What is Cybersecurity?
Learn what cybersecurity is and understand the definitions of different types of threats.
We’ve all seen movies like The Sting, Catch Me If You Can and The Good Liar. Each of these involve people who spoof identities for various reasons. Movies about cybercrime – such as Snowden, Sneakers and the venerable War Games – all involve scenes where people and machines imitate each other for one reason or another. What’s the takeaway here? Spoofing is a time-honored activity, and one type of cyberattack that often leads to a much larger hack.
With spoofing, hackers and attackers of all types imitate people, companies and even computers with the intent to trick people into giving up personal information in order to gain access to something valuable. Spoofing can apply to emails, phone calls and websites, or it can be more technical, such as IP spoofing, Address Resolution Protocol (ARP) spoofing or Domain Name System (DNS) server. Oftentimes spoofing is used during a cyberattack to disguise the source of attack traffic.
Spoofing happens when cybercriminals use deception to appear as another person or source of information. That person can manipulate today’s technology, such as email services and messages, or the underlying protocols that run the internet.
Why do they do this? It’s simple: Attackers target people and/or things for some form of profit.
Spoofing usually involves some type of pretext followed by an action statement.
The pretext is the initial, believable assertion, or lie, where the attacker comes up with a convincing story or idea. Sometimes, this lie involves a request from an authority. Other times, the scammer indicates that there is limited time available, and the person or machine must act now. The key to the pretext is that it is plausible and is within the comfort level of the victim. If the pretext is too outrageous, too generic or simply not relevant, then the attacker will likely fail.
The action statement tells the victim what they must do, such as click a link or enter some information on a form. Many times, the action statement, or ask, seems fairly benign. After all, we all click on links every day. Sometimes the action statement is more forceful, such as an ask to provide a credit card number, bank information or a social security number to remedy a situation. The action statement also has to be something that the victim is capable of doing. If the attacker asks for the impossible, then usually the intended victim will ignore the social engineering attempt.
Learn what cybersecurity is and understand the definitions of different types of threats.
What is malware? Understand the definition as well as how to prevent and remove it, from CompTIA.
What is social engineering? Understand the definition as well as how to prevent and protect against it, from CompTIA.
There are many ways that attackers engage in spoofing. Some of the most common types of spoofing include phone/caller ID spoofing, GPS, website, IP address, facial, DNS and ARP.
Type of Spoof | Description |
|---|---|
Phone/Caller ID | An attacker uses a phone app or a piece of hardware to falsify caller ID information sent across a voice network. The telephone network has no real way to verify that the spoofed phone number has been falsified and forwards that information to the unsuspecting user. |
GPS | The use of an app or hardware to convince a device’s GPS to report that the device is in a different location than it actually is. |
Website | An attacker creates an entire malicious website, complete with convincing landing pages. The website will often contain password reset instructions and even digital certifications to trick users into thinking that the website is a legitimate source. |
Facial | The subversion of authentication systems, such as those on an Android or iPhone, that use facial recognition. In some cases, attackers have used masks or computer screens with pictures or videos of the person they wish to imitate. Increasingly, we’re seeing “deep fake” videos used to trick people, as well as authentication systems. |
IP address | The traditional IPv4 protocol has no built-in authentication or encryption. Therefore, it’s easy to create fake IP addresses. It is also possible to forge IPv6 addresses, because few fully implement the IPv6 standard. |
Domain Name System (DNS) | The point of the DNS system is to map user-friendly names (e.g., comptia.org) to an IP address. With DNS spoofing, attackers are able to upload bogus information to a DNS server and poison the database. The result is that an end user may think they are going to www.comptia.org, but they are actually sent to a fake website created by a hacker. |
Address Resolution Protocol (ARP) | While people communicate via DNS names, computers communicate via Media Access Code (MAC) and IP addresses. The ARP resolves MAC addresses to IPv4 or IPv6 addresses. Like IPv4, ARP does not include any encryption or authentication mechanism, which allows hackers to imitate MAC addresses. This can lead to many forms of deception of both people and machines. |
Let’s take a deeper dive into a few of these types of spoofing.
At one time or another, all of us have received emails supposedly coming from a friend or an authority figure asking us to do something. Most of the time, we can easily determine that someone is trying to trick (or phish) us. But, sometimes, those emails are pretty convincing.
Here is an example of an email that claimed to come from the U.S. Postal Service. Would you think this is a legitimate email?
Figure 1: An email message from a spoofed source
This is actually a pretty good spoof. It has a plausible pretext, as people receive packages through the mail all the time. The email doesn’t have any misspellings, it has good graphics and it is authoritative. In other words, it has a good action statement.
But something is wrong.
Usually when you hover the mouse over the contact name, you’ll see the actual email address the message originated from. In this case, you can see that this email didn’t really originate from the U.S. Postal Service. It really came from the address [email protected], as shown below.
Figure 2: Investigating a spoofed email
It’s highly doubtful that bksamson is the U.S. Postmaster General. Being cautious and more than a little skeptical concerning email, spoof texts or spoof phone numbers is the primary way to protect yourself from email spoofing.
A common example of GPS spoofing is Pokémon Go spoofing. The Pokémon Go game is all about gathering points based on physically traveling to specific locations. But through GPS spoofing, people can cheat by convincing the Pokémon Go app that they have been places they actually haven’t, gathering points improperly.
While the Pokémon Go spoofing example is relatively trivial, GPS spoofing is a much more serious issue when it comes to tracking apps issued by governments.
For example, many governments have proposed the use of tracking applications to help contain pandemics (e.g., COVID-19) and otherwise manage populations. Regardless of the motive behind contact tracing, the fact that it is currently possible to trick a GPS device or an application that uses a GPS device is an issue that IT professionals and government policymakers alike need to understand.
Applications such as the Social Engineering Toolkit (SET), shown below, exist to create convincing websites. Many times, these websites have seemingly legitimate names that are often convincing variations of legitimate sites.
Figure 3: The Social Engineering Toolkit (SET)
For example, an attacker may send a text or email directing the victim to reset a password at www.comptia1.com, instead of the legitimate website www.comptia.org.
It is even possible to obtain encryption certificates for spoofed websites. This can make the ruse even more convincing to a distracted user.
It is relatively easy to create – or spoof – any element of a traditional IP address. As a result, it is possible for attackers to thwart detection and trick people or machines into revealing information or unwittingly engaging in attacks.
For example, check out the following command created on a Linux system:
james@stangernet1:~/Desktop$ hping3 -a 10.18.21.24 192.168.55.56 -S -q -p 80 --flood[DM4]
Basically, this command is telling a Linux system to send a flood of TCP SYN packets to a victim computer with the IP address of 192.168.55.56. This is an example of how a Denial of Service (DoS) attack is conducted. Similarly, when multiple systems work together to target one system, that’s known as a Distributed Denial of Service (DDoS) attack.
Going back to the above example, the command also tells the Linux system to spoof the source IP address of all of the packets. This flood of packets will have the fake source IP address of 10.18.21.24.26.
The diagram below shows the results from the above command.
Figure 4: Diagram of a DoS attack
In this attack, a flood of partial TCP synchronization commands with a spoofed source address (10.18.21.24.26) have been sent. The victim computer receives this flood of packets, and then responds to what it thinks is the correct IP address.
But because the source address is a fake, the victim system can’t respond properly. Instead, the victim will dutifully process all of these thousands of fake TCP packets again and again. Eventually the victim system will become overwhelmed and will no longer be able to work.
Plus, any responses from the victim will go to a third IP address. That third IP address might be real or fake. If the third IP address is real, then that system could become an additional victim.
The primary way spoofers hack organizations is by tricking employees. Thankfully, most organizations have active cybersecurity programs to avoid these things.
The IT industry has created many solutions to combat malware and spoofing – and it’s always creating new ones. For example, the IPv6 specification includes effective authentication and encryption mechanisms.
The IT industry continues to adopt two-factor authentication (2FA), which is where you combine the use of biometric information (e.g., facial recognition, fingerprints) with passwords or a physical token. The use of 2FA can help reduce facial recognition system hacks, as well as phishing.
The best way to protect yourself against phishing and caller ID spoofing is to educate yourself about how to identify fake emails and websites and how to respond to unsolicited offers and demands. This is why smart organizations have regular end user training campaigns.
IT professionals can use sophisticated intrusion detection applications and security information and event management (SIEM) tools. Many times, IT pros use IP tracking services, such as IP Tracker , IP2Location and InfoSniper to track packets.
Figure 5: The IP Tracker website
But, the primary way IT pros can guard against spoofing is to carefully learn all the details about the underlying network protocols and best practices necessary to run a network. This means that you should learn about the TCP/IP family of protocols, which include the Transmission Control Protocol (TCP), the Internet Protocol (IP), the User Datagram Protocol (UDP) and many others.
IT support professionals, like network administrators, need to understand not only how to run a network, but also how to secure it. Get the skills needed to secure networks with CompTIA Security+. Download the exam objectives for free to see what skills are covered.
Read more about Cybersecurity.