Spoofed URL

Last updated

A spoofed URL involves one website masquerading as another, often leveraging vulnerabilities in web browser technology to facilitate a malicious computer attack. These attacks are particularly effective against computers that lack up-to- security patches. Alternatively, some spoofed URLs are crafted for satirical purposes.

Contents

In such an attack scenario, an unsuspecting computer user visits a website and observes a familiar URL, like http://www.wikipedia.org, in the address bar. However, unbeknownst to them, the information they input is being directed to a completely different location, usually monitored by an information thief. When a fraudulent website requests sensitive information, it's referred to as phishing.

These fraudulent websites often entice users through emails or hyperlinks.

In a different variation, a website might resemble the original but is, in reality, a parody. These instances are generally harmless and conspicuously distinct from the genuine sites, as they typically do not exploit web browser vulnerabilities.

Another avenue for these exploits involves redirects within a hosts file, rerouting traffic from legitimate sites to an alternate IP associated with the spoofed URL. [1]

Cyber security

Spoofing is the act of deception or hoaxing. [2] URLs are the address of a resource (as a document or website) on the Internet that consists of a communications protocol followed by the name or address of a computer on the network and that often includes additional locating information (as directory and file names). [3] Simply, a spoofed URL is a web address that illuminates an immense amount of deception through its ability to appear as an original site, despite it not being one. In order to prevent falling victim to the prevalent scams stemmed from the spoofed URLs, major software companies have come forward and advised techniques to detect and prevent spoofed URLs.

SSL handshake with two way authentication with certificates Ssl handshake with two way authentication with certificates.png
SSL handshake with two way authentication with certificates

Detection

In order to prevent criminals from accessing personal information, such as credit card information, bank account/routing numbers, and one’s telephone number, home address, etc. it is important to learn and understand how these spoof URLs can be detected. It is very important to first verify the name of the site on a digital certification through the use of SSL/TLS. Always try to identify the actual URL for the web page you are on. Make sure you are able to see the full URL for any hyperlink, so that you can examine the address. Some characters that are commonly found in spoofed URLs are: %00, %01, @. Sometimes the URLs can differ by a single letter or number. In general, only input personal information on a Website if the name has been verified on the digital certificate. Also, if you have any concern about the confidentiality of a website leave the page immediately. [4]

Prevention

Spoofed URLs, a universal defining identity for phishing scams, pose a serious threat to end-users and commercial institutions. Email continues to be the favorite vehicle to perpetrate such scams mainly due to its widespread use combined with the ability to easily spoof them. [5] Several approaches, both generic and specialized, have been proposed to address this problem. However, phishing techniques, growing in ingenuity as well as sophistication, render these solutions weak. In order to prevent users from future victimization stemmed from a spoofed URL, Internet vigilantes have published numerous tips to help users identify a spoof.

Firefox phishing alert Firefox phishing alert.jpg
Firefox phishing alert

The most common are: using authentication based on key exchange between the machines on your network, using an access control list to deny private IP addresses on your downstream interface, implementing filters of both inbound and outbound traffic, configuring routers and switches if they support such configuration, to reject packets originating from outside the local network that claim to originate from within, and enable encryption sessions in the router so that trusted hosts that are outside your network can securely communicate with your local hosts. [6] Ultimately, protection comes from the individual user. Keeping up with new spoofing techniques or scams will readily allow one to identify a scam and most importantly keep information secure and personal.

Spoofed URL contributing to PayPal phishing scam Paypal Phishing Scam Example.png
Spoofed URL contributing to PayPal phishing scam

Susceptible targets

PayPal, an e-commerce business allows money transactions to be made through the Internet and is a common target for spoofed URLs. This forgery of a legitimate PayPal website allows hackers to gain personal and financial information and thus, steal money through fraud. Along with spoof or fake emails that appear with generic greetings, misspellings, and a false sense of urgency, spoofed URLs are an easy way for hackers to violate one’s PayPal privacy. For example, www.paypalsecure.com, includes the name, but is a spoofed URL designed to deceive. Remember to always log into PayPal through a new window browser and never log in through email. In the case that you do receive a suspected spoofed URL, forward the entire email to spoof@PayPal.com to help prevent the URL from tricking other PayPal users. [7]

Common crimes

A major crime associated with spoofed URLs is identity theft. The thief will create a website very similar in appearance to that of a popular site, then when a user accesses the spoofed URL, they can inadvertently give the thief their credit card and personal details. Their spoofed URLs might use “too good to be true” prices to lure more and more looking for a good deal. Crimes like these happen quite often, and most frequently during the festive holidays and other heavy online shopping periods of the year. [8]

Another crime associated with spoofed URLs is setting up a fake anti-malware software. An example of this would be Ransomware, fake anti-malware software that locks up important files for the computer to run, and forces the user to pay a ransom to get the files back. If the user refuses to pay after a certain period of time, the Ransomware will delete the files from the computer, essentially making the computer unusable. Ads for these programs usually appear on popular websites, such as dating sites or social media sites like Facebook and Twitter. They can also come in the form of attachments to emails. Phishing scams are also another major way that users can get tricked into scams (see below).

Phishing

Phishing is a scam by which an e-mail user is duped into revealing personal or confidential information which the scammer can use illicitly. [9] Phishing is the action of fraudsters sending an email to an individual, hoping to seek private information used for identity theft, by falsely asserting to be a reputable legal business. Phishing is performed through emails containing a spoofed URL, which links them to a website. Since it usually appears in the form on an email, it is crucial to not rely just on the address in the “from” field in order to prevent phishing. Computer users should also look out for spelling mistakes within the website's URLs, as this is another common sign to look out for in a phishing email. [10] The website whose URLs are in the e-mails requests individuals to enter personal information so businesses can update it in their system. This information often includes passwords, credit card numbers, social security, and bank account numbers. In turn, the email recipients are giving these fake businesses their information the real businesses already have.

See also

Related Research Articles

<span class="mw-page-title-main">Domain name</span> Identification string in the Internet

In the Internet, a domain name is a string that identifies a realm of administrative autonomy, authority or control. Domain names are often used to identify services provided through the Internet, such as websites, email services and more. As of 2017, 330.6 million domain names had been registered. Domain names are used in various networking contexts and for application-specific naming and addressing purposes. In general, a domain name identifies a network domain or an Internet Protocol (IP) resource, such as a personal computer used to access the Internet, or a server computer.

Various anti-spam techniques are used to prevent email spam.

<span class="mw-page-title-main">Phishing</span> Form of social engineering

Phishing is a form of social engineering and scam where attackers deceive people into revealing sensitive information or installing malware such as ransomware. Phishing attacks have become increasingly sophisticated and often transparently mirror the site being targeted, allowing the attacker to observe everything while the victim is navigating the site, and transverse any additional security boundaries with the victim. As of 2020, it is the most common type of cybercrime, with the FBI's Internet Crime Complaint Center reporting more incidents of phishing than any other type of computer crime.

<span class="mw-page-title-main">Email spam</span> Unsolicited electronic advertising by email

Email spam, also referred to as junk email, spam mail, or simply spam, is unsolicited messages sent in bulk by email (spamming). The name comes from a Monty Python sketch in which the name of the canned pork product Spam is ubiquitous, unavoidable, and repetitive. Email spam has steadily grown since the early 1990s, and by 2014 was estimated to account for around 90% of total email traffic.

In the context of information security, and especially network security, a spoofing attack is a situation in which a person or program successfully identifies as another by falsifying data, to gain an illegitimate advantage.

A Joe job is a spamming technique that sends out unsolicited e-mails using spoofed sender data. Early Joe jobs aimed at tarnishing the reputation of the apparent sender or inducing the recipients to take action against them, but they are now typically used by commercial spammers to conceal the true origin of their messages and to trick recipients into opening emails apparently coming from a trusted source.

Email fraud is intentional deception for either personal gain or to damage another individual using email as the vehicle. Almost as soon as email became widely used, it began to be used as a means to defraud people, just as telephony and paper mail were used by previous generations.

Anti-phishing software consists of computer programs that attempt to identify phishing content contained in websites, e-mail, or other forms used to accessing data and block the content, usually with a warning to the user. It is often integrated with web browsers and email clients as a toolbar that displays the real domain name for the website the viewer is visiting, in an attempt to prevent fraudulent websites from masquerading as other legitimate websites.

Pharming is a cyberattack intended to redirect a website's traffic to another, fake site by installing a malicious program on the computer. Pharming can be conducted either by changing the hosts file on a victim's computer or by exploitation of a vulnerability in DNS server software. DNS servers are computers responsible for resolving Internet names into their real IP addresses. Compromised DNS servers are sometimes referred to as "poisoned". Pharming requires unprotected access to target a computer, such as altering a customer's home computer, rather than a corporate business server.

The internationalized domain name (IDN) homograph attack is a way a malicious party may deceive computer users about what remote system they are communicating with, by exploiting the fact that many different characters look alike

Email spoofing is the creation of email messages with a forged sender address. The term applies to email purporting to be from an address which is not actually the sender's; mail sent in reply to that address may bounce or be delivered to an unrelated party whose identity has been faked. Disposable email address or "masked" email is a different topic, providing a masked email address that is not the user's normal address, which is not disclosed, but forwards mail sent to it to the user's real address.

Paypai is a phishing scam, which targets account holders of the widely used internet payment service, PayPal, taking advantage of the fact that a capital "i" may be difficult to distinguish from a lower-case "L" in some computer fonts. This is a form of a homograph attack.

Voice phishing, or vishing, is the use of telephony to conduct phishing attacks.

Website spoofing is the act of creating a website with the intention of misleading readers that the website has been created by a different person or organization. Normally, the spoof website will adopt the design of the target website, and it sometimes has a similar URL. A more sophisticated attack results in an attacker creating a "shadow copy" of the World Wide Web by having all of the victim's traffic go through the attacker's machine, causing the attacker to obtain the victim's sensitive information.

Internet fraud prevention is the act of stopping various types of internet fraud. Due to the many different ways of committing fraud over the Internet, such as stolen credit cards, identity theft, phishing, and chargebacks, users of the Internet, including online merchants, financial institutions and consumers who make online purchases, must make sure to avoid or minimize the risk of falling prey to such scams.

<span class="mw-page-title-main">Credit card fraud</span> Financial crime

Credit card fraud is an inclusive term for fraud committed using a payment card, such as a credit card or debit card. The purpose may be to obtain goods or services or to make payment to another account, which is controlled by a criminal. The Payment Card Industry Data Security Standard is the data security standard created to help financial institutions process card payments securely and reduce card fraud.

<span class="mw-page-title-main">Malvertising</span> Use of online advertisement or advertising to spread malware

Malvertising is the use of online advertising to spread malware. It typically involves injecting malicious or malware-laden advertisements into legitimate online advertising networks and webpages. Because advertising content can be inserted into high-profile and reputable websites, malvertising provides malefactors an opportunity to push their attacks to web users who might not otherwise see the ads, due to firewalls, more safety precautions, or the like. Malvertising is "attractive to attackers because they 'can be easily spread across a large number of legitimate websites without directly compromising those websites'."

SmartScreen is a cloud-based anti-phishing and anti-malware component included in several Microsoft products, including operating systems Windows 8 and later, the applications Internet Explorer, Microsoft Edge. SmartScreen intelligence is also used in the backend of Microsoft's online services such as the web app Outlook.com and Microsoft Bing search engine.

Social hacking describes the act of attempting to manipulate outcomes of social behaviour through orchestrated actions. The general function of social hacking is to gain access to restricted information or to a physical space without proper permission. Most often, social hacking attacks are achieved by impersonating an individual or group who is directly or indirectly known to the victims or by representing an individual or group in a position of authority. This is done through pre-meditated research and planning to gain victims’ confidence. Social hackers take great measures to present overtones of familiarity and trustworthiness to elicit confidential or personal information. Social hacking is most commonly associated as a component of “social engineering”.

<span class="mw-page-title-main">Google Docs</span> Cloud-based word processing software

Google Docs is an online word processor included as part of the free, web-based Google Docs Editors suite offered by Google, which also includes Google Sheets, Google Slides, Google Drawings, Google Forms, Google Sites and Google Keep. Google Docs is accessible via an internet browser as a web-based application and is also available as a mobile app on Android and iOS and as a desktop application on Google's ChromeOS.

References

  1. Pandagle, Vishwa (2022-10-15). "Cybersecurity Awareness Month: Simple Tips to Identify and Prevent Phishing Scams". The Cyber Express.
  2. "Spoof". Merriam-Webster . Retrieved March 7, 2014.
  3. "URL". Merriam-Webster. Retrieved March 7, 2014.
  4. "Steps that you can take to help identify and to help protect yourself from deceptive (spoofed) websites and malicious hyperlinks". Microsoft support. October 13, 2020. Retrieved December 28, 2020.
  5. Madhusudhanan Chandrasekaran; Ramkumar Chinchani; Shambhu Upadhyaya (2006). "Phoney: Mimicking User Response to Detect Phishing Attacks". 2006 International Symposium on a World of Wireless, Mobile and Multimedia Networks(WoWMoM'06). pp. 1–5. doi:10.1109/WOWMOM.2006.87. ISBN   0-7695-2593-8. S2CID   15308925.
  6. Jonathan Hassel (June 8, 2006). "The top five ways to prevent IP spoofing". Computerworld. Archived from the original on March 17, 2014. Retrieved March 9, 2014.
  7. "How to spot fake, fraudulent, spoof, or phishing emails". PayPal . Retrieved March 19, 2014.
  8. "New E-Scams & Warnings". Federal Bureau of Investigation . Retrieved March 18, 2014.
  9. "Phishing". Merriam-Webster. Retrieved March 19, 2014.
  10. "Phishing and Spoofing – Your Guide to Protect Against Them". Adweb Technologies Pvt Ltd. June 27, 2017. Retrieved December 28, 2020.