Header Ads

Breaking News

Pharming explained: How attackers use fake websites to steal data

Pharming definition

A pharming attack tries to redirect a website’s traffic to a fake website controlled by the attacker, usually for the purpose of collecting sensitive information from victims or installing malware on their machines. Attackers tend to focus on creating look-alike ecommerce and digital banking websites to harvest credentials and payment card information.

These attacks manipulate information on the victim’s machine or compromise the DNS server and rerouting traffic, the latter of which is much harder for users to defend against.

How pharming attacks work

Though they share similar goals, pharming uses a different method from phishing. “Pharming attacks are focused on manipulating a system, rather than tricking individuals into going to a dangerous website,” explains David Emm, principal security researcher at Kaspersky. “When either a phishing or pharming attack is completed by a criminal, they have the same driving factor to get victims onto a corrupt location, but the mechanisms in which this is undertaken are different.”

Pharming attacks involve redirecting user requests by manipulating the Domain Name Service (DNS) protocol and rerouting the target from its intended IP address to one controlled by the hacker. This can be done in two ways.

  1. Attackers compromise the victim’s machine and change the local hosts file (a local directory of IP addresses) on the device, which then redirects the user the next time they try to access a site (usually disguised to look like the victim’s intended destination). This attack is often preceded with a phishing attack or some other malware deployment method that then manipulates the host file. Routers are also a potential endpoint device targeted in pharming attacks (sometimes known as “drive-by” pharming).
  2. Attackers redirect traffic via DNS poisoning by exploiting DNS server vulnerabilities so that the victims are rerouted to the IP address of an attacker-controlled machine. This can be an especially challenging threat as the victim doesn’t have to click on anything or make a mistake to be sent to the faked website. This is sometimes known as a phish without a lure.

While DNS servers are harder to compromise because they sit on an organization’s network and behind its defenses, the attack can affect far more victims and offer greater reward for the attackers. Poisoning can also spread to other DNS servers. An internet service provider (ISP) receiving DNS information from a poisoned server can lead to the corrupted DNS entry being cached on the ISP’s servers, spreading it to more routers and devices. This happened by mistake in 2010 when an ISP fetched DNS information from a server behind China’s Great Firewall, which then began to spread China’s blocking of websites such as Twitter to other countries.

“Hacking a Domain Name Server can be more difficult to achieve and is the reason why we do not see these types of attacks as often,” says Emm. “While injecting malware onto an individual’s device restricts damage to just that person, infecting a DNS has the potential to affect all devices that use that server to access web sites and can be extremely damaging.”

Copyright © 2020 IDG Communications, Inc.

Source Link

No comments