I’ve mentioned spoofing quite a bit in various posts and blogs, but what exactly is it?  Spoofing, as it pertains to cybersecurity, is when someone or something pretends to be something else, attempting to gain our confidence to get access to our systems, steal data, steal money, or spread malware. These attacks come in several forms, including:

• Email spoofing
• Website and/or URL spoofing
• Caller ID spoofing
• Text message spoofing
• GPS spoofing
• Man-in-the-middle attacks
• Extension spoofing
• IP spoofing
• Facial spoofing

Cyber criminals aren’t all that original and spoofing is another con to fool us into taking some form of action that the criminal wants us to take; in other words, it’s a more technical variation on a con artists skill set.  Very often, merely invoking the name of a big, trusted organisation is enough to get us to give up information or take some kind of action. For example, a spoofed email might inquire about purchases you never made. Concerned about your account, you might click the included link.

From that malicious link, scammers will send you to a web page with a malware download or a faked login page, complete with a familiar logo and spoofed link to a web page, for the purpose of harvesting your username and password.

There are many more ways a spoofing attack can play out. In all of them, fraudsters rely on victims falling for the fake. If you never doubt the legitimacy of a website and never suspect an email of being faked, then you could become a victim of a spoofing attack at some point.

Let’s look at some types of spoofing.

Email spoofing is the act of sending emails with false sender addresses, usually as part of a phishing attack designed to steal your information, infect your computer with malware or just ask for money. An example of this is the fabled CEO attack whereby a spoofed email is sent to someone in your accounts payable department attaching an invoice from a fake supplier and purporting to come from the CEO or other senior manager, with the instruction to pay the invoice now, without delay, and sounding like the senior manager is angry about something.  Of course, this is quite easy to defend against by having a rule in place that if a suspect email is received, the alleged sender should be contacted for verification.  Be aware though, if you simply reply to the email, it will go back to the scammer, you must open a fresh email or make a call.

Phishing emails will typically include a combination of deceptive features:

• False sender address designed to look like it’s from someone you know and trust, maybe a friend, coworker, family member, or company you do business with. 
• In the case of a company or organisation, the email may include familiar branding, e.g. logo, colours, font, call to action button, etc.
• Spear phishing attacks target an individual or small group within a company and will include personalised language and address the recipient by name.
• Typos. Email scammers can be lazy and often don’t spend much time proofreading their own work. Email spoofs often have typos, or they look like someone translated the text through Google Translate.

Website spoofing is all about making a malicious website look like a legitimate one. The spoofed site will look like the login page for a website you frequent, down to the branding, user interface, and even a spoofed domain name that looks the same at first glance. Cybercriminals use spoofed websites to capture your username and password (aka login spoofing) or drop malware onto your computer.

Caller ID spoofing happens when scammers fool your caller ID by making the call appear to be coming from somewhere it isn’t. Scammers have learned that you’re more likely to answer the phone if the caller ID shows an area code the same or near your own.

Text message spoofing or SMS spoofing is sending a text message with someone else’s phone number or sender ID. If you’ve ever sent a text message from your laptop, you’ve spoofed your own phone number to send the text, because the text did not actually originate from your phone.

Man-in-the-Middle (MitM) attacks can happen when you use free Wi-Fi at your local coffee shop. Have you considered what would happen if a cybercriminal hacked the Wi-Fi or created another fraudulent Wi-Fi network in the same location?

Extension spoofing occurs when cybercriminals need to disguise executable malware files. One common extension spoofing trick criminals like to use is to name the file something along the lines of “filename.txt.exe.” The criminals know file extensions are hidden by default in Windows so to the average Windows user this executable file will appear as “filename.txt.”

IP spoofing is used when someone wants to hide or disguise the location from which they’re sending or requesting data online.

Facial spoofing might be the most personal, because of the implications it carries for the future of technology and our personal lives. As it stands, facial ID technology is limited. We use our faces to unlock our mobile devices and laptops, and not much else. This is likely to spread, and the use of AI makes facial spoofing more likely.  Imagine if we advance to using facial recognition to make online payments – scary stuff.

There’s a lot more to this subject, for instance, how do you spot it?  How do you protect yourself against it?  The best form of defence is simply cyber awareness training, something you’re probably getting fed up hearing from me.  But it’s simply a fact that your staff can be your first line of defence, or your biggest threat.

Malwarebytes have published a more detailed article on this subject but even that needs some understanding and explanation.