Web Spoofing: An Internet Con Game

Get BibTex-formatted data

Author

Edward W. Felten,Dirk Balfanz,Drew Dean,Dan S. Wallach

Entry type

techreport

Abstract

This paper describes an Internet security attack that could endanger the privacy of World Wide Web users and the integrity of their data. The attack can be carried out on today's systems endangering users of the most common Web browsers, including Netscape Navigator and Microsoft Internet Explorer. Web spoofing allows an attacker to create a "shadow copy" of the entire World Wide Web. Accesses to the shadow Web are funneled through the attackers machine, allowing the attacker to monitor all of the victim's activities including any passwords or account numbers the victim enters. The attacker can also cause false or misleading data to be sent to Web servers in the victim's name, or to the victim in the name of any Web server. In short, the attacker observes and controls everything the victim does on the Web. We have implemented a demonstration version of this attack.

Date

1996

URL

http:// http://www.csl.sri.com/~ddean/papers/spoofing.pdf

Institution

Princeton University

Key alpha

Felten

Number

540-96

Publication Date

2001-01-01

BibTex-formatted data

To refer to this entry, you may select and copy the text below and paste it into your BibTex document. Note that the text may not contain all macros that BibTex supports.

@Techreport{ Felten,
	title = "Web Spoofing: An Internet Con Game",
	author = "Edward W. Felten,Dirk Balfanz,Drew Dean,Dan S. Wallach",
	year = "1996",
	institution = "Princeton University",
	number = "540-96",
	abstract = "This paper describes an Internet security attack that could endanger the
privacy of World Wide Web users and the integrity of their data. The attack
can be carried out on today's systems endangering users of the most common
Web browsers, including Netscape Navigator and Microsoft Internet Explorer.
Web spoofing allows an attacker to create a "shadow copy" of the entire
World Wide Web. Accesses to the shadow Web are funneled through the
attackers machine, allowing the attacker to monitor all of the victim's
activities including any passwords or account numbers the victim enters.
The attacker can also cause false or misleading data to be sent to Web
servers in the victim's name, or to the victim in the name of any Web server.
In short, the attacker observes and controls everything the victim does on
the Web.
We have implemented a demonstration version of this attack.",
	url = " http://www.csl.sri.com/~ddean/papers/spoofing.pdf",
}