2 cissp ® Official Study Guide Eighth Edition

Spoofing Attacks
Spoofing
(also known as masquerading) is pretending to be something, or someone, else. 
There is a wide variety of spoofing attacks. As an example, an attacker can use someone 
else’s credentials to enter a building or access an IT system. Some applications spoof legiti-
mate logon screens. One attack brought up a logon screen that looked exactly like the oper-
ating system logon screen. When the user entered credentials, the fake application captured 
the user’s credentials and the attacker used them later. Some phishing attacks (described 
later in this section) mimic this with bogus websites.
In an IP spoofing attack, attackers replace a valid source IP address with a false one 
to hide their identity or to impersonate a trusted system. Other types of spoofing used in 
access control attacks include email spoofing and phone number spoofing.
Email Spoofing
Spammers commonly spoof the email address in the From field to make 
an email appear to come from another source. Phishing attacks often do this to trick users 
into thinking the email is coming from a trusted source. The Reply To field can be a differ-
ent email address and email programs typically don’t display this until a user replies to the 
email. By this time, they often ignore or don’t notice it.
Phone Number Spoofing
Caller ID services allow users to identify the phone number 
of any caller. Phone number spoofing allows a caller to replace this number with another 
one, which is a common technique on Voice over Internet Protocol (VoIP) systems. One 
technique attackers have been using recently is to replace the actual calling number with a 
phone number that includes the same area code as the called number. This makes it look 
like it’s a local call.

---

Understanding Access Control Attacks