Professional Documents
Culture Documents
Web Spoofing: Prepared By: Yukti Chuttani B.C.A Iii 15008000610
Web Spoofing: Prepared By: Yukti Chuttani B.C.A Iii 15008000610
Prepared by:
YUKTI CHUTTANI
B.C.A III
15008000610
Web Spoofing
Allows an attacker to create a “shadow copy” of the
entire World Wide Web.
Attacker creates misleading context in order to
trick the victim.
Attack is like a con game.
Online fraud.
History
The concept of web spoofing was discussed in
1980 by Robert Morris, whose son found some
security weakness in TCP protocol known as
security prediction.
Starting the Attack
The attacker must somehow lure the victim into
the attacker’s false web. there are several ways
to do this.
An attacker could put a link to false web onto
popular web page.
If the victim is using Web-enabled email, the
attacker could email the victim a pointer to false
web.
Spoofing attacks
in the physical world as well as the
electronic world
In the physical world for example, there have
been several incidents in which criminals set up
bogus automated teller machines. the criminal
copy the victim’s card and use the duplicate.
In the these attack people were fooled for the
context what they saw. The location of the
machine and the appearance of their electronic
displays.
People using computer system often makes
security relevant decisions based on contextual
cues they see. For example you might decide to
type in you account number because you believe
you are visiting your bank’s web page. This belief
might arise because the page has a familiar look.
Consequences
• Surveillance – the attacker can passively
watch the traffic, recording which pages the
victim visits and the contacts of those pages.
(This allows the attacker to observe any
account numbers or passwords the victim
enters.)
• Tampering – the attacker can modify any of
the data traveling in either direction between
the victim and the Web. (The attacker would
change the product number, quantity or ship
to address.)
How the Attack Works
Forms
URL Rewriting
URL Rewriting
The attacker’s first trick is to rewrite all of the URLs
on some web page so that they point to the attacker’s
server rather than the real server. Assuming the
attacker’s server is on the machine www.attacker.org,
the attacker rewrites a URL by adding http://
www.attacker.org to the front of the URL. For
example, http://home.netscape.com becomes http://
www.attacker.org/http://home.netscape.com.
Once the attacker’s server has fetched the real
document needed to satisfy the request, the attacker
rewrites all of the URLs. in the document into the
same special form. Then the attacker’s server
provides the rewritten page to the victim’s browser.
If the victim fallows a link on the new page, the victim
remains trapped in the attacker’s false web
Forms
When the victim submits a form, the submitted
data goes to the attacker’s server. The attacker’s
server can observe and even modify the
submitted data, doing whatever malicious editing
desired, before passing it on to the real server.
How attacker attacks victim
Destroying the Illusion
There are cues that can destroy the illusion:
• Status line
• Location line
• Viewing document source