science Monitor.
- ^ Wen, Hengqing; Huang, Peter; Dyer, John; Archinal, Andy; Fagan, John (2004). "Countermeasures for GPS signal spoofing" (PDF). University of Oklahoma. Archived from the original (PDF) on 15 March 2012. Retrieved 16 December 2011.
{{cite web}}: Unknown parameter|deadurl=ignored (|url-status=suggested) (help) - ^ Humphreys, T.E.; Ledvina, B. M.; Psiaki, M.; O'Hanlon, B. W.; Kintner, P.M. (2008). "Assessing the Spoofing Threat: Development of a Portable GPS Civilian Spoofer" (PDF). ION GNSS. Retrieved 16 December 2011.
- ^ Jon S. Warner; Roger G. Johnston (December 2003). "GPS Spoofing Countermeasures". homelandsecurity.org. Archived from the original on 7 February 2012. Retrieved 16 December 2011.
{{cite journal}}: Cite journal requires|journal=(help) - ^ "Students Hijack Luxury Yacht". Secure Business Intelligence Magazine.
- ^ "UT Austin Researchers Successfully Spoof an $80 million Yacht at Sea". The University of Texas at Austin. Retrieved 5 February 2015.
- ^ a b c Lied, Henrik (September 18, 2017). "GPS freaking out? Maybe you're too close to Putin". Norwegian Broadcasting Corporation. Archived from the original on September 25, 2017.
- ^ Goward, Dana A. (July 11, 2017). "Mass GPS Spoofing Attack in Black Sea?". The Maritime Executive.
An apparent mass and blatant, GPS spoofing attack involving over 20 vessels in the Black Sea last month has navigation experts and maritime executives scratching their heads.
{{cite news}}: Italic or bold markup not allowed in:|publisher=(help) - ^ Norwegian Broadcasting Corporation (September 14, 2017). "Moscow correspondent Morten Jentoft shows GPS trouble near Kremlin". YouTube. Retrieved September 25, 2017.
- ^ DEFCONConference (27 October 2017). "DEF CON 25 - David Robinson - Using GPS Spoofing to control time". Retrieved 7 April 2018 – via YouTube.
- ^ The Department of Homeland Security. "Improving the Operation and Development of Global Positioning System (GPS) Equipment Used by Critical Infrastructure". Retrieved November 12, 2017.