What is sniffing and spoofing?
Sniffing is the process in which all the data packets passing in the network are monitored. … Sniffers can be hardware or software installed on the system. Spoofing is the process in which an intruder introduces fake traffic and pretends to be someone else (legal source or the legitimate entity.
From an information security perspective, sniffing refers to tapping the traffic or routing the traffic to a target where it can be captured, analyzed and monitored. Sniffing is usually performed to analyze the network usage, troubleshooting network issues, monitoring the session for development and testing purpose.
The practice or technique of monitoring, gathering, capturing, and logging some or all data packets passing through a given computer network is called sniffing or packet sniffing. A packet sniffer is composed of two parts namely; a network adapter and software that is used by a network to observe or troubleshoot network traffic.
Attackers use these sniffers to seize data packets that contain valuable information and analyze the network traffic. Sniffing is categorized into active sniffing and passive sniffing. In Active sniffing, there is the constant activity by the attacker to obtain information and sniff the traffic from the switch network. In passive sniffing, the attacker is hidden and sniffs through the hub.
Any kind of behavior where an attacker mask as an authentic user or a device to secure something beneficial or crucial information for their gain is called spoofing. There are various kinds of spoofing such as website spoofing, E-mail spoofing, and IP spoofing. Other common methods include ARP spoofing attacks and DNS server spoofing attacks.
An E-mail spoofing targets the user while an IP spoofing is predominantly targeted at a network.
In an IP spoofing attack, the attacker attempts to obtain illicit and illegal access to a network through messages with a bogus or spoofed IP address to deceive and show it off as a message from a trusted source. This is achieved by using a genuine host’s IP address and varying the packet headers led from their personal system to mimic it as an original and a trusted computer’s IP address.
B) DIFFERENCE BETWEEN SNIFFING AND SPOOFING
Now that we have understood what is sniffing and spoofing, the spoofing and sniffing definition, let’s now compare packet sniffing and packet spoofing.
- During the process of sniffing, the networks’ data traffic is the main target of the attacker who captures data packets that flows across a computer network using packet sniffers.
Whereas in spoofing, the attacker rip-offs the authorizations of a user and deploys those details in a system as an authentic user to unveil attacks against network hosts, take data, disburse malware, or circumvent access controls.
- In spoofing, the attackers use another person’s IP address to produce TCP/IP. In packet sniffing, a sniffing program is on a part between two interactive endpoints where the attacker pretends to be one end of the connection to the target and snoop on files delivered between the two endpoints.
The software or method depleted to achieve this is called a packet sniffer, which is a function that sniffs without altering the network’s packets in any way.
- In short, packet sniffing means eavesdropping on other people’s conversations. Packet spoofing refers to dynamically presenting phony network traffic impersonating to be someone else.
- In packet sniffing, an attacker can’t cause any mutilation to the system per se and hence is a passive attack. Packet spoofing is an active attack where it is possible for an attacker to introduce a harmful program to taint the victim’s system.
- The attackers get access to the device or system through which the traffic is directed in packet and packet spoofing, the attack is done by transferring packets with incorrect source address i.e., modifying routing tables.
- A popular method to defend sniffing is by way of encryption while the top method to tackle spoofing is by use of digital signatures.
The Difference Between Sniffing and Spoofing is that,In sniffing, the attacker listens into a networks’ data traffic and captures data packets using packet sniffers. In spoofing, the attacker steals the credentials of a user and uses them in a system as a legitimate user.
SNIFFING AND SPOOFING TOOLS
|bettercap||It works like a Swiss army knife for network attacks and monitoring. It is a tool for network capture, analysis, and MITM attacks.|
|Burp Suite||Burp Suit is a platform for security testing of web applications.|
|DNSChef||It is a highly configurable DNS proxy for Penetration Testers and Malware Analyst.|
|fiked||It is a Cisco VPN attack tool that is used to attack insecure Cisco VPN PSK+XAUTH based IPsec authentication setups, which are called as semi MitM attack.|
|hamster-sidejack||It is a side-jacking tool that acts like a proxy server that replaces your cookies with session cookies stolen from somebody else.|
|HexInject||It is a hexadecimal packet injector or sniffer which is capable of reading, intercepting, and modifying network traffic in a transparent manner.|
|iaxflood||It is a VOIP flooder tool.|
|inviteflood||It is a SIP/SDP INVITE message flooding over UDP/IP.|
|iSMTP||This tool tests for SMTP user enumeration, internal spoofing, and relay.|
|isr-evilgrade||It is an Evilgrade framework that allows the user to take advantage of poor upgrade implementations by injecting fake updates.|
|mitmproxy||It is an HTTP proxy that provides a console interface that allows traffic flows to be inspected and edited.|
|ohrwurn||It is an RTP fuzzer that reads SIP messages to get information about the RTP port numbers.|
|protos-sip||It evaluates the implementation level security and robustness of Session Initiation Protocol implementation.|
|rebind||It is a DNS rebinding tool that implements the multiple A record DNS rebinding attack.|
|responder||It is an LLMNR and NBT-NS responder which answers to specific NBT-NS queries based on their name suffix.|
|rtpbreak||It detects, reconstructs and analyses RTP sessions|
|rtpinsertsound||This tool is used to insert audio into a specified stream.|
|sctpscan||It is a tool to mix pre-recorded audio in real-time with the audio in the specified target audio stream.|
|SIPArmyKnife||It is a fuzzer that searches for cross site scripting SQL injection, log injection, format strings, buffer overflow, etc|
|SIPp||It is a traffic generator for the SIP protocol.|
|SIPVicious||It is an online password cracker that is used to audit SIP based VoIP systems.|
|Sniffjoke||It is a transparent TCP connection scrambler that delays, modify and inject fake packets inside your transmission.|
|SSLsplit||It is a transparent and scalable SSL/ TLS interception used for man-in-the -middle attacks against SSL/TLS encrypted network connections.|
|sslstrip||It is an SSL/TLS man-in-the-middle attack tool that is used to hijack HTTP traffic on a network transparently.|
|THC-IPV6||It converts a MAC or IPv4 address to an IPv6 address.|
|VoIPHopper||It mimics the behaviour of IP phones to rapidly run a VLAN hop into the voice VLAN on specific Ethernet switches.|
|WebScarab||It is a web application review tool used to expose the working of an HTTP based application.|
|Wifi Honey||It creates five monitor mode interfaces, in which four are used as access points, and the fifth is used for airodump-ng.|
|Wireshark||It is a network protocol/traffic analyser. It allows us to monitor our network at a microscopic level.|
|xspy||It is a keystroke sniffer that sniffs keystrokes on remote or local X-Windows servers.|
|zaproxy||It is a penetration testing tool for finding vulnerabilities in web applications.|
SNIFFING AND SPOOFING PREVENTION
- Use authentication based on key exchange between the machines on your network; something like IPsec will significantly cut down on the risk of spoofing.
- Use an access control list to deny private IP addresses on your downstream interface.
- Implement filtering of both inbound and outbound traffic.
- Configure your routers and switches if they support such configuration, to reject packets originating from outside your local network that claim to originate from within.
- Enable encryption sessions on your router so that trusted hosts that are outside your network can securely communicate with your local hosts.
Precautionary measures against Sniffing attacks
- Connect to trusted networks: Do you trust a free Wi-Fi offered by the coffee shop next door? Connecting to any public network will have a risk that the traffic might be sniffed. Attackers choose these public places exploiting the user’s lack of knowledge. Public networks are setup and then may or may not be monitored for any intrusions or bugs. Attackers can either sniff that network or create a new network of their own with similar names so that the users get tricked into joining that network. An attacker sitting at an airport can create a Wi-Fi with the name of “Free Airport Wi-Fi” and the nearby users may connect to it sending all the data through the attackers’ sniffer node. The word of caution here is that you should only connect to the network you trust – home network, office network etc.
- Encrypt! Encrypt! Encrypt! : Encrypt all the traffic that leaves your system. This will ensure that even if the traffic is being sniffed, the attacker will not be able to make sense of it. One thing here to be noted is that security work on defense in depth principle. Encrypting he data does not mean that now everything is safe. The attacker might be able to capture a lot of data and run crypto attacks to get something out of it. Use of secured protocols ensures that the traffic is encrypted and renders security for the traffic. Websites using https protocol are more secure than the ones that use HTTP – how is that achieved? Encryption.
- Network scanning and monitoring: Networks must be scanned for any kind of intrusion attempt or rogue devices that may be setup in span mode to capture traffic. Network admins must monitor the network as well so as to ensure the device hygiene. IT team can use various techniques to determine the presence of sniffers in the network. Bandwidth monitoring is one, an audit of devices which are set to promiscuous mode etc.
In both the sniffing and spoofing attacks, the victims or the targeted persons are completely unaware of the fact that their data and exchanges have been intercepted and conceded. This becomes one of the greatest strengths for the intruders who take away the private information for their undue benefits. Hence, it is imperative to understand their mechanism and know ways to defend against these attacks. Some of the ways to defend against these attacks are as follows:
- It is important to use and surf only websites that are encrypted with the “HTTPS-.” This can be found by looking at the address of the website. The presence of HTTPS:// in the address bar means a secure website, which makes it impossible for the hacker to sniff out the data.
- A Virtual Private Network or VPN helps track all your Internet movement over an encrypted network, which is impossible for a hacker to invade and trace. This is extremely important and useful if you are online in public as a VPN conceals your real IP address from hackers who may attempt to track or trace it.
- Network administrators must scan and observe their network’s bandwidth monitoring or device auditing at periodical intervals to detect any doubtful traffic or activity.
Be mindful and aware of every activity that happens in your system to be secure and safe at all times.
Drop your comment