Spoofing attack

In the context of information security, and especially network security, a spoofing attack is a situation in which a person or program successfully identifies as another by falsifying data, to gain an illegitimate advantage.^[1]

Internet

Spoofing and TCP/IP

Main articles: IP address spoofing and ARP spoofing

Many of the protocols in the TCP/IP suite do not provide mechanisms for authenticating the source or destination of a message,^[2] leaving them vulnerable to spoofing attacks when extra precautions are not taken by applications to verify the identity of the sending or receiving host. IP spoofing and ARP spoofing in particular may be used to leverage man-in-the-middle attacks against hosts on a computer network. Spoofing attacks which take advantage of TCP/IP suite protocols may be mitigated with the use of firewalls capable of deep packet inspection or by taking measures to verify the identity of the sender or recipient of a message.

Domain name spoofing

Main article: Domain name § Domain name spoofing

The term 'Domain name spoofing' (or simply though less accurately, 'Domain spoofing') is used generically to describe one or more of a class of phishing attacks that depend on falsifying or misrepresenting an internet domain name.^[3][4] These are designed to persuade unsuspecting users into visiting a web site other than that intended, or opening an email that is not in reality from the address shown (or apparently shown).^[5] Although website and email spoofing attacks are more widely known, any service that relies on domain name resolution may be compromised.

Referrer spoofing

Main article: Referer spoofing

Some websites, especially pornographic paysites, allow access to their materials only from certain approved (login-) pages. This is enforced by checking the referrer header of the HTTP request. This referrer header, however, can be changed (known as "referrer spoofing" or "Ref-tar spoofing"), allowing users to gain unauthorized access to the materials.

Poisoning of file-sharing networks

Main article: Spoofing (anti-piracy measure)

"Spoofing" can also refer to copyright holders placing distorted or unlistenable versions of works on file-sharing networks.

E-mail address spoofing

Main article: Email spoofing

The sender information shown in e-mails (the From: field) can be spoofed easily. This technique is commonly used by spammers to hide the origin of their e-mails and leads to problems such as misdirected bounces (i.e. e-mail spam backscatter).

E-mail address spoofing is done in quite the same way as writing a forged return address using snail mail. As long as the letter fits the protocol, (i.e. stamp, postal code) the Simple Mail Transfer Protocol (SMTP) will send the message. It can be done using a mail server with telnet.^[6]

Geolocation

Geolocation spoofing occurs when a user applies technologies to make their device appear to be located somewhere other than where it is actually located.^[7] The most common geolocation spoofing is through the use of a Virtual Private Network (VPN) or DNS Proxy in order for the user to appear to be located in a different country, state or territory other than where they are actually located. According to a study by GlobalWebIndex, 49% of global VPN users utilize VPNs primarily to access territorially restricted entertainment content.^[8] This type of geolocation spoofing is also referred to as geo-piracy, since the user is illicitly accessing copyrighted materials via geolocation spoofing technology. Another example of geolocation spoofing occurred when an online poker player in California used geolocation spoofing techniques to play online poker in New Jersey, in contravention of both California and New Jersey state law.^[9] Forensic geolocation evidence proved the geolocation spoofing and the player forfeited more than $90,000 in winnings.

Telephony

Caller ID spoofing

Main article: Caller ID spoofing

Public telephone networks often provide caller ID information, which includes the caller's number and sometimes the caller's name, with each call. However, some technologies (especially in Voice over IP (VoIP) networks) allow callers to forge caller ID information and present false names and numbers. Gateways between networks that allow such spoofing and other public networks then forward that false information. Since spoofed calls can originate from other countries, the laws in the receiver's country may not apply to the caller. This limits laws' effectiveness against the use of spoofed caller ID information to further a scam.^{[10][failed verification]}

Global navigation satellite system spoofing

A global navigation satellite system (GNSS) spoofing attack attempts to deceive a GNSS receiver by broadcasting fake GNSS signals, structured to resemble a set of normal GNSS signals, or by rebroadcasting genuine signals captured elsewhere or at a different time.^[11] Spoofing attacks are generally harder to detect as adversaries generate counterfeit signals. These spoofed signals are challenging to recognize from legitimate signals, thus confusing ships' calculation of positioning, navigation, and timing (PNT).^[12] This means that spoofed signals may be modified in such a way as to cause the receiver to estimate its position to be somewhere other than where it actually is, or to be located where it is but at a different time, as determined by the attacker. One common form of a GNSS spoofing attack, commonly termed a carry-off attack, begins by broadcasting signals synchronized with the genuine signals observed by the target receiver. The power of the counterfeit signals is then gradually increased and drawn away from the genuine signals.^[11]

Even though GNSS is one of the most relied upon navigational systems, it has demonstrated critical vulnerabilities towards spoofing attacks. GNSS satellite signals have been shown to be vulnerable due to the signals’ being relatively weak on Earth’s surface, making GNSS signals ultimate targets for spoofing attacks. Furthermore, it has been suggested that the systems are continuously and recklessly deemed trustworthy even though there, at present, are no means of protecting the systems, signals, or safely guarding vessels against malicious spoofing attacks.^[13] Resultingly, the reliance upon systems such as GNSS has opened the door for outside attackers to send malicious commands that could result in the loss of human lives, environmental contamination, navigation accidents, and financial costs.^[14][15][16] However, seeing as more than 80% of global trade is moved through shipping companies, relying upon GNSS systems for navigation is necessary even though maritime vessels will be vulnerable to spoofing attacks with limited countermeasures.^[17][18]

Potential use of GPS spoofing against a naval vessel

All GNSS systems, such as the US GPS, Russia's GLONASS, China's BeiDou, and Europe's Galileo constellation, are vulnerable to this technique.^[19] It has been suggested that in order to mitigate some of the vulnerabilities the GNSS systems face concerning spoofing attacks, the use of more than one navigational system at once is recommended.^[20]

It was suggested that the December 2011 capture of a Lockheed RQ-170 drone aircraft in northeastern Iran was the result of such an attack.^[21] GNSS spoofing attacks had been predicted and discussed in the GNSS community as early as 2003.^[22][23][24] A "proof-of-concept" attack was successfully performed in June 2013, when the luxury yacht White Rose of Drachs was misdirected with spoofed GPS signals by a group of aerospace engineering students from the Cockrell School of Engineering at the University of Texas in Austin. The students were aboard the yacht, allowing their spoofing equipment to gradually overpower the signal strengths of the actual GPS constellation satellites, altering the course of the yacht.^[25][26][27]

In 2019, the British oil tanker Stena Impero was the target of a spoofing attack that directed the ship into Iranian waters where it was seized by Iranian forces. Consequently, the vessel including its crew and cargo were used as pawns in a geopolitical conflict. Several shipping companies with vessels navigating around Iranian waters are instructing vessels to transit dangerous areas with high speed and during daylight.^[28]

On October 15, 2023, Israel Defense Forces (IDF) announced that GPS had been “restricted in active combat zones in accordance with various operational needs,” but has not publicly commented on more advanced interference. In April 2024, however, researchers at University of Texas at Austin detected false signals and traced their origin to a particular air base in Israel run by the IDF.^[29]

Russian GPS spoofing

See also: Krasukha § Operational_history, Borisoglebsk-2, and Automatic Dependent Surveillance–Broadcast

In June 2017, approximately twenty ships in the Black Sea complained of GPS anomalies, showing vessels to be transpositioned miles from their actual location, in what Professor Todd Humphreys believed was most likely a spoofing attack.^[27][30] GPS anomalies around Putin's Palace and the Moscow Kremlin, demonstrated in 2017 by a Norwegian journalist on air, have led researchers to believe that Russian authorities use GPS spoofing wherever Vladimir Putin is located.^[27][31]

The mobile systems named Borisoglebsk-2, Krasukha and Zhitel are reported to be able to spoof GPS.^[32]

Incidents involving Russian GPS spoofing include during a November 2018 NATO exercise in Finland that led to ship collision (unconfirmed by authorities).^[33] and a 2019 incident of spoofing from Syria by the Russian military that affected the civil airport in Tel Aviv.^[34][35]

In December of 2022 significant GPS interference in several Russian cities was reported by the GPSJam service; the interference was attributed to defensive measures taken by Russian authorities in the wake of the invasion of Ukraine.^[19]

GPS spoofing with SDR

Since the advent of software-defined radio (SDR), GPS simulator applications have been made available to the general public. This has made GPS spoofing much more accessible, meaning it can be performed at limited expense and with a modicum of technical knowledge.^[36] Whether this technology applies to other GNSS systems remains to be demonstrated.

Preventing GNSS spoofing

The Department of Homeland Security, in collaboration with the National Cybersecurity and Communications Integration Center (NCCIC) and the National Coordinating Center for Communications (NCC), released a paper which lists methods to prevent this type of spoofing. Some of the most important and most recommended to use are:^[37]

1. Obscure antennas. Install antennas where they are not visible from publicly accessible locations or obscure their exact locations by introducing impediments to hide the antennas.
2. Add a sensor/blocker. Sensors can detect characteristics of interference, jamming, and spoofing signals, provide local indication of an attack or anomalous condition, communicate alerts to a remote monitoring site, and collect and report data to be analyzed for forensic purposes.^[38]
3. Extend data spoofing whitelists to sensors. Existing data spoofing whitelists have been and are being implemented in government reference software, and should also be implemented in sensors.
4. Use more GNSS signal types. Modernized civil GPS signals are more robust than the L1 signal and should be leveraged for increased resistance to interference, jamming, and spoofing.
5. Reduce latency in recognition and reporting of interference, jamming, and spoofing. If a receiver is misled by an attack before the attack is recognized and reported, then backup devices may be corrupted by the receiver before hand-over.

These installation and operation strategies and development opportunities can significantly enhance the ability of GPS receivers and associated equipment to defend against a range of interference, jamming, and spoofing attacks. A system and receiver agnostic detection software offers applicability as cross-industry solution. Software implementation can be performed in different places within the system, depending on where the GNSS data is being used, for example as part of the device's firmware, operating system, or on the application level.^{[citation needed]}

A method proposed by researchers from the Department of Electrical and Computer Engineering at the University of Maryland, College Park and the School of Optical and Electronic Information at Huazhong University of Science and Technology that aims to help mitigate the effects of GNSS spoofing attacks by using data from a vehicles controller area network (CAN) bus. The information would be compared to that of received GNSS data and compared in order to detect the occurrence of a spoofing attack and to reconstruct the driving path of the vehicle using that collected data. Properties such as the vehicles speed and steering angle would be amalgamated and regression modeled in order to achieve a minimum error in position of 6.25 meters.^[39] Similarly, a method outlined by researchers in a 2016 IEEE Intelligent Vehicles Symposium conference paper discuss the idea of using cooperative adaptive cruise control (CACC) and vehicle to vehicle (V2V) communications in order to achieve a similar goal. In this method, the communication abilities of both cars and radar measurements are used to compare against the supplied GNSS position of both cars to determine the distance between the two cars which is then compared to the radar measurements and checked to make sure they match. If the two lengths match within a threshold value, then no spoofing has occurred, but above this threshold, the user is notified so that s/he can take action.^[40]

Voice spoofing

Information technology plays an increasingly large role in today's world, and different authentication methods are used for restricting access to informational resources, including voice biometrics. Examples of using speaker recognition systems include internet banking systems, customer identification during a call to a call center, as well as passive identification of a possible criminal using a preset "blacklist".^[41]

Technologies related to the synthesis and modeling of speech are developing very quickly, allowing one to create voice recordings almost indistinguishable from real ones. Such services are called Text-to-Speech (TTS) or Style transfer services. The first one aimed at creating a new person. The second one aimed at identifies as another in voice identification systems.

A large number of scientists are busy developing algorithms that would be able to distinguish the synthesized voice of the machine from the real one. On the other hand, these algorithms need to be thoroughly tested to make sure that the system really works.^[42] However, an early study has shown that feature design and masking augmentation have a significant impact on the ability to detect spoofed voice.^[43]

Facial recognition spoofing

Facial recognition technology is widely employed in various areas, including immigration checks and phone security, as well as on popular platforms like Airbnb and Uber to verify individuals' identities. However, the increased usage has rendered the system more susceptible to attacks, given the widespread integration of facial recognition systems in society. Some online sources and tutorials detail methods for tricking facial recognition systems through practices known as face spoofing or presentation attacks, which can pose risks in terms of unauthorized access. To mitigate these dangers, measures such as liveness checks (verifying blinking), deep learning, and specialized cameras like 3D cameras have been introduced to prevent facial recognition spoofing. It is important to implement comprehensive security procedures like these to protect against face spoofing attempts and uphold the overall security and integrity of systems relying on facial recognition authentication.^[44]

See also

• Domain name spoofing – class of phishing attacks that depend on falsifying or misrepresenting an internet domain name
  • DNS spoofing – Cyberattack using corrupt DNS data
  • Email spoofing – Creating email spam or phishing messages with a forged sender identity or address
  • IP address spoofing – Creating IP packets using a false IP address
  • IDN homograph attack – Visually similar letters in domain names, mixing letters from different alphabets to trick an unsuspecting user into trusting and clicking on a link, also known as "script spoofing".
  • Website spoofing – Creating a website, as a hoax, with the intention of misleading readers
• LAND attack – Denial of Service attackPages displaying wikidata descriptions as a fallback using spoofed network packets
• MAC spoofing – Changing a factory-assigned MAC address
• Phishing – Impersonating a reputable organization via electronic media (most often by telephone or email).
• Stream cipher attacks – Methods to break a stream cipher

Standard facilities that might be subverted

• Protocol spoofing – Benign simulation of a protocol (in order to use another, more appropriate one).

References

1. Jindal, K.; Dalal, S.; Sharma, K. K. (February 2014). "Analyzing Spoofing Attacks in Wireless Networks". 2014 Fourth International Conference on Advanced Computing & Communication Technologies. pp. 398–402. doi:10.1109/ACCT.2014.46. ISBN 978-1-4799-4910-6. S2CID 15611849.
2. Veeraraghavan, Prakash; Hanna, Dalal; Pardede, Eric (2020-09-14). "NAT++: An Efficient Micro-NAT Architecture for Solving IP-Spoofing Attacks in a Corporate Network". Electronics. 9 (9): 1510. doi:10.3390/electronics9091510. ISSN 2079-9292.
3. "Canadian banks hit by two-year domain name spoofing scam". Finextra. 9 January 2020.
4. "Domain spoofing". Barracuda Networks.
5. Tara Seals (August 6, 2019). "Mass Spoofing Campaign Abuses Walmart Brand". threatpost.
6. Gantz, John; Rochester, Jack B. (2005). Pirates of the Digital Millennium. Upper Saddle River, NJ: Prentice Hall. ISBN 0-13-146315-2.
7. Günther, Christoph (2014-09-14). "A Survey of Spoofing and Counter-Measures". Navigation. 61 (3): 159–177. doi:10.1002/navi.65.
8. "VPNs Are Primarily Used to Access Entertainment". GlobalWebIndex Blog. 2018-07-06. Retrieved 2019-04-12.
9. Hintze, Haley (2019-03-09). "California Online Poker Pro Forfeits Over $90,000 for Geolocation-Evading New Jersey Play". Flushdraw.net. Retrieved 2019-04-12.
10. Schneier, Bruce (3 March 2006). "Caller ID Spoofing". schneier.com. Retrieved 16 January 2011.
11. Coffed, Jeff (February 2014). "The Threat of GPS Jamming The Risk to an Information Utility" (PDF). Exelis.
12. Spravil, J., Hemminghaus, C., von Rechenberg, M., Padilla, E., & Bauer, J. (2023). Detecting Maritime GPS Spoofing Attacks Based on NMEA Sentence Integrity Monitoring. Journal of Marine Science and Engineering, 11(5), 928-. https://doi.org/10.3390/jmse11050928
13. Spravil, J., Hemminghaus, C., von Rechenberg, M., Padilla, E., & Bauer, J. (2023). Detecting Maritime GPS Spoofing Attacks Based on NMEA Sentence Integrity Monitoring. Journal of Marine Science and Engineering, 11(5), 928-. https://doi.org/10.3390/jmse11050928
14. Androjna, A., Brcko, T., Pavic, I., & Greidanus, H. (2020). Assessing Cyber Challenges of Maritime Navigation. Journal of Marine Science and Engineering, 8(10), 776-. https://doi.org/10.3390/jmse8100776
15. Leite Junior, W. C., de Moraes, C. C., de Albuquerque, C. E. P., Machado, R. C. S., & de Sa, A. O. (2021). A Triggering Mechanism for Cyber-Attacks in Naval Sensors and Systems. Sensors (Basel, Switzerland), 21(9), 3195-. https://doi.org/10.3390/s21093195
16. Spravil, J., Hemminghaus, C., von Rechenberg, M., Padilla, E., & Bauer, J. (2023). Detecting Maritime GPS Spoofing Attacks Based on NMEA Sentence Integrity Monitoring. Journal of Marine Science and Engineering, 11(5), 928-. https://doi.org/10.3390/jmse11050928
17. Amro, Ahmed; Gkioulos, Vasileios (2022). "From Click to Sink: Utilizing AIS for Command and Control in Maritime Cyber Attacks". In Vijayalakshmi Atluri; Roberto Di Pietro; Christian D. Jensen; Meng Weizhi (eds.). Computer Security – ESORICS 2022, Proceedings part 3. 27th European Symposium on Research in Computer Security, Copenhagen, Denmark, September 26–30, 2022. Lecture Notes in Computer Science. Vol. 13556. pp. 535–553. doi:10.1007/978-3-031-17143-7_26. hdl:11250/3049159. ISBN 978-3-031-17142-0.
18. Leite Junior, Walmor Cristino; de Moraes, Claudio Coreixas; de Albuquerque, Carlos E. P.; Machado, Raphael Carlos Santos; de Sá, Alan Oliveira (4 May 2021). "A Triggering Mechanism for Cyber-Attacks in Naval Sensors and Systems". Sensors. 21 (9): 3195. Bibcode:2021Senso..21.3195L. doi:10.3390/s21093195. PMC 8124306. PMID 34064505.
19. Burgess, Matt (15 December 2022). "GPS Signals Are Being Disrupted in Russian Cities". Wired. ISSN 1059-1028.
20. Androjna, Andrej; Brcko, Tanja; Pavic, Ivica; Greidanus, Harm (3 October 2020). "Assessing Cyber Challenges of Maritime Navigation". Journal of Marine Science and Engineering. 8 (10): 776. doi:10.3390/jmse8100776.
21. Scott Peterson; Payam Faramarzi (December 15, 2011). "Exclusive: Iran hijacked US drone, says Iranian engineer". Christian Science Monitor.
22. Wen, Hengqing; Huang, Peter; Dyer, John; Archinal, Andy; Fagan, John (2004). "Countermeasures for GPS signal spoofing" (PDF). University of Oklahoma. Archived from the original (PDF) on 15 March 2012.
23. Humphreys, T.E.; Ledvina, B. M.; Psiaki, M.; O'Hanlon, B. W.; Kintner, P.M. (2008). "Assessing the Spoofing Threat: Development of a Portable GPS Civilian Spoofer" (PDF). Ion GNSS. Retrieved 16 December 2011.
24. Jon S. Warner; Roger G. Johnston (December 2003). "GPS Spoofing Countermeasures". Los Alamos Research Paper. LAUR-03-6163. homelandsecurity.org. Archived from the original on 7 February 2012. Retrieved 16 December 2011.
25. "Students Hijack Luxury Yacht". Secure Business Intelligence Magazine.
26. Leahy, Cory (29 July 2013). "UT Austin Researchers Successfully Spoof an $80 million Yacht at Sea". Ut News. Retrieved 5 February 2015.
27. Lied, Henrik (September 18, 2017). "GPS freaking out? Maybe you're too close to Putin". Norwegian Broadcasting Corporation. Archived from the original on September 25, 2017.
28. Androjna, A., Brcko, T., Pavic, I., & Greidanus, H. (2020). Assessing Cyber Challenges of Maritime Navigation. Journal of Marine Science and Engineering, 8(10), 776-. https://doi.org/10.3390/jmse8100776
29. Arraf, Jane (April 22, 2024). "Israel fakes GPS locations to deter attacks, but it also throws off planes and ships". NPR. Retrieved 2 June 2024.
30. Goward, Dana A. (July 11, 2017). "Mass GPS Spoofing Attack in Black Sea?". The Maritime Executive. An apparent mass and blatant, GPS spoofing attack involving over 20 vessels in the Black Sea last month has navigation experts and maritime executives scratching their heads.
31. Norwegian Broadcasting Corporation (September 14, 2017). "Moscow correspondent Morten Jentoft shows GPS trouble near Kremlin". YouTube. Retrieved September 25, 2017.
32. Cranny-Evans, Samuel (14 June 2019). "Russia trials new EW tactics". Janes.com.
33. "Russia suspected of jamming GPS signal in Finland". BBC News. 12 November 2018. Retrieved 28 December 2019 – via BBC.
34. Times Of Israel (5 August 2019). "Disruption of GPS systems at Ben Gurion Airport resolved after 2 months". Retrieved 29 December 2019 – via Times of Israel.
35. JOFFRE, TZVI; BOB, YONAH JEREMY (23 July 2019). "MI6 fears Iran used Russian GPS tech to send UK tanker off course - report". The Jerusalem Post.
36. DEFCONConference (27 October 2017). "DEF CON 25 - David Robinson - Using GPS Spoofing to control time". Retrieved 7 April 2018 – via YouTube.
37. The Department of Homeland Security. "Improving the Operation and Development of Global Positioning System (GPS) Equipment Used by Critical Infrastructure". Retrieved November 12, 2017.
38. Lundberg, Erik; McMichael, Ian (2018). "Novel Timing Antennas for Improved GNSS Resilience" (PDF). Mitre Corporation.
39. Wang, Qian & Lu, Zhaojun & Qu, Gang. (2018). Edge Computing based GPS Spoofing Detection Methods. 10.1109/ICDSP.2018.8631600.
40. Carson, N.; Martin, S.; Starling, J.; Bevly, D. (2016). GPS spoofing detection and mitigation using Cooperative Adaptive Cruise Control system. 2016 IEEE Intelligent Vehicles Symposium (IV), 2016-. pp. 1091–1096. doi:10.1109/IVS.2016.7535525.
41. Shchemelinin, Vadim; Topchina, Mariia; Simonchik, Konstantin (2014). Ronzhin, Andrey; Potapova, Rodmonga; Delic, Vlado (eds.). Vulnerability of Voice Verification Systems to Spoofing Attacks by TTS Voices Based on Automatically Labeled Telephone Speech. International Conference on Speech and Computer. Lecture Notes in Computer Science. Vol. 8773. Cham: Springer International Publishing. pp. 475–481. doi:10.1007/978-3-319-11581-8_59. ISBN 978-3-319-11581-8.
42. Sinitca, Aleksandr M.; Efimchik, Nikita V.; Shalugin, Evgeniy D.; Toropov, Vladimir A.; Simonchik, Konstantin (January 2020). "Voice Antispoofing System Vulnerabilities Research". 2020 IEEE Conference of Russian Young Researchers in Electrical and Electronic Engineering (EIConRus). St. Petersburg and Moscow, Russia: IEEE. pp. 505–508. doi:10.1109/EIConRus49466.2020.9039393. ISBN 978-1-7281-5761-0. S2CID 214595791.
43. Cohen, Ariel; Rimon, Inbal; Aflalo, Eran; Permuter, Haim H. (June 2022). "A study on data augmentation in voice anti-spoofing". Speech Communication. 141: 56–67. arXiv:2110.10491. doi:10.1016/j.specom.2022.04.005. S2CID 239050551.
44. Hadid, Abdenour (June 2014). "Face Biometrics Under Spoofing Attacks: Vulnerabilities, Countermeasures, Open Issues, and Research Directions". 2014 IEEE Conference on Computer Vision and Pattern Recognition Workshops. IEEE. pp. 113–118. doi:10.1109/cvprw.2014.22. ISBN 978-1-4799-4308-1. S2CID 9540938.