What is Spoofing?
From an information security standpoint, spoofing is when a cybercriminal disguises a phone call, website, email, etc…, for malicious purposes. This person or program successfully falsifies data to misrepresent themselves for their own advantage. Spoofing can be used as a means to gain entry to the target’s personal information or to bypass network access controls. A successful attack can destroy an organization’s security, its reputation as well as potentially cause an excessive loss of revenue.
Types of Spoofing
Website Spoofing- This is when a fake website is designed by a cybercriminal to impersonate an existing, trusted site the user intended to access. Attackers will use these sites to acquire login credentials or any other personal information the website provides. They may use a web address similar to the real site, but usually there will be a slight discrepancy in spelling by a letter or two. These websites also may request excessive amounts of information. Many times a spoofed website URL will be provided within a phishing email.
Email Spoofing- Similar to website spoofing, a scammer will create an email address similar to an existing company email and will send emails with fake messaging to gain access to your information and data. For example, the fake email address may be Customer.support@Netfliix.com. They hope the users will overlook the slight misspelling of “Netflix” and log on to the link provided. Scammers also may even pose as a coworker, family member, or friend to gain information.
Caller ID Spoofing- Caller ID spoofing occurs when a caller manipulates their calling number to appear to be coming from a more trusted source. Scammers can easily purchase technology that lets them change their Caller ID’s. The callee then sees the caller ID which appears as if it’s from a reputable business and is more inclined to answer it. Often, the perpetrator will pose as someone from a bank or customer support to deceive their target into providing sensitive information like account information, passwords, credit card information, or even their social security number. A form of caller ID spoofing is called “Neighbor Spoofing”, which is when an attacker manipulates their phone number to match the first few digits of their target. If a call looks like it’s from a local number, the intended target may be more likely to answer it.
IP Spoofing- IP Spoofing can occur when an attacker disguises their computer IP address to either hide the identity of the real sender or to impersonate another computing system. One reason scammers do this is to gain access to networks that verify users based on IP addresses. Oftentimes attackers will use this spoofing method in denial-of-service attacks, in which the goal is to overwhelm the target with traffic. This will make a machine or network inaccessible to its intended users or shut it down completely. Denial-of-service attacks cost organizations time and resources, while also rendering their services inaccessible – all of which can contribute to a great loss of revenue.
How to Detect Spoofing Attacks
- Scammer’s hope the targets won’t do their due diligence and will overlook slight discrepancies like misspellings of URL’s and email addresses. They may use a symbol in names or addresses that the company does not use.
- Be aware of a website, caller, or email that is requesting an unusual amount of information.
- If you’re unsure about a possible spoofed email, forward it to your IT department for further review. Do not respond to the email and do not click on any links within it.
- For phone calls, avoid answering unknown or unanticipated calls. If you do answer such calls, be suspicious if they are asking for any personal information (i.e. User ID’s, Passwords, Social Security Number, DOB, etc.). You can also hang up and call a number back if you’re unsure if it’s legitimate. It’s always better to err on the side of caution in such cases.
- Implement an employee training regime. Informed and alert employees are your best defense against spoofing attempts.
It’s important to stay informed of all of the tactics that hackers may use to try and gain access to your sensitive data and information. Make sure to verify any source before providing any important personal information. There are many options to safeguard against cyber attackers. If you have any questions or concerns regarding cybersecurity, please contact us today. We’ve helped many companies stay safe and secure in these difficult times. We can do the same for you and your firm as well.
