HACKING 17 Most Dangerous Hacking Attacks (2017)

Chapter 7 – Spoofing

Spoofing could de define as you would pretend someone or something that you are not. Faking your presents or your details to look like someone or something else. In simple terms, there isn’t any other way I could describe spoofing. However, lets look at some examples, so you can understand how dangerous spoofing can be.

Voice Spoofing

It must have happened a few years back around 2012 when I got spoofed the first time, and I realized the potentials. What happened is that while I was at work sitting at my desk, beside another Security Engineer whose name is Ajay we have been working on a Business Continuity project for a Financial Organization. Business Continuity is paramount for Disaster recovery purposes, in case some disaster would happen and the company would lose the central head office, or worse all the buildings, the employees would have a secured place to go to work. This place would be able to accommodate 100 people with PC-s and Phones ready to work. Sure this would not assist every employee. However, the management and selected people would be able to work. So Basically Ajay was configuring the VPN on the ASA (Virtual Private Network on a Cisco Firewall) while I was sitting beside him and creating a Visio Diagram for this new site, while I have realized that my mobile phone was vibrating in my pocket. When I looked at the phone, I already missed a call, so checked who I missed the call from, and it was a bit strange that I had a missed call from Ajay, in fact, I had two missed call from him already in the last 2 minutes. I looked at him, seeing that both his hands are on the keyboard since a long time, focusing on the project, so I just didn’t understand what’s happening. After a few seconds, I thought that he must have called me by mistake, so I just asked him:

-Ajay! Did you just call me?

He answered:

-I am busy dude, just give me a minute.

So I was now really confused. I couldn’t wait any longer, as I saw on my mobile that he called me from his mobile as his name was on the phone. Because it only happened a few minutes ago, I thought that his phone is not locked and while in his pocket, I will keep on getting calls from him, and I just wanted to tell him to lock his phone at least even he is busy… So I started talking to him again…

-Ajay, your phone, keeps on calling me, where is your phone mate?

He then reached for his iPhone, when I saw with my own eyes that his phone was locked, but in the same second my phone was ringing again with his caller ID, so now I was a bit louder and saying:

-AJAY! You are calling me again man!

While he unlocked his phone, and we now both were looking at his phone, clearly see there is no dialing – he just said:

-I am not calling you! Pick it up, and see who it is!

So I picked it up, but the phone went dead.

Ajay and I were looking at each other thinking, how and what is going on, while I have realized that Roger from Telephony seems like laughing quietly, then I realized that some other engineers are laughing too. So now I have realized that is a good laugh for some of us, sure making fun of those trying to work hard, but I didn't agree, more like curious how it was done. I will not get into details now. However you have to understand that using Cisco Call Manager, newly called CUCM (Cisco Unified Call Manager) you can change the caller ID to anything you desire. There are many other platforms too that you can achieve the same result. However, this was done by the Call Manager.

I have talked about Phone Phreakers in Volume 1, and I have explained that back in the 80’s old school hackers/phreakers used to play around making fun of people. This is a good laugh for sure, however spoofing voice by changing the caller ID, can be utilized by Black Hat hackers too. Imagine that you would receive a phone call, or a TXT message that saying that it was an Electric Company, asking you to call back due to necessary changes. So you would check the number, and you would see that is legit, but at the same time, they would be calling you again. So after you would pick up the telephone, they would explain that they have changed their Bank Details, therefore from now on you must make your monthly payments to their new account, and they didn’t receive your payment yet. So, your current option is to pay what you own them, or they will shut down your electricity by the end of the day. You have time to make changes on your standard order. However, you must make the payment now to their new Bank Account that is only 45 dollars. The reality is that when Black Hat hackers spoofing the caller ID, you would believe they are legit and would make a payment. This is only one example. However, there are multiple ways to scam people with spoofing caller ID-s. Unfortunately, this technique is very efficient, and there are just too many victims out there, and it is tough to differentiate the good company from scammers, especially if they have an excellent social engineering skillset.

Spoofing comes in many other forms such as spoofing e-mails or websites, even a particular software can be fooled. However, the most common way that is implemented is to spoof the caller ID.