What is Device Impersonation?

Device impersonation is a broad term that includes attacks where a bad actor pretends to operate a legitimate device that was previously authorized to work with a system.

Depending on the defenses deployed on the system’s server side, impersonating a device can range from trivial (such as spoofing the device ID) to quite complex (spoofing device metadata, replicating files, recreating security keys etc.).

To execute a successful attack, the bad actor has to perform the three steps: reconnaissance, data theft, and data reuse.

At the reconnaissance stage, an attacker could resort to observation and reverse engineering to understand how devices are identified on the system and what it takes to pretend to operate from a legitimate device. Reverse engineering protection is outside of the scope of this work, as a thorough protection is implemented in Guardsquare products. Contact us to learn more.

At the data theft stage, the attacker could use a range of methods, some of the most popular examples include:

• Gaining temporary physical access to the device
• Deploying malware that would collect and exfiltrate the data necessary to identify the device

Finally, the reuse stage happens when the attacker deploys the stolen device information on a different device or simulates the transmission of identifying information through custom-built software. At this stage, the attacker’s software can successfully impersonate operating from the victim’s device and gain access to the victim’s digital assets.