What Is Spoofing?

Date First Published: 15th June 2023

Topic: Cybersecurity

Subtopic: Threats To Individuals

Article Type: Computer Terms & Definitions

Difficulty: Medium

Difficulty Level: 5/10

CONTENTS

Types Of Spoofing
Difference Between Spoofing, Phishing, and Social Engineering

Learn about what spoofing is in this article.

Spoofing is the act of pretending to be something or someone else to deceive other users. This is accomplished by disguising the identity of one thing as something else to gain a user's trust and make them believe that the spoofed communications are legitimate in order to gain unauthorised access to systems, steal sensitive information, spread viruses and malware, bypass access controls, and steal money. Spoofing can apply to emails, phone calls, text messages, IP addresses, websites, facial recognition technology, and GPS.

Types Of Spoofing

Below are eight different types of spoofing:

Email spoofing - The act of sending emails with false sender addresses. This is accomplished by sending emails with a forged "From;" line to trick users into thinking that the email has come from a trusted company or another legitimate source. Spoofers often send their email messages from their own SMTP servers, allowing them to use fake email addresses and make it possible to receive an email message from an email address that is not the actual address of the sender.
Website spoofing - The act of creating a fake website that mimics a legitimate one to deceive other users. This may be accomplished by a cloaked URL, which redirects users to the fake website. Spoofed websites are designed to steal credentials or install malware. It is often used in combination with email spoofing.
Caller ID spoofing - This involves users forging their caller ID number so that their information looks like they are calling from a different number, often to avoid being caught making prank calls. This allows spoofers to hide their true identity from the person they are calling.
SMS spoofing - Also known as text message spoofing, SMS spoofing is the act of sending a text message with a forged phone number or sender ID. It is often accomplished by replacing the originating mobile number with alphanumeric text in order for the spoofer to hide their true identity.
DNS spoofing - Also known as DNS cache poisoning, this type of spoofing uses modified DNS records to redirect online traffic to a fake website. It is accomplished by replacing the IP addresses stored in the DNS server with the ones the attackers want to use. It is a common tactic used in pharming attacks.
ARP spoofing - This occurs when an attacker sends forged ARP messages to a LAN for linking their MAC address with the IP address of a legitimate computer or server within the network, enabling the data from the victim’s computer to be sent to the attacker’s computer. Attackers disguise their computers as network members.
GPS spoofing - This occurs when a spoofer misrepresents their physical location by forging their GPS coordinates. Spoofers are pretending to be in one location, but are actually in another.
Facial spoofing - This occurs when a spoofer takes someone's face and mimis their facial biometrics by using a photo or video to forge their identity and bypass the facial recongnition system.

The main difference between spoofing and phishing are that spoofing is more focused on impersonating the identity of legitimate and trusted sources to deceive other users. Phishing is a type of spoofing that tries to steal sensitive information. There are different types of spoofing and not all of them try to steal sensitive information. Spoofing is a wider term that refers to all the methods of disguising the identity of one thing as something else to gain a user's trust. Sometimes, attackers spoof email addresses or text messages to make their phishing messages seem more believable.

Also, spoofing is not the same thing as social engineering. Social engineering is a wider term that refers to the use of deception tactics to get a user to give away their sensitive information, like usernames, passwords, and bank details, which may be used for fraudulent purposes. It does not always involve pretending to be something or someone else. Spoofers often use a combination of the spoof itself and social engineering tactics.