Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [spoofing]

A kind of attack in which one system, program, or user successfully masquerades as another.

1
vote
3answers
88 views

is spoofing CA to sign application possible?

Is it possible to spoof the CA of any server to sign some application? As like as what CarbonCopy claims?
1
vote
1answer
34 views

Smartphone fingerprint plus iris scanning for login

I have often thought about the fact that when intimate relationship partners live together they eventually tend to sneak over your shoulder and gain access to your password on either your mobile phone ...
6
votes
1answer
137 views

How could malicious code changes in a GitHub pull request be masked by an attacker?

When viewing a pull request on GitHub (or the equivalent on any other platform), the web interface displays a diff of the changes for you to review. Reviewing the diff is obviously vulnerable to ...
0
votes
0answers
27 views

Disconnect two Bluetooth connected devices [duplicate]

Suppose, two Bluetooth devices are connected in range. I know both their Bluetooth MAC addresses. Since these devices are constantly sending commands to each other, can't I just spoof on device's ...
1
vote
1answer
115 views

Help! Someone fake texted or made a photo with my number calling and texting them [closed]

My husband received a Facebook message from a random guy who’s profile we cannot find nor could we respond! It was this picture that I attached. He’s made a picture where it looks like my phone number ...
0
votes
0answers
411 views

Can a Whatsapp account be spoofed?

I've had a big privacy concern lately regarding the safety of my Whatsapp account. Ever since my phone was stolen from me and returned by certain malicious individuals, I've had the weirdest feeling ...
2
votes
0answers
26 views

DNS search lists cause ambiguity, but what are practical examples of this?

Browsers and other Web software tend to allow the system resolver to use the local domain search list when resolving URLs. E.g. www -> www.example.com., if your domain search list is example.com. ...
37
votes
5answers
6k views

How could a public DNS server return bad results?

I live in a country which is under many sanctions. Both internal sanctions (government on people) and external sanctions (US on our people). In our country, YouTube, Twitter, Facebook and many other ...
0
votes
1answer
75 views

Is it possible to make a spoofing attack in a access point with same SSID target network?

With an Evil Twin attack is it possible for the access point to send malware to connected devices? If it is, how can this be prevented?
1
vote
2answers
72 views

Is it safe to add IP address to SPF record

I am a programmer who manages online exchanges user also and i have been asked to add IP address to SPF record so that one of the application can hosted on Azure can send emails to user etc.. v=spf1 +...
3
votes
1answer
696 views

How to detect WiFi spoofing? [duplicate]

I have recently become concerned that someone might be spoofing the WiFi network at my office. The network has been really unstable these last few weeks. The password isn't really that secret, and I'm ...
0
votes
2answers
90 views

Message telling me that I bought something with credit card

I just received a message via SMS that I bought something from an online shop with my credit card. The message reads like this (translated from German): Your credit card purchase - please check: - ...
1
vote
2answers
508 views

OAuth - How does the Resource Server validate the access token is not for any other Resource Server?

Let's take an example where there are two resource servers - RS1 and RS2 and there is one authorization server - AS. Both resource servers - RS1 and RS2 use authorization server - AS If a client ...
2
votes
0answers
180 views

Fake lock screen in full screen browser window

Suppose a desktop OS has a lock screen and fades and locks after inactivity. Suppose the default appearance and inactivity duration are well known (eg consider a default installation of some popular ...
1
vote
0answers
95 views

Firefox directs me to strange chinese error page, is my security compromised?

Today I was working on a project on my localhost ( I'm a web developer ), when I noticed Firefox is showing a message that means I need to login to my ISP before I can start browsing ( The ...
1
vote
1answer
77 views

How does faked DNS manage to downgrade preloaded HSTS?

Yesterday, in a bid to entertain myself for a while, I was playing around with DNS servers. I set up a DNS server locally, which I then set as my primary DNS server. Within it, I added some records ...
0
votes
0answers
197 views

Fake Wordpress reset password email with an external X-Google-Original-From header

My employer owns a Wordpress blog and I have an account with it used to submit blog posts. I have recently received a few password reset emails that link to an external site. These emails appear to ...
22
votes
4answers
559 views

Bank asked for a cross login?

I was creating a new bank account here in the US at HSBC's popular online bank... You know the step where you have to verify the account you're sending from, by receiving two small test payments? I ...
0
votes
1answer
741 views

dnsspoof doesn't spoof DNS request with IP-address of local machine

I want to spoof all DNS requests with the IP address of my local machine. However, running dnsspoof, all clients receive the real IP address and not the fake IP address of my host. I know I can ...
80
votes
1answer
23k views

Is Starbucks spoofing me?

When I connected to Starbucks's Wi-Fi, I got a security alert from MS Outlook that looks like this: I looked up secure.datavalet.io, but there's no mention of this thing anywhere. This does not ...
0
votes
0answers
223 views

Kali Linux 2 DNS spoofing: is there still a bug?

Good evening, I am trying to set up dns spoofing in kali linux 2.1 I have two kali environments, one on my tablet using linux deploy, and another on an USB stick. I managed to poison ARP using ...
0
votes
1answer
178 views

Is IP spoofing possible in Windows Desktop with user privileges?

I read on WinSockAPI that IP spoofing is disabled for Desktop windows devices (non-servers like Windows 7, etc). However, I've been able to do IP spoofing using nmap, so clearly this is possible. ...
3
votes
4answers
337 views

I started to learn about MITM attacks, and I can't figure out few things

I just started to learn about MITM attacks, and I can't figure out few things. I have few questions and appreciate all the answers. If the attacker is already in my LAN why does he need to trp to arp ...
0
votes
1answer
113 views

Spoofed number? [duplicate]

I got an offensive text message from a phone number I don't recognize. I looked up the number with reverse look up. It says the number is a land line. Have I been "spoofed"? Is there a way to find out ...
1
vote
1answer
69 views

APIPA traffic in router/netflow logs

While inspecting some flow logs, I noticed some port 22 traffic destined to a few local servers (at 10.x.x.x) . What was surprising is that the traffic originated from a 169.254.x.x IP address. Is ...
1
vote
1answer
213 views

MITM based on ARP spoofing

I fail to understand how a MITM attack sniffs packets and modifies them.In the case of ARP spoofing although the attacker has spoofed the MAC address of a host, how does he modify it? if he listen to ...
25
votes
2answers
5k views

How wise is it to use a tool for portspoofing at your server to confuse attackers?

I came across this tool recently https://github.com/drk1wi/portspoof How efficient will it be to use it to confuse hackers doing port scanning? If it's actually going to be pretty efficient, why ...
1
vote
2answers
744 views

Can I spoof my user agent so that the type of device I'm using doesn't show up?

I was looking into spoofing a user agent but all that has come up so far is spoofing the browser type. However I can still see what kind of device I am using (tbh I'm not really even sure why someone ...
0
votes
1answer
41 views

Is it possible for a single user to route connections through several IP addresses?

I have searched google for an answer to my question and can’t seem to find one. Maybe you can help me out. Is it possible to use somebody else’s IP addresses to post on a forum with? I am a moderator ...
1
vote
1answer
2k views

Reply to a spoofed SMS message

If my phone number is (212)555-1212 and Bob spoofs my number vias SMS to Alice, will Alice's reply be sent to Bob, me or both? EDIT: The concern is that the spoof prompts Alice to disclose ...
0
votes
1answer
62 views

Shmishing scam that targets Gmail access

I'm looking for information on scams that target GMail users. I believe I found an article that discusses the attack in the context of bank fraud at Warning over text message scam that allowed '...
0
votes
3answers
122 views

Can a malicious SSH server successfully *pretend* to know a client's public key?

Yes, I know that after giving an SSH public key to someone else, one should always assume that it might have been swiftly published somewhere. (For instance, give your SSH public key to GitHub, and ...
1
vote
1answer
1k views

It's there a way to bypass https nowadays?

It's there a way to bypass https (using mitm attacks) on browsers like chrome, firefox, etc? I know it could be done in some way, exploiting the NTP port, but we need the interaction of the victim. ...
3
votes
2answers
98 views

How can an end-user verify the authenticity of a third-party authentication provider's login form

Given the ubiquitous use of third party authentication providers in web apps today, how can end-users verify the authenticity of the login forms that collect their credentials? What's to stop a ...
0
votes
1answer
492 views

Tracing email sent from service?

I know an email was sent using the online service emkei.cz. Is there a way to find out who used that service to send the specific email I received?
2
votes
2answers
237 views

Protecting yourself from DNS spoof

How does one protect themself from a DNS compromised site, which also has had their SSL private key stolen? Short of monitoring which IP the packets are being sent to. Edit: Or even without the ...
5
votes
1answer
121 views

Is it worth verifying the request hostname in API-to-API communications?

When authenticating from a browser application to an API layer, you can verify the request origin for CORS requests. I'm aware that this is primarily to prevent CSRF attacks. It doesn't prevent an ...
13
votes
1answer
814 views

Did somebody try to spoof my wifi network?

I am traveling on a train in Switzerland, working on a macbook connected to a wifi hotspot that I've set up on my Phone [1] using WPA2. At some point along the journey, the internet connection drops. ...
1
vote
2answers
297 views

Why is spoofing allowed in reputed VPS services?

I just learned about IP spoofing and so I set up VMs and sent spoofed UDP packets (8.8.8.8, Facebook's IP, Twitter's IP) to myself (home PC and mobile) from well-reputed VPS providers like AWS, ...
9
votes
2answers
259 views

WPAD name collision attack victim: possible information leak

This is a home network: a wireless Linksys router serving around 5 wireless devices and 3 wired ones, two PCs and a PS4. The router is setup to serve DHCP to client devices. It has a setting to ...
8
votes
3answers
2k views

Someone is making random calls spoofing my phone number. What to do?

For the past six months, I've experienced call-backs from foreign numbers (all within the EU) telling me that I had called them earlier. At first, I thought the calls are malicious. However, due to ...
2
votes
3answers
2k views

Can iMessages be spoofed?

I am subject to legal proceedings where fake iMessages (not SMS) are being introduced by the opposing party and proclaiming to have come from me. I read about spoofing SMS messages. Is it possible for ...
0
votes
0answers
68 views

Spoof local/internal IP address on browser [duplicate]

I found this website and I didn't knew you could get the local ip of a computer with php. I also found how to do it here. So I am wondering if anyone knows how to spoof this. Also, if you know how to ...
1
vote
1answer
768 views

Is it possible to Spoof Another Machine's MAC Address on LAN?

Is it possible to Spoof Another Machine's MAC Address on LAN? I know we can spoof mac address of machine that we are currently on, using macchanger or ifconfig wlan0 ether de:ad:be:ef:ca:fe. But I ...
2
votes
2answers
313 views

Why can't I force an application to close active session by spoofing the Source IP address?

I am trying to get my head around the setup above. A simple netcat session between two hosts and a pentesting machine is trying to get that established session to be terminated by only knowing source ...
1
vote
1answer
7k views

Suspicious text received from my # but I did not send it - is there definitely a virus involved, and if so who has it, the sender or receiver?

A close friend texted me this morning asking if I meant to send that last text, noting it was suspicious. I asked for a screenshot of the text in question, and it is a text from my number with spam I ...
0
votes
1answer
66 views

Botnet tracing: Is SvcHost RemoteIP reliable or can it be spoofed?

On an RDP server, the "Resource Monitor" system app shows network connectivity by process in the "Overview" tab under "Network" section. In this section, I see an SvcHost process on TCP port 3389 for ...
0
votes
2answers
2k views

How a spoofing email site such as emkei works

I'm trying to understand how email spoofing works. After studying the technical process, I have finally understood that : 1)The spoofer will try to scan every ports of a smtp server to catch the mx ...
0
votes
2answers
442 views

Windows Active Directory: How do endpoints authenticate the Domain Controller?

Windows Active Directory is based on Kerberos and LDAP. When authenticating via the Domain Controller, how does my endpoint know that it's really speaking to the DC? Likewise, AD can be used to ...
0
votes
1answer
52 views

In what ways can the URL be analyzed to decide whether a page is Phishing or not?

In what ways can a URL be analyzed to check whether its a Phishing page or not. Such as using target site's name somewhere in the URL, URL obfuscation, misspellings, etc. Its not possible every time ...