1. Spoofing Rafael Sabino 10/28/2004

2. Introduction What is spoofing? Context and Security relevant decisions Phishing Web spoofing Remedies

3. What is Spoofing? Dictionary.com definitions: –To deceive –A hoax

4. Security Relevant Decisions Decisions that can lead to undesirable results Examples Accepting data as being true and accurate

5. Context The browser, text, and pictures Names of objects Timing of events

6. Context Spoofing (Examples) http://www.antiphishing.org/p hishing_archive.htmlhttp://www.antiphishing.org/p hishing_archive.html

7. Context Spoofing Spoofed emails have upwards of 20% success rates Costs billions of dollars to the industry Brand names attacked: 7. Bestbuy 8. Microsoft MSN 9. FBI 1.Citigroup 2.Wachovia 3.Bank of America 4.Yahoo! 5.Ebay 6.Paypal

8. Consequences Unauthorized Surveillance Tampering Identity theft

9. What is Web Spoofing? Creating a shadow copy of the world wide web Shadow copy is funneled through attackers machine Data tampering

10. Web Spoofing Attack The physical world can also be spoofed Security relevant decisions and context

11. How does the Attack Work? Step : 1 Rewriting the URL: Example: –home.netscape.comhome.netscape.com –www.attacker.com/http://home.netscape.com

12. How does the Attack Work? 1. Request Spoof URL www.attacker.org www.server.com 2. Request real URL 3. Real Page contents 4. Change page 5. Spoofed page

13. How does the Attack Work? Once attacker server obtains the real URL, it modifies all links Rewritten page is provided to victim’s browser This funnels all information Is it possible to spoof the whole web?

14. Forms Submitted data goes to the attackers server Allows for tampering Attacker can also modify returned data

15. “Secure” Connections Everything will work the same Secure connection indicator will be turned on Secure connection is with attacker’s server “Secure” connections are a false sense of security

16. Starting the Attack Put links in popular places Emails Search Engines

17. Completing the Illusion There are cues that can destroy the illusion: –Status line –Location line –Viewing document source These can be virtually eliminated

18. Status Line Displays URL links points to Displays name of server being contacted JavaScript is the solution

19. Location Line Displays URL of current page User can type in any URL JavaScript is the solution

20. Viewing Document Source Menu bar allows user to see pages’ source JavaScript can be used to create a fake menu bar

21. Tracing the Attacker Is possible if attacker uses his/her own machine Stolen computers are used to launch attacks Hacked computers are used as well

22. What can we do? Short term solution: –JavaScript –Location line is visible –Pay attention to location line Be selective with your features

23. What can we do? Do not reply to or click on a link that will lead you to a webpage asking you for info. Look for the presence of a padlock and https://. Both most be present for a connection to be secure Keep up with updates

24. What can we do? Check your bank / credit card statements To report suspicious activity, send email to Federal Trade Commision: uce@ftc.govuce@ftc.gov If you are a victim, file a complaint at www.ftc.govwww.ftc.gov

25. Resources www.antiphishing.com http://www.cs.princeton.edu/s ip/pub/spoofing.htmlhttp://www.cs.princeton.edu/s ip/pub/spoofing.html Gary McGraw and Edward W. Felten. Java Security: Hostile Applets, Holes and Antidotes. John Wiley and Sons, New York, 1996.