What Is Spoofing? And How To Avoid An Attack …

What Is Spoofing?

Spoofing is the act of impersonation associated with cybercriminals. The imposter communication manipulates the technology into believing that the imposter communication is coming from a trusted source. In reality, it’s coming from an unknown source that could be ready to cause a malicious attack. Bad actors commonly use spoofing for identity theft, computer viruses, and denial-of-service (DOS) attacks that shut down popular websites. With the advancement of facial recognition technology, today’s modern definition now includes biometric spoofing. Facial biometric spoofing is rare for now but should be considered when considering face-based accessed control security products for your business. 

What Are Types Of Spoofing? 

1. Email Spoofing
2. Caller ID Spoofing
3. GPS Spoofing
4. Website Spoofing
5. IP Address Spoofing
6. Text Message Spoofing
7. Facial Recognition Spoofing

1) Email Spoofing

Email Spoofing happens when an attacker sends you a message that looks like it’s coming from a legitimate email address, but the spoofed email contains a bad link with an enticing call-to-action. For example; The email may offer a free $500 gift card, but it will install malware on your computer after you click the link instead. When an email is spoofed, it might entice you to hand over your personal information because your guard is down, thinking you’re dealing with a credible source. They are preying on people’s trust. Scammers design their scams to gain access to your personal information, passwords, financial information and track your website movements. 

Today’s sophisticated scammer will use social engineering and multiple spoofing methods to gain a victim’s trust. The more techniques you can recognize, the better you will become at thwarting attacks. 

2) Caller ID Spoofing

Caller ID Spoofing happens when a scammer uses technology to conceal their location and identity when they call you. Most of the time, they will make it look like the call comes from an individual or organization that you know. They’re able to manipulate the area code on your phone’s caller id, so it looks like the call is coming from your neighborhood. The hacker knows that if they can trick you into thinking the phone call is local, there is a greater chance you’ll pick up the phone. Once you do, their scam begins.

3) GPS Spoofing

You can spoof your GPS to make it look like you’ve climbed Mount Everest, trick your phone into finding rare Pokemon, or fool your Instagram followers that you’re traveling the world. Harmless right? Changing your location may seem tame to you, but the security threat is real. GPS stands for Global Positioning System, and it is used heavily in logistical supply chain management, banking networks, and power grids. It’s easy to see how dangerous it would be for a hacker to access any of these systems.

4) Website Spoofing

Website Spoofing is when bad actors create look-alike websites to fool visitors. These look-alike URLs are usually sent through email and mimick the domain names of websites you often use, like your bank, favorite online retailer, or social media platform. A spoofed website will have a familiar-looking login page, but the scammers are the ones receiving your information. After the hacker gets your information, they can access the actual website, change your password, make purchases or access your contact lists. 

5) IP Address Spoofing

IP Address Spoofing is a severe threat to a company’s network traffic and critical data. Hackers will mask their location by spoofing their IP address while sending or requesting large amounts of requests to a website all at once. This is called a denial-of-service attack (DDOS) and is mainly used to shut down websites by overwhelming the servers. Hackers will sometimes modify their IP Address to look like it’s coming from a trusted source or computer on the shared network, making the hacker harder to find or shut down.

6) Text Message Spoofing

Text Message Spoofing is on the rise and has a new name. SMS phishing or Smishing is similar to Caller ID and Email Spoofing; the scammer wants you to believe the text message is coming from a legitimate person or business. Once you click the link in the text message, the scam begins by downloading a trojan horse or malware onto your device. They could also gain access to your contact list. Make sure you have strong mobile security on all of your devices. 

7) Facial Recognition Spoofing

Facial Recognition Spoofing is relatively rare, but as the demand for this technology grows and more companies add facial biometric access control readers to their physical security systems, facial spoofing concerns will continue to grow. For now, imposters are using photographs and video stills found on social media to imitate individuals and create fake access. Sometimes they may even attempt to use a 3D printed mask. With facial recognition systems that use image databases, the risk of false positives due to people with similar facial features is there. 

None of these spoofing attempts will work with the StoneLock GO. A photograph, video still, or 3D mask all reflect infrared light in a much different way than an actual person does, so when these items are presented at the sensor, they will fail to be recognized.  

It should be known that to this date, the StoneLock GO facial biometric reader has not had a single instance of Facial Recognition Spoofing. The StoneLock GO uses the most secure pathways available and never uses photographs or video stills to authenticate. 

Want to know more about spoofing and facial biometrics? Sign up for a demo of the StoneLock GO biometric reader here.

Spoofing Vs. Phishing? 

Spoofing and Phishing are two sides of the same coin. Spoofing is when one thing attempts to imitate something else, and Phishing is when someone steals your sensitive information. When you download malicious software on your phone or computer, it’s Spoofing. When a scammer uses social engineering to obtain your password or banking details, it’s Phishing.

How To Protect Against Spoofing Attacks?

• Knowing the types of spoofing attacks is the first step in protecting yourself from scammers, hackers, and cybercriminals. Here are some more;
• Watch for poor grammar and bad spelling.
• Pay very close attention to the actual sender address in the emails you receive.
• Download a reputable free antivirus and malware app. 
• Security awareness goes a long way. Pay attention to the latest scams and other suspicious activity happening in your home-town. 
• Make sure your company network and website us using the most up-to-date DDOS protection software. 
• If you fall victim to a Spoofing or Phishing scheme, contact your local Consumer Complaint Center for assistance.
• Avoid clicking on unfamiliar links or downloading attachments.
• Turn on spam filters. 
• Always use two-factor authentication for logging into all of your accounts. 
• Consider using a password safe to generate and store all of your passwords.
• Watch that the websites you are visiting have active SSL certificates.
• Limit the personal information you give out online. 

Sign up for a demo of the StoneLock GO biometric access control reader here.