Web Spoofing

1
Web Spoofing

• John D. Cook
• Andrew Linn

2
Web huh?

• Spoof A hoax, trick, or deception
• Discussed among academics in the 1980s as the
  concept of IP spoofing
• IP Spoofing was used in a few early and well
  known attacks
• IP Spoofing fell out of popularity (TCP)
• Still done today in different forms.
• Not all web spoofs are malicious

3
Phishing

• Pronounced fishing, just much less fun
• Broad term to describe attempted acquisition of
  private or sensitive information
• Passive or aggressive attack.
• Not all phishing attacks are web spoofs
• Nature of web spoofs make them a good choice
  however.
• An example of the many uses of web spoofs

4
Phishing Spoof Attacks

• Fairly common They are easy and WORK!!
• Man in the middle attack
• Rewrites the URLs of a page
• http//www.cnn.com ?
• http//www.IAmAttacker.com/http//www.cnn.com
• Users can get trapped in the attackers system

5
Email Hoaxes

• Often a phishing attack as well as a type of
  spoof
• Rely on carelessness or ignorance of the user
• Appear to be from legitimate service
• Login IDs, Passwords, Credit Card Numbers, and SS
  numbers are the booty

6
Email Hoaxes Cont.

• Some serve as a way to implement a web page spoof
  that in itself is a phishing attack.
• FSU Phishing Email Hoax
• WoW Email Hoax
• I love FireFox
• The purpose of the hoax

7
Spoofs Today

• Because everything else was totally last month.
• Video games are in. So is stealing them.
• The downside of all info stored server-side.
• Online shopping stolen credit cards. Yes,
  because us Americans just dont go to the store
  anymore.

8
Recognizing Spoofs

• Look for the lock at the bottom of your browser.
  Though this isnt always indicative of a safe
  website
• Use a good browser. My ambiguity in that
  statement allows me to not be biased.
• Check certificates of the page
• Or just pay attention.

9
The Shadow Web

• Known as Web spoofing
• First examined by Princeton researchers in 1996
• Tested in 2002 by researchers at Dartmouth
• Traps the user in attackers web
• Uses JavaScript to rewrite browser
• Effectively spoofs the entire Web

10
(No Transcript)
11
Sample fake tool bar pop-up
Sample true tool bar pop-up
Courtesy of Dartmouth College
12
Fake SSL warning window
True SSL warning window
Courtesy of Dartmouth College
13
The Shadow Web

• While plausible, it is unlikely
• High yield Huge effort
• Various browsers, customization, and security
  software options prevent it from being a viable
  attack
• Acts as a Man-in-the-Middle attack

14
Shadow Web Demonstration
Courtesy of Felton et al Princeton University
15
The Shadow Web Attacks

• Simple surveillance -gt Phishing attacks
• Data manipulation -gt Man-in-the-Middle

16
The Shadow Web Detection

• Disable JavaScript
• Customize
• Pop-up and spam blockers
• Firewalls and other security software

17
Computer Security Dilemma

• Most spoof attacks are user initiated
• Hard to prevent from computer security side
• Security software falls short of user ignorance
• Broad audience uninformed

18
Detection and Prevention

• Understand what will and will not be requested in
  an email
• Do not follow email links to edit account
  information. Instead, type the websites URL
  address into the browser
• Verify a URL before clicking on a link
• Check the SSL certificate of a website before
  disclosing personal information

19
Sample Email Spoof
20
Sample Email Spoof
21
Motivations

• Most spoof attacks are phishing attacks
• Some serve to smear a companys reputation or
  hurt their finances with false reports
• Others for fun or political goals
• All spoofs, even those that are jokes, have the
  potential for harm

22
Brick and Mortar

• Virtual world vs. physical
• Harder to verify Amazon.com than brick and mortar
  store
• Security software helps, but educated user base
  best defense against spoof attack

23
Criminal Act

• Identity theft is a growing concern
• Spoofing is used in many phishing scams to
  facilitate identity theft
• Most attackers use stolen or hacked machines
• When caught, attackers must be punished
  appropriately

24
Questions?