What is sniffing and spoofing?

Sniffing is the process in which all the data packets passing in the network are monitored. … Sniffers can be hardware or software installed on the system. Spoofing is the process in which an intruder introduces fake traffic and pretends to be someone else (legal source or the legitimate entity.

From an information security perspective, sniffing refers to tapping the traffic or routing the traffic to a target where it can be captured, analyzed and monitored. Sniffing is usually performed to analyze the network usage, troubleshooting network issues, monitoring the session for development and testing purpose.

SNIFFING

The practice or technique of monitoring, gathering, capturing, and logging some or all data packets passing through a given computer network is called sniffing or packet sniffing.  A packet sniffer is composed of two parts namely; a network adapter and software that is used by a network to observe or troubleshoot network traffic.

Attackers use these sniffers to seize data packets that contain valuable information and analyze the network traffic. Sniffing is categorized into active sniffing and passive sniffing. In Active sniffing, there is the constant activity by the attacker to obtain information and sniff the traffic from the switch network. In passive sniffing, the attacker is hidden and sniffs through the hub.

SPOOFING

Any kind of behavior where an attacker mask as an authentic user or a device to secure something beneficial or crucial information for their gain is called spoofing. There are various kinds of spoofing such as website spoofing, E-mail spoofing, and IP spoofing. Other common methods include ARP spoofing attacks and DNS server spoofing attacks.

An E-mail spoofing targets the user while an IP spoofing is predominantly targeted at a network. 

In an IP spoofing attack, the attacker attempts to obtain illicit and illegal access to a network through messages with a bogus or spoofed IP address to deceive and show it off as a message from a trusted source. This is achieved by using a genuine host’s IP address and varying the packet headers led from their personal system to mimic it as an original and a trusted computer’s IP address.

B) DIFFERENCE BETWEEN SNIFFING AND SPOOFING

Now that we have understood what is sniffing and spoofing, the spoofing and sniffing definition, let’s now compare packet sniffing and packet spoofing. 

• During the process of sniffing, the networks’ data traffic is the main target of the attacker who captures data packets that flows across a computer network using packet sniffers. 

Whereas in spoofing, the attacker rip-offs the authorizations of a user and deploys those details in a system as an authentic user to unveil attacks against network hosts, take data, disburse malware, or circumvent access controls.

• In spoofing, the attackers use another person’s IP address to produce TCP/IP. In packet sniffing, a sniffing program is on a part between two interactive endpoints where the attacker pretends to be one end of the connection to the target and snoop on files delivered between the two endpoints.

The software or method depleted to achieve this is called a packet sniffer, which is a function that sniffs without altering the network’s packets in any way.

• In short, packet sniffing means eavesdropping on other people’s conversations.  Packet spoofing refers to dynamically presenting phony network traffic impersonating to be someone else.
• In packet sniffing, an attacker can’t cause any mutilation to the system per se and hence is a passive attack. Packet spoofing is an active attack where it is possible for an attacker to introduce a harmful program to taint the victim’s system.
• The attackers get access to the device or system through which the traffic is directed in packet and packet spoofing, the attack is done by transferring packets with incorrect source address i.e., modifying routing tables.
• A popular method to defend sniffing is by way of encryption while the top method to tackle spoofing is by use of digital signatures.

The Difference Between Sniffing and Spoofing is that,In sniffing, the attacker listens into a networks’ data traffic and captures data packets using packet sniffers. In spoofing, the attacker steals the credentials of a user and uses them in a system as a legitimate user.

SNIFFING AND SPOOFING TOOLS

Tools	Description
bettercap	It works like a Swiss army knife for network attacks and monitoring. It is a tool for network capture, analysis, and MITM attacks.
Burp Suite	Burp Suit is a platform for security testing of web applications.
DNSChef	It is a highly configurable DNS proxy for Penetration Testers and Malware Analyst.
fiked	It is a Cisco VPN attack tool that is used to attack insecure Cisco VPN PSK+XAUTH based IPsec authentication setups, which are called as semi MitM attack.
hamster-sidejack	It is a side-jacking tool that acts like a proxy server that replaces your cookies with session cookies stolen from somebody else.
HexInject	It is a hexadecimal packet injector or sniffer which is capable of reading, intercepting, and modifying network traffic in a transparent manner.
iaxflood	It is a VOIP flooder tool.
inviteflood	It is a SIP/SDP INVITE message flooding over UDP/IP.
iSMTP	This tool tests for SMTP user enumeration, internal spoofing, and relay.
isr-evilgrade	It is an Evilgrade framework that allows the user to take advantage of poor upgrade implementations by injecting fake updates.
mitmproxy	It is an HTTP proxy that provides a console interface that allows traffic flows to be inspected and edited.
ohrwurn	It is an RTP fuzzer that reads SIP messages to get information about the RTP port numbers.
protos-sip	It evaluates the implementation level security and robustness of Session Initiation Protocol implementation.
rebind	It is a DNS rebinding tool that implements the multiple A record DNS rebinding attack.
responder	It is an LLMNR and NBT-NS responder which answers to specific NBT-NS queries based on their name suffix.
rtpbreak	It detects, reconstructs and analyses RTP sessions
rtpinsertsound	This tool is used to insert audio into a specified stream.
sctpscan	It is a tool to mix pre-recorded audio in real-time with the audio in the specified target audio stream.
SIPArmyKnife	It is a fuzzer that searches for cross site scripting SQL injection, log injection, format strings, buffer overflow, etc
SIPp	It is a traffic generator for the SIP protocol.
SIPVicious	It is an online password cracker that is used to audit SIP based VoIP systems.
Sniffjoke	It is a transparent TCP connection scrambler that delays, modify and inject fake packets inside your transmission.
SSLsplit	It is a transparent and scalable SSL/ TLS interception used for man-in-the -middle attacks against SSL/TLS encrypted network connections.
sslstrip	It is an SSL/TLS man-in-the-middle attack tool that is used to hijack HTTP traffic on a network transparently.
THC-IPV6	It converts a MAC or IPv4 address to an IPv6 address.
VoIPHopper	It mimics the behaviour of IP phones to rapidly run a VLAN hop into the voice VLAN on specific Ethernet switches.
WebScarab	It is a web application review tool used to expose the working of an HTTP based application.
Wifi Honey	It creates five monitor mode interfaces, in which four are used as access points, and the fifth is used for airodump-ng.
Wireshark	It is a network protocol/traffic analyser. It allows us to monitor our network at a microscopic level.
xspy	It is a keystroke sniffer that sniffs keystrokes on remote or local X-Windows servers.
zaproxy	It is a penetration testing tool for finding vulnerabilities in web applications.

SNIFFING AND SPOOFING PREVENTION

spoofing prevention

1. Use authentication based on key exchange between the machines on your network; something like IPsec will significantly cut down on the risk of spoofing.
2. Use an access control list to deny private IP addresses on your downstream interface.
3. Implement filtering of both inbound and outbound traffic.
4. Configure your routers and switches if they support such configuration, to reject packets originating from outside your local network that claim to originate from within.
5. Enable encryption sessions on your router so that trusted hosts that are outside your network can securely communicate with your local hosts.

Precautionary measures against Sniffing attacks

1. Connect to trusted networks: Do you trust a free Wi-Fi offered by the coffee shop next door? Connecting to any public network will have a risk that the traffic might be sniffed. Attackers choose these public places exploiting the user’s lack of knowledge. Public networks are setup and then may or may not be monitored for any intrusions or bugs. Attackers can either sniff that network or create a new network of their own with similar names so that the users get tricked into joining that network. An attacker sitting at an airport can create a Wi-Fi with the name of “Free Airport Wi-Fi” and the nearby users may connect to it sending all the data through the attackers’ sniffer node. The word of caution here is that you should only connect to the network you trust – home network, office network etc.   
2. Encrypt! Encrypt! Encrypt! : Encrypt all the traffic that leaves your system. This will ensure that even if the traffic is being sniffed, the attacker will not be able to make sense of it. One thing here to be noted is that security work on defense in depth principle. Encrypting he data does not mean that now everything is safe. The attacker might be able to capture a lot of data and run crypto attacks to get something out of it. Use of secured protocols ensures that the traffic is encrypted and renders security for the traffic. Websites using https protocol are more secure than the ones that use HTTP – how is that achieved? Encryption.    
3. Network scanning and monitoring: Networks must be scanned for any kind of intrusion attempt or rogue devices that may be setup in span mode to capture traffic. Network admins must monitor the network as well so as to ensure the device hygiene. IT team can use various techniques to determine the presence of sniffers in the network. Bandwidth monitoring is one, an audit of devices which are set to promiscuous mode etc.

CONCLUSION

In both the sniffing and spoofing attacks, the victims or the targeted persons are completely unaware of the fact that their data and exchanges have been intercepted and conceded. This becomes one of the greatest strengths for the intruders who take away the private information for their undue benefits. Hence, it is imperative to understand their mechanism and know ways to defend against these attacks. Some of the ways to defend against these attacks are as follows:

• It is important to use and surf only websites that are encrypted with the “HTTPS-.” This can be found by looking at the address of the website. The presence of HTTPS:// in the address bar means a secure website, which makes it impossible for the hacker to sniff out the data.
• A Virtual Private Network or VPN helps track all your Internet movement over an encrypted network, which is impossible for a hacker to invade and trace. This is extremely important and useful if you are online in public as a VPN conceals your real IP address from hackers who may attempt to track or trace it.
• Network administrators must scan and observe their network’s bandwidth monitoring or device auditing at periodical intervals to detect any doubtful traffic or activity. 

Be mindful and aware of every activity that happens in your system to be secure and safe at all times.

Drop your comment