View source for Spoofing attack

{{Short description|Type of cyber attack}}
In the context of [[information security]], and especially [[network security]], a '''spoofing attack''' is a situation in which a person or program successfully identifies as another by falsifying [[data]], to gain an illegitimate advantage.<ref>{{Cite book|last1=Jindal|first1=K.|last2=Dalal|first2=S.|last3=Sharma|first3=K. K.|title=2014 Fourth International Conference on Advanced Computing & Communication Technologies |chapter=Analyzing Spoofing Attacks in Wireless Networks |date=February 2014|pages=398–402|doi=10.1109/ACCT.2014.46|isbn=978-1-4799-4910-6|s2cid=15611849}}</ref>

==Internet==
=== Spoofing and TCP/IP ===
{{Main|IP address spoofing|ARP spoofing}}
Many of the protocols in the [[TCP/IP]] suite do not provide mechanisms for [[Authentication|authenticating]] the source or destination of a message,<ref>{{Cite journal |last1=Veeraraghavan |first1=Prakash |last2=Hanna |first2=Dalal |last3=Pardede |first3=Eric |date=2020-09-14 |title=NAT++: An Efficient Micro-NAT Architecture for Solving IP-Spoofing Attacks in a Corporate Network |journal=Electronics |language=en |volume=9 |issue=9 |pages=1510 |doi=10.3390/electronics9091510 |issn=2079-9292|doi-access=free }}</ref> leaving them vulnerable to spoofing attacks when extra precautions are not taken by applications to verify the identity of the sending or receiving host. IP spoofing and [[ARP spoofing]] in particular may be used to leverage [[man-in-the-middle attack]]s against hosts on a [[computer network]]. Spoofing attacks which take advantage of TCP/IP suite protocols may be mitigated with the use of [[firewall (computing)|firewalls]] capable of [[deep packet inspection]] or by taking measures to verify the identity of the sender or recipient of a message.

===Domain name spoofing===
{{main|Domain name#Domain name spoofing}}
The term 'Domain name spoofing' (or simply though less accurately, 'Domain spoofing') is used generically to describe one or more of a class of [[phishing]] attacks that depend on falsifying or misrepresenting an internet [[domain name]].<ref>{{cite news |title= Canadian banks hit by two-year domain name spoofing scam | work=Finextra | url= https://www.finextra.com/newsarticle/35030/canadian-banks-hit-by-two-year-domain-name-spoofing-scam |date=9 January 2020 }}</ref><ref>{{cite web | title =Domain spoofing |publisher = [[Barracuda Networks]] |url=https://www.barracuda.com/glossary/domain-spoofing}}</ref> These are designed to persuade unsuspecting users into visiting a web site other than that intended, or opening an email that is not in reality from the address shown (or apparently shown).<ref>{{cite news |title=Mass Spoofing Campaign Abuses Walmart Brand | work=threatpost |author=Tara Seals |date=August 6, 2019 |url=https://threatpost.com/mass-spoofing-campaign-walmart/146994/ }}</ref> Although website and email spoofing attacks are more widely known, any service that relies on [[Name resolution (computer systems)|domain name resolution]] may be compromised.

=== Referrer spoofing ===
{{Main|Referer spoofing}}
Some websites, especially pornographic [[paysite]]s, allow access to their materials only from certain approved (login-) pages. This is enforced by checking the [[HTTP referrer|referrer]] header of the [[HTTP]] request. This referrer header, however, can be changed (known as "[[referrer spoofing]]" or "Ref-tar spoofing"), allowing users to gain unauthorized access to the materials.

=== Poisoning of file-sharing networks ===
{{Main|Spoofing (anti-piracy measure)}}

"[[Spoofing (anti-piracy measure)|Spoofing]]" can also refer to [[copyright]] holders placing distorted or unlistenable versions of works on [[file-sharing]] networks.

=== E-mail address spoofing ===
{{Main|Email spoofing}}

The sender information shown in [[e-mail]]s (the <code>From:</code> field) can be spoofed easily. This technique is commonly used by [[E-mail spam|spammers]] to hide the origin of their e-mails and leads to problems such as misdirected [[Bounce message|bounces]] (i.e. e-mail spam [[backscatter (e-mail)|backscatter]]).

E-mail address spoofing is done in quite the same way as writing a forged return address using [[snail mail]].  As long as the letter fits the protocol, (i.e. stamp, [[postal code]]) the [[Simple Mail Transfer Protocol|Simple Mail Transfer Protocol (SMTP)]] will send the message.  It can be done using a mail server with [[telnet]].<ref>{{cite book|last=Gantz|first=John|title=Pirates of the Digital Millennium|year=2005|publisher=[[Prentice Hall]]|location=Upper Saddle River, NJ|isbn=0-13-146315-2|author2=Rochester, Jack B. }}</ref>

=== Geolocation===
[[Geopositioning|Geolocation]] spoofing occurs when a user applies technologies to make their device appear to be located somewhere other than where it is actually located.<ref>{{Cite journal |last=Günther |first=Christoph |date=2014-09-14 |title=A Survey of Spoofing and Counter-Measures |url=https://onlinelibrary.wiley.com/doi/10.1002/navi.65 |journal=Navigation |language=en |volume=61 |issue=3 |pages=159–177 |doi=10.1002/navi.65|url-access=subscription }}</ref> The most common geolocation spoofing is through the use of a [[Virtual private network|Virtual Private Network]] (VPN) or [[Domain Name System|DNS]] Proxy in order for the user to appear to be located in a different country, state or territory other than where they are actually located. According to a study by [[GlobalWebIndex]], 49% of global VPN users utilize VPNs primarily to access [[Geo-blocking|territorially restricted]] entertainment content.<ref>{{Cite web|url=https://blog.globalwebindex.com/chart-of-the-day/vpns-are-primarily-used-to-access-entertainment/|title=VPNs Are Primarily Used to Access Entertainment|date=2018-07-06|website=GlobalWebIndex Blog|language=en-GB|access-date=2019-04-12}}</ref> This type of geolocation spoofing is also referred to as geo-piracy, since the user is illicitly accessing copyrighted materials via geolocation spoofing technology. Another example of geolocation spoofing occurred when an online poker player in California used geolocation spoofing techniques to play online poker in [[New Jersey]], in contravention of both [[California]] and New Jersey state law.<ref>{{Cite web|url=http://www.flushdraw.net/news/california-online-poker-pro-forfeits-over-90000-geolocation-evading-fraudulent-new-jersey-play/|title=California Online Poker Pro Forfeits Over $90,000 for Geolocation-Evading New Jersey Play|last=Hintze|first=Haley|date=2019-03-09|website=Flushdraw.net|language=en-GB|access-date=2019-04-12}}</ref> Forensic geolocation evidence proved the geolocation spoofing and the player forfeited more than $90,000 in winnings.

==Telephony==
=== Caller ID spoofing ===
{{Main|Caller ID spoofing}}
Public telephone networks often provide [[caller ID]] information, which includes the caller's number and sometimes the caller's name, with each call. However, some technologies (especially in [[Voip|Voice over IP (VoIP)]] networks) allow callers to forge caller ID information and present false names and numbers. Gateways between networks that allow such spoofing and other public networks then forward that false information. Since spoofed calls can originate from other countries, the laws in the receiver's country may not apply to the caller. This limits laws' effectiveness against the use of spoofed caller ID information to further a [[scam]].<ref>{{cite web|last=Schneier|first=Bruce|title=Caller ID Spoofing |url=http://www.schneier.com/blog/archives/2006/03/caller_id_spoof.html|publisher=schneier.com|access-date=16 January 2011|date=3 March 2006}}</ref>{{Failed verification|date=August 2016|reason=Source doesn't address international calls.}}

== Satellite navigation spoofing <span class="anchor" id="GPS spoofing"></span><span class="anchor" id="GNSS spoofing"></span>==
{{excerpt|GNSS spoofing}}

== Voice spoofing ==
Information technology plays an increasingly large role in today's world, and different authentication methods are used for restricting access to informational resources, including voice biometrics. Examples of using [[speaker recognition]] systems include internet banking systems, customer identification during a call to a call center, as well as passive identification of a possible criminal using a preset "blacklist".<ref>{{Cite conference|last1=Shchemelinin|first1=Vadim|last2=Topchina|first2=Mariia|last3=Simonchik|first3=Konstantin|date=2014|editor-last=Ronzhin|editor-first=Andrey|editor2-last=Potapova|editor2-first=Rodmonga|editor3-last=Delic|editor3-first=Vlado|title=Vulnerability of Voice Verification Systems to Spoofing Attacks by TTS Voices Based on Automatically Labeled Telephone Speech|url=https://link.springer.com/chapter/10.1007/978-3-319-11581-8_59|conference=International Conference on Speech and Computer|series=Lecture Notes in Computer Science|volume=8773|language=en|location=Cham|publisher=Springer International Publishing|pages=475–481|doi=10.1007/978-3-319-11581-8_59|isbn=978-3-319-11581-8|url-access=subscription}}</ref>

Technologies related to the synthesis and modeling of speech are developing very quickly, allowing one to create voice recordings almost indistinguishable from real ones. Such services are called [[Speech synthesis|Text-to-Speech]] (TTS) or [[Neural Style Transfer|Style transfer]] services. The first one aimed at creating a new person. The second one aimed at identifies as another in voice identification systems.

A large number of scientists are busy developing algorithms that would be able to distinguish the synthesized voice of the machine from the real one. On the other hand, these algorithms need to be thoroughly tested to make sure that the system really works.<ref>{{Cite book|last1=Sinitca|first1=Aleksandr M.|last2=Efimchik|first2=Nikita V.|last3=Shalugin|first3=Evgeniy D.|last4=Toropov|first4=Vladimir A.|last5=Simonchik|first5=Konstantin|title=2020 IEEE Conference of Russian Young Researchers in Electrical and Electronic Engineering (EIConRus) |chapter=Voice Antispoofing System Vulnerabilities Research |date=January 2020|location=St. Petersburg and Moscow, Russia|publisher=IEEE|pages=505–508|doi=10.1109/EIConRus49466.2020.9039393|isbn=978-1-7281-5761-0|s2cid=214595791}}</ref> However, an early study has shown that feature design and masking augmentation have a significant impact on the ability to detect spoofed voice.<ref>{{cite journal |last1=Cohen |first1=Ariel |last2=Rimon |first2=Inbal |last3=Aflalo |first3=Eran |last4=Permuter |first4=Haim H. |title=A study on data augmentation in voice anti-spoofing |journal=Speech Communication |date=June 2022 |volume=141 |pages=56–67 |doi=10.1016/j.specom.2022.04.005|arxiv=2110.10491 |s2cid=239050551 }}</ref>

== Facial recognition spoofing ==
Facial recognition technology is widely employed in various areas, including immigration checks and phone security, as well as on popular platforms like [[Airbnb]] and [[Uber]] to verify individuals' identities. However, the increased usage has rendered the system more susceptible to attacks, given the widespread integration of facial recognition systems in society. Some online sources and tutorials detail methods for tricking facial recognition systems through practices known as face spoofing or presentation attacks, which can pose risks in terms of unauthorized access. To mitigate these dangers, measures such as [[liveness test|liveness check]]s (verifying blinking), [[deep learning]], and specialized cameras like 3D cameras have been introduced to prevent facial recognition spoofing. It is important to implement comprehensive security procedures like these to protect against face spoofing attempts and uphold the overall security and integrity of systems relying on facial recognition authentication.<ref>{{Cite book |last=Hadid |first=Abdenour |chapter=Face Biometrics Under Spoofing Attacks: Vulnerabilities, Countermeasures, Open Issues, and Research Directions |date=June 2014 |pages=113–118 |title=2014 IEEE Conference on Computer Vision and Pattern Recognition Workshops |chapter-url=http://dx.doi.org/10.1109/cvprw.2014.22 |publisher=IEEE |doi=10.1109/cvprw.2014.22|isbn=978-1-4799-4308-1 |s2cid=9540938 }}</ref>

== See also ==
* [[Domain name#Domain name spoofing|Domain name spoofing]]{{snd}}class of phishing attacks that depend on falsifying or misrepresenting an internet domain name
** {{annotated link|DNS spoofing}}
**{{anli|Email spoofing}}
** {{annotated link|IP address spoofing}}
** {{annotated link|IDN homograph attack}}, mixing letters from different alphabets to trick an unsuspecting user into trusting and clicking on a link, also known as "script spoofing".
** {{annotated link|Website spoofing}}
* {{annotated link|LAND|LAND attack}} using spoofed network packets
* {{annotated link|MAC spoofing}}
* {{annotated link|Phishing}} (most often by telephone or email).
* {{annotated link|Stream cipher attacks}}

===Standard facilities that might be subverted===
* {{annotated link|Protocol spoofing}} (in order to use another, more appropriate one).

== References ==
{{Reflist}}

{{Scams and confidence tricks}}

[[Category:Computer network security]]
[[Category:Types of cyberattacks]]