Spoofing

What is spoofing?

Spoofing is when a bad actor disguises themselves as a trusted device or user in order to gain access into a network. Attackers often target Internet Protocol (IP) addresses, Address Resolution Protocols (ARPs), and Domain Name Systems (DNS), attempting to take advantage of an application’s inability to distinguish between legitimate and corrupted inputs. When attackers bypass these controls and gain entry, they can steal sensitive data, insert malware, or crash the entire system.

Different types of spoofing attacks

There are many types of spoofing attacks associated with communications. Attackers can spoof emails, phone calls, and even text messages, disguising themselves as a trusted entity. Spoofing application attacks are classified by their target; the most common among applications include the following.

IP address spoofing attack

An IP address spoofing attack is often used to bypass trust-based networks and systems. IP addresses or IP packets are employed to identify users, connecting them to networks or hosts. When attackers tamper with IP packets, they can choose whether to hide their identity or impersonate a trusted network—gaining immediate access. Attackers most commonly spoof multiple IP addresses to launch a distributed denial-of-service (DDoS) attack. In this type of application attack, bad actors send an overwhelming amount of traffic into one system, overloading it to the point of destruction. Attackers can either flood the selected target with multiple spoofed IP packets or select one IP address and send it to multiple locations at one time.

ARP spoofing attack

ARPs are a critical piece of communications between applications. They link together IP addresses with their corresponding MAC addresses and save them in an ARP cache. When an ARP is spoofed and a link is made with its corresponding MAC address, attackers intercept all of the data intended for the target’s IP address. ARP spoofing attacks are mostly after data in transit, as data makes its way from one application to another. Because traffic is redirected and attackers intercept all incoming data, they can facilitate other more serious attacks with ease, including man-in-the-middle (MITM) attacks. In this type of attack, bad actors sit silently in the middle of all communications between two parties, observing all information and data shared in real time. This can include personally identifiable information (PII), login credentials for multiple applications, and even financial details.  

DNS server spoofing attack

The DNS server is responsible for translations of domain names into IP addresses, giving browsers detailed instructions on what to load. When attackers spoof the DNS server, they corrupt interactions between a specific domain name and an IP address. In doing so, they reroute all traffic to an IP address linked to a server of their choosing. Commonly associated with DNS server spoofing attacks are computer worms and viruses, as attackers can corrupt servers and add malicious content and files once they have control. Infecting one system can create a downfall of any system or IP address that it associates with, infecting several systems and crashing them one by one.

How does spoofing target application vulnerabilities?

Spoofing works by tricking systems into approving access and authorizations. It is a more sophisticated attack than just taking guesses (e.g., brute-force attacks), requiring knowledge of the target they would like to spoof and some social engineering. Attackers rely on application vulnerabilities to launch spoofing attacks, exploiting a systems management of protocols or weak security configurations.

Exploiting application vulnerabilities with protocols  

IP addresses are used for authentications and lack any form of security. They are passed from one place to another in the form of an IP packet, including a header made up of the IP address among other things. The header can be altered, tricking computers into accepting it and approving authentication. This is a direct result of a lack of security measures within application communications. When attackers use social engineering to create a corrupted IP packet accepted by a network, they can cause damage to the application, inserting malicious code, stealing sensitive data, or overloading the system with traffic.

Exploiting trust relationships

Trust relationships between applications and networks are built based on previously accepted authentications. Without these trust relationships, applications lose their fast-paced reputations, leaving users to log in for each visit. Once a user passes an IP address that is accepted by an application, they create a trust relationship recognized by their ARP/MAC match. Attackers take advantage of these trust relationships, knowing that gaining access only once can provide them with open entry into the application. This leaves room for attacks such as SQL injection, where attackers can inject malicious code that executes requests in their favor. This could be transferring funds from one account to another, changing user credentials, or intercepting sensitive data.

Lack of continuous security

Applications are in constant communication with one another, passing data across networks at warp speeds. Because these channels of communication are a common target for spoofing attacks, constant monitoring of communication between them is needed. However, legacy application security measures cannot constantly monitor interactions and application behaviors, mostly testing before applications go into production. Penetration testing and vulnerability scanning are common practices for application security testing (AST), but they are not able to provide the continuous monitoring needed to prevent spoofing attacks.

Penetration tests take time to develop and test, backing up release dates while security teams analyze results. Vulnerability scanning does provide a deeper look into an application’s defenses by using two methods: static application security testing (SAST) and dynamic application security testing (DAST). SAST takes a look at the application code line by line, creating an alert for each vulnerability triggered. DAST, on the other hand, tests an application's defenses from the outside in its running state. Issues with legacy application scanning come when security teams are left to diagnose and triage results, having to sift through triggered alerts and decide which vulnerabilities deserve attention. They also run into the issue of missed alerts (false negatives), most common in DAST scanning. The time and expertise needed to analyze these findings pushes back release cycles and halts overall production, creating an issue for today’s fast and scalable development environment.

How to stop spoofing attacks

Spoofing attacks take on many different forms, making it complicated to combat them. The specifics for the prevention of each type of attack depend on the application vulnerability targeted and the method of exploitation used. It is even more complicated with applications in constant communication. Stopping spoofing attacks altogether takes an evolved approach to application security that is both accurate and continuous.

Leveraging security instrumentation

The last thing that cybersecurity teams have time for is doubt when patching vulnerabilities. That is why organizations are turning to security instrumentation. The starting point is to ensure application vulnerabilities are resolved early in the software development life cycle (SDLC). Organizations that allow security debt to accumulate in development are much more likely to have vulnerabilities slip into production. Further, the longer an organization waits to address vulnerabilities, the more time and cost that is incurred to fix them.

Security instrumentation is a paradigm change for application security. Rather that an outside-in approach, it embeds telemetry within software—from development to production—that delivers continuous, accurate monitoring of software for vulnerabilities by examining application routes exercised. It also provides developers with the location and line-of-code context for the vulnerability, enabling them to shave significant time from remediation cycles. And because security instrumentation shifts application security left and integrates directly into IDE tools and the continuous integration/continuous deployment (CI/CD) pipeline, developers are able to fix vulnerabilities as they write code.

Security instrumentation also extends into production using runtime application self-protection (RASP), which eliminates false-positive noise resulting from web application firewall (WAF) solutions and the need for security operations (SecOps) teams to expend valuable time and resources triaging and diagnosing false positives.