- [Instructor] In this segment, we're going
to focus in on phone and text spoofing
and how it can be used for pretexting and impersonation.
Pretexting being a fabricated scenario.
Impersonation, also referred to as spoofing,
is pretending to be someone else.
Well, to make these type of attacks very effective
it's critical that the attackers
have good supporting collateral.
So in this segment, we're gonna take a look
at how easy it is to display a caller ID number
or a text origination number of the attacker's choice
to immediately establish trust with the intended victim.
So we're gonna go to a site called spoofcard.com.
Now, please note, I am not in any way suggesting
that this is a malicious or a nefarious service.
There's really very legitimate uses
for services like this, specifically protecting privacy.
For example, perhaps you're a physician on call,
you're returning a patient's call,
you're using your private cell number,
but you don't want that number to show up on the caller id.
So instead, you can put an alternate number.
Now, in the terms and conditions of SpoofCard,
they are very, very clear that this service is not
to be used for any fraudulent or illegal purposes.
But you can imagine how technology like this can be misused.
The attacker controls a display caller ID number,
perhaps displaying a local number,
a recognizable number or a trusted number.
And there's more, there's an option
to send the call straight to voicemail,
allowing the attacker to set up a scenario
that they can build upon, perhaps leaving multiple messages
and/or request a call back at a different number,
maybe even an 800 number.
Another option is to disguise the caller's voice
as a man or as a woman, or include specific types
of background noises.
And the same type of technology can and is used
for texting to disguise the text origination number
and to allow texts to be sent back
and forth from that number.
Really, really enhancing legitimacy.
You know, over the years we've all become inundated
with phishing emails, you know, and we've become jaded
and generally pretty good at ignoring them.
But, you know, it's quite the opposite
with phone and with text.
Because those feel more personal, we're inclined
to be trusting, or at the very least curious.
You know, I think it is so important
to demonstrate this type of technology
to our user communities to enhance their awareness.
And I guarantee when you show them this,
it will absolutely be an aha moment for them.
And that my friend, is a closer look
at phone and text spoofing.