1 / 25

Spoofing

Spoofing. Rafael Sabino 10/28/2004. Introduction. What is spoofing? Context and Security relevant decisions Phishing Web spoofing Remedies. What is Spoofing?. Dictionary.com definitions: To deceive A hoax. Security Relevant Decisions. Decisions that can lead to undesirable results

Pat_Xavi
Download Presentation

Spoofing

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Spoofing Rafael Sabino 10/28/2004

  2. Introduction • What is spoofing? • Context and Security relevant decisions • Phishing • Web spoofing • Remedies

  3. What is Spoofing? • Dictionary.com definitions: • To deceive • A hoax

  4. Security Relevant Decisions • Decisions that can lead to undesirable results • Examples • Accepting data as being true and accurate

  5. Context • The browser, text, and pictures • Names of objects • Timing of events

  6. Context Spoofing (Examples) • http://www.antiphishing.org/phishing_archive.html

  7. Spoofed emails have upwards of 20% success rates Costs billions of dollars to the industry Brand names attacked: Bestbuy Microsoft MSN FBI Context Spoofing • Citigroup • Wachovia • Bank of America • Yahoo! • Ebay • Paypal

  8. Consequences • Unauthorized Surveillance • Tampering • Identity theft

  9. What is Web Spoofing? • Creating a shadow copy of the world wide web • Shadow copy is funneled through attackers machine • Data tampering

  10. Web Spoofing Attack • The physical world can also be spoofed • Security relevant decisions and context

  11. How does the Attack Work? • Step : 1 Rewriting the URL: • Example: • home.netscape.com • www.attacker.com/http://home.netscape.com

  12. How does the Attack Work? www.attacker.org 1. Request Spoof URL 4. Change page 5. Spoofed page 2. Request real URL 3. Real Page contents www.server.com

  13. How does the Attack Work? • Once attacker server obtains the real URL, it modifies all links • Rewritten page is provided to victim’s browser • This funnels all information • Is it possible to spoof the whole web?

  14. Forms • Submitted data goes to the attackers server • Allows for tampering • Attacker can also modify returned data

  15. “Secure” Connections • Everything will work the same • Secure connection indicator will be turned on • Secure connection is with attacker’s server • “Secure” connections are a false sense of security

  16. Starting the Attack • Put links in popular places • Emails • Search Engines

  17. Completing the Illusion • There are cues that can destroy the illusion: • Status line • Location line • Viewing document source • These can be virtually eliminated

  18. Status Line • Displays URL links points to • Displays name of server being contacted • JavaScript is the solution

  19. Location Line • Displays URL of current page • User can type in any URL • JavaScript is the solution

  20. Viewing Document Source • Menu bar allows user to see pages’ source • JavaScript can be used to create a fake menu bar

  21. Tracing the Attacker • Is possible if attacker uses his/her own machine • Stolen computers are used to launch attacks • Hacked computers are used as well

  22. What can we do? • Short term solution: • JavaScript • Location line is visible • Pay attention to location line • Be selective with your features

  23. What can we do? • Do not reply to or click on a link that will lead you to a webpage asking you for info. • Look for the presence of a padlock and https://. Both most be present for a connection to be secure • Keep up with updates

  24. What can we do? • Check your bank / credit card statements • To report suspicious activity, send email to Federal Trade Commision: uce@ftc.gov • If you are a victim, file a complaint at www.ftc.gov

  25. Resources • www.antiphishing.com • http://www.cs.princeton.edu/sip/pub/spoofing.html • Gary McGraw and Edward W. Felten. Java Security: Hostile Applets, Holes and Antidotes. John Wiley and Sons, New York, 1996.

More Related