What is a “spoofing” attack: how to detect and how to protect yourself

Qwhen you talk about computer attacks or cyberattacks there is a great diversity of methods used by hackers depending on what the intention is. Many of these attacks take some form of social engineering and may adopt names such as “phishing” or “vishing” in order to gain access to victims’ data.

Another term that often arises with regard to these terms is the “spoofing” a kind of attack that is even harder to detect once. It turns out that an attack known as “spoofing” leads scammers to impersonate someone (or something) the victim relies on with the aim of gaining access to systems, stealing data, money or even spreading malicious software.

The Kaspersky cybersecurity company explains that, in “spoofing” attacks, those responsible “psychologically manipulate victims, exploiting human vulnerabilities such as fear, greed or lack of technical knowledge”.

Moreover, Kaspersky tells that a “spoofing” attack is usually initiated with the sending of an email that seems to have been sent by a co-worker or superior where the victim is asked to transfer some money, always associating some verisimil justification. Instead of e-mails, those responsible may also use phone calls and fake websites, sometimes involving IP addresses.

In the event of an attack by “spoofing” via email, you may be able to identify that you are at risk by consulting the metadata in the header of the email sent and that they provide you with information about how the email was sent. In addition, you can always activate the spam filter from your inbox, which will help prevent most fake emails from entering your inbox.

If, on the other hand attack is conducted via a voice call, you can prevent by adopting a service or app that helps you identify and filter spam calls. If you are not available to share your data with this type of services or pay for a subscription (covered by many of them), you may simply stop answering calls from unknown numbers and thus considerably reduce the likelihood of being the target of a “spoofing” attack.

Finally, if you fear to be the target of a attack of this type through fake websites, a sign that may be facing an attempt to cheat is immediately present in the URL. 

“ To be sure, the URL should start with https:// instead of http:// – the ‘s’ means ‘safe’ and there should also be a lock symbol in the address bar”Explains to Kaspersky. “ This means that the site has an updated security certificate. But if a site doesn’t have one, that doesn’t necessarily mean it was faked – look for additional signs”.

For additional signs, it should be “attentive to spelling or grammatical errors or logos or colors that may appear slightly incorrect” and also check if the site in question has areas such as privacy policy – which is usually present on normal websites.

Finally, you can also bet on a password manager with which you can automatically fill authentication credentials fields. It turns out that this type of software doesn't work on fake sites so if your credentials don't pop up automatically, the case may be that the site in question is fake.

There are also other more comprehensive rules that you should follow to avoid being the victim of “spoofing” attacks. Below you may get to know some of them and, even if it may take a while to get used to it, it is certain that the adoption of these habits can dramatically reduce the chances of becoming a victim.

Habits to be adopted to avoid “spoofing” attacks:

• Avoid clicking links or opening attachments with unknown provenance;
• Do not respond to emails or number calls from unknown senders;
• Where possible, configure two-factor authentication;
• Choose safer passwords that are long and complex;
• Do not share personal information with anyone on the Internet unless you have 100% confidence that you are talking to someone you can trust;
• Always have the software properly updated, either on your computer or on your phone;
• Make a review of who has access to your social networks and consider closing them to unknown people.