Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [spoofing]

A kind of attack in which one system, program, or user successfully masquerades as another.

Filter by
Sorted by
Tagged with
0 votes
0 answers
30 views

Spoofed iMessage? Apple account breach? What are the possible ways this happened?

See the screenshot below. A friend asked me about this. Person #1 had a group text thread with Person #2 and Person #3. At the top, Person #2 sent a photo and a message. Person #3 replied. Then there ...
user avatar
  • 119
0 votes
1 answer
39 views

Spoofing TCP/IP headers and uniqueness of the host name

I have some related questions: Is it possible to spoof the source address in the TCP/IP header when using HTTPS? If possible, is there any way to detect source address change? I think the checksum is ...
user avatar
0 votes
1 answer
26 views

Authorizing 3rd Party Envelope Sender to Impersonate Header Sender

Rewriting for clarity: This is regarding emails send from a 3rd party marketer spoofing one of our email addresses in the message header from field. In these emails the envelope sender would come ...
user avatar
0 votes
1 answer
37 views

Is it possible to spoof a service running on a port in Ubuntu?

I was looking into the idea of port spoofing, and I came across this GitHub repository. I'm mainly looking to disguise my computer as something else, whereas this program opens every TCP port and ...
user avatar
1 vote
0 answers
44 views

How would a cellular phone call be connected if there are two phones with the same number? [closed]

In the 2004 movie "Primer", the a character goes back in time, and there are two copies of him, both with a cell phone. The character receives a phone call initially, and then receives the ...
user avatar
  • 119
0 votes
0 answers
48 views

Loopback source IP Spoofing

Assuming I have a service running with elevated privileges on a host, and another service is listening on a UDP port with access for everyone (0.0.0.0) is it possible to craft a spoofed UDP datagram ...
user avatar
0 votes
0 answers
32 views

How do tracking services stop third party requests?

Facebook Pixel and Google Analytics for example give you an API key to identify tracking requests from your website. But what is to stop someone from grabbing the key, spoofing your domain and ...
user avatar
  • 1
0 votes
1 answer
119 views

Why do DDoS attacks spoof DNS source IPs?

Recently, a lot of my friends have been talking about botnets. They said they've created their own.‌‌ Obviously, I ​​know this is all illegal so I try not to take part in any of it. But I've been ...
user avatar
0 votes
2 answers
141 views

Malicious SMS and iMessage Interception

I have an interesting situation on my hands. There are people in my neighborhood that have been harassing me for some time now. It appears that these individuals can are receiving my text (sms) ...
user avatar
0 votes
2 answers
63 views

Business Email Compromise emails sent to personal email accounts

I am using Google workspace to handle my domain emails. At a certain point, employees started to receive spoofing emails to their @mydomain.com addresses. I blocked these emails and it worked. However,...
user avatar
  • 101
0 votes
1 answer
90 views

Can this logic with regard to checking Reverse DNS records be flawed?

For my web app, I hardcode a reverse DNS detection for common web crawlers. And for detecting them I use their Reverse DNS, which I always check whether it includes i.e. google.com. My questions would ...
user avatar
  • 200
0 votes
1 answer
77 views

"Mutuality" of public key authentication

I'm a newbie when it comes to cryptographic security, but there's something I'm not quite getting concerning the "mutual" aspect of public key authentication. Say you have a client X, and ...
user avatar
  • 115
0 votes
0 answers
82 views

What would happen if I ARP spoofed my router

What would happen if I ARP spoofed my router, with that I mean that I make all devices on the network believe that I am the router. As there would be a MAC address conflict would that result in a DOS ...
user avatar
1 vote
1 answer
84 views

SPF records and spoofing

Lets say we have this SPF record v=spf1 include:spf.protection.outlook.com include:spf.onprem.com -all` And this record v=spf1 include:spf.protection.outlook.com include:spf.onprem.com ?all What ...
user avatar
0 votes
0 answers
91 views

How can you spoof you caller id but not using a voip (your carrier instead)?

My research: I found this security stackexchange post but it didn't answer my question. I know that you can do similar things using astresik with voip provider. I came up on o blog that explain that ...
user avatar
0 votes
1 answer
106 views

When GPS is spoofed in a smartphone, does this affect whatever is being monitored?

When GPS is spoofed in a smartphone, does this affect whatever is being monitored? Suppose I spoof the GPS on my smartphone, such as lazy Pokemon GO players do to play from their couch. Will this ...
user avatar
0 votes
1 answer
204 views

Securing a Websocket Connection in case of XSS Vulnerability

Goal Authenticate the Client via HTTP Request. Authenticate the Client's WebSocket connection. Prevent exploitation of WebSocket connection(when a XSS Vulnerability is present on website). How I'm ...
user avatar
  • 3
1 vote
2 answers
207 views

Do fowarded emails retain DMARC protection?

Assume I ask someone to create a filter in their Gmail account that automatically forwards certain emails to my inbox. If the original email was protected with DMARC, would the forwarded email also be ...
user avatar
4 votes
2 answers
225 views

Fake AP for Staff Security Awareness

We are working on an activity to train staff about security. Is there any way to spoof the company's guest router and ask staff to provide login credentials (as public wifi does) and when they do that,...
user avatar
0 votes
1 answer
110 views

Cell Phone texting [closed]

Is it possible for someone to redirect text messages to you from another’s phone? Something weird is going on…over the last few weeks I have received “wrong number”text messages from people with ...
user avatar
0 votes
1 answer
115 views

DNS local cache spoofing with malware or RAT

I was learning networking and knew that browsers don't have algorithms to convert domain names to IPs. It queries a DNS server. After that, the computer remembers the IP, so next time the domain is ...
user avatar
  • 119
5 votes
0 answers
456 views

How did ntpd get patched to prevent NTP time synchronization attacks?

I recently tested the NTP Time Synchronization Attack as described and demonstrated by Jose Selvi in 2015. Basically, the attack was mostly used to send the victim's clock in the future, so the ...
user avatar
0 votes
0 answers
619 views

How does the NSA "masquerade as any routable IPv4 or IPv6 host"?

I was reading the Wikipedia article about TAO and there is written that: Details on a program titled QUANTUMSQUIRREL indicate NSA ability to masquerade as any routable IPv4 or IPv6 host. This enables ...
user avatar
0 votes
1 answer
261 views

Spoof IP address after a TCP handshake established

Is it possible to spoof the IP once a TCP handshake was performed successfully? For example: Perform the handshake Use the session with the same IP which performed handshake but on different machine ...
user avatar
1 vote
0 answers
199 views

SPF fail, DKIM pass, where did the emails originate from [closed]

I have been a victim of a fraud where my solicitor's email address was used to dupe me out of a house purchase deposit. How do I determine where the emails originated from - did the crooks use emails ...
user avatar
  • 11
1 vote
0 answers
209 views

Prevent IP session hijacking

I was thinking of the following scenario : a network is behind a router (performing NAT) and firewall this firewall denies all unsollicited incoming packet a user on a computer of the network opens a ...
user avatar
  • 331
1 vote
1 answer
2k views

SPF/DMARC for shared email provider (gmail) - how did this email pass SPF?

We recently received an email from a self described "white hat hacker" purporting to be from our own organization. According to the mail headers, spf, dmarc, dkim and arc all passed okay and ...
user avatar
1 vote
1 answer
112 views

Spoof texting a regiatered number to yourself and relying....having a conversation [closed]

I feel like I am going crazy. A friend was at my house and received text messages from a number from a person i know. She had a conversation with this number for basically a week. She is now saying ...
user avatar
  • 11
0 votes
1 answer
194 views

Spoof publisher info on Windows applications

Let me start by acknowledging that I have absolutely no experience with Windows development and this is purely for academic purposes. I apologize for incorrect terminology and welcome corrections or ...
user avatar
  • 1
1 vote
1 answer
122 views

Would it be possible to create an external mac address spoofer?

I was wondering if it would be possible to create some sort of ethernet passthrough device, but this device also functions as a layer 2 mac address spoofer, which can be used with any device without ...
user avatar
  • 11
1 vote
1 answer
109 views

Why can't mail clients verify an email was sent from the user and server it claims to be from?

Background When I explain to my clients the security issues around email spoofing, I often explain that emails are like regular mail. Anyone can write Jon Doe on the return address, but that doesn't ...
user avatar
  • 2,266
1 vote
1 answer
123 views

Best way to learn every way I am tracked online? [closed]

Is there a course or resource for a person with basic networking skills to see all ways a website like FB or Google can track and identify users + how to spoof them and look natural? Not for malicious ...
user avatar
1 vote
0 answers
105 views

Retrieving a No Caller ID phone number? [closed]

I got a call from an unknown number, more specifically, a no caller ID number. I’m not the guy who gets a lot of calls from a no caller ID phone number, and usually, when I got one is typically the ...
user avatar
2 votes
1 answer
520 views

Man in the middle using HTTPs downgrade to HTTP

In general browsers attempt to establish a HTTPs-Connection if possible. How would you force a browser to fallback to HTTP when somebody enters asdf.xyz in the search bar of his/her browser without ...
user avatar
1 vote
1 answer
192 views

Is it possible for a domain to be faked?

I was talking to PayPal customer service and they were trying to tell me PayPal does not have any third parties, so when I shown them https://www.paypal.com/uk/webapps/mpp/ua/third-parties-list they ...
user avatar
  • 562
0 votes
1 answer
207 views

Redirection - Different Website from Different Computer

There are URLs which its only purpose is to redirect the HTTP requestor to a correct website. Say, if I tried to access example.com/0wa/RaNd0m from my computer, it would redirect me to wikipedia.com. ...
user avatar
1 vote
2 answers
2k views

How to spoof IMEI/SIM location?

Once you plug it into a phone and power it on, the IMEI number of the phone and the SIM's serial number will be transmitted to the nearest cell tower(s). source Is there a way to spoof the location ...
user avatar
  • 155
0 votes
2 answers
205 views

Does an attacker need to guess or brute-force a password for TCP spoofing?

From my understanding, TCP spoofing can be carried out if the attacker can correctly guess the sequence numbers from the response packets (to mimic the real client). The attacker may even obtain this ...
user avatar
0 votes
1 answer
119 views

Internal HTTPS recommended security practices

So I'm by no means a security expert. I'm just a recently graduated software developer who is working on a contract project and I want to ensure I'm taking appropriate security measures for my client. ...
user avatar
  • 101
0 votes
2 answers
128 views

How Can I Prevent Hackers From Spoofing TCP messages onto my server?

I have a Python client and server communicating over a TCP socket - they send and receive a certain set of standardized string commands to each other. How can I prevent a hacker from creating their ...
user avatar
0 votes
2 answers
470 views

What prevents someone from spoofing their public key when trying to establish an SSH connection? [duplicate]

Recently I've been trying to learn the mechanisms behind SSH keys but I came across this question that I haven't been able to find an answer to (I haven't figured out how to word my question such that ...
user avatar
0 votes
2 answers
232 views

How do I access a website on my phone without it being able to determine that it was accessed from the same phone and location?

How is it possible to create an account in a website with completely different credentials without the website being able to link the user of the first account and this new one? Tor is not a viable ...
user avatar
  • 101
4 votes
2 answers
366 views

Are there security reasons for prohibiting universal mac address modification?

Background In a standard 48-bit MAC address, the 7th (most significant) bit specifies whether it is a universally-administered address (UAA) or a locally-administered address (LAA). If it is 0, then ...
user avatar
  • 401
1 vote
1 answer
137 views

DDoS using websites instead of bots?

What if a ddos attacker hits public websites (google, amazon etc) with some requests but spoofed the souce ip to the victim's ip. Now the responses will be sent to the victim's ip. Attacker can rotate ...
user avatar
1 vote
1 answer
121 views

Access-Control-Allow-Origin and security behind it [duplicate]

I have some troubles to understand how the header "Access-Control-Allow-Origin" can really be secure. Let me explain what I have in mind: Let's say I have an API on api.contoso.com setting this ...
user avatar
  • 113
1 vote
1 answer
161 views

Is it possible to spoof a GPS satellite?

If it is possible? Any devices that can be bought to do so. If not, how are GPS satellites are designed to be spoof-free.
user avatar
0 votes
0 answers
161 views

How can you spoof your caller ID? [duplicate]

How can I spoof my caller ID to make it look like someone else is calling for pen testing purposes. Note: I tagged Python because I am trying to make it with Python.
user avatar
1 vote
1 answer
528 views

Can a DNS query source be spoofed?

Will the DNS server reply to the spoofed address if you send a DNS request on behalf of it? What I'm trying to ask isn't DNS spoofing but spoofing the source address.
user avatar
  • 13
1 vote
3 answers
127 views

What is the best defense for a multi-layered attack: Spoofing, MiTM, Login CSRF?

How would one go about defending against this sort of attack to best protect a sloppy user? There can be obvious signs of a spoofing attack, such as not using SSL, slightly different domain, etc, but ...
user avatar
4 votes
1 answer
411 views

Why can't spoofed caller ID's be identified?

There are several posts here about how easy it is to spoof caller ID and that there is no way to detect it. I did find one post suggesting the calls to 1-800 numbers could not be spoofed. being ...
user avatar

1
2 3 4 5 6