Buzz
Understanding Pharming: How to Prevent It?
What is Pharming?
Pharming involves a dual attack strategy: DNS poisoning and phishing. By leveraging the power of DNS poisoning and phishing, Pharming sets up a seemingly trustworthy trap for users. While phishing relies on baiting users and hoping they take it, Pharming can hijack the entire DNS server and redirect users to a fake website.
So, what is Pharming? To answer that question, we need to dissect the two building blocks of Pharming and understand how they interact to orchestrate a comprehensive Pharming attack.
Decoding DNS Poisoning
DNS poisoning operates by hijacking DNS lookups. When you enter a website address (such as www.facebook.com), your computer needs to convert that address into an IP address. This is because the computer doesn't understand what Facebook is. While URLs make it easy for users to remember website addresses, computers only know and understand the IP address of that website's server. So, to access Facebook, the computer has to translate the URL into an IP address.
To achieve this, the computer queries a DNS server, acting as a URL and IP address directory. The computer uses the DNS server to find the IP address of the URL (www.facebook.com => 157.240.1.35), and then uses it to communicate with Facebook's servers.
When a computer discovers the IP address of a URL, it may record the address in the cache memory. This is done to save time searching for the same IP address and more. In this example, the computer will note that the URL www.facebook.com leads to the address 157.240.1.35 in the cache memory.
DNS poisoning operates in two ways: either by accessing the cache memory on the user's personal computer and altering the IP address to redirect to malicious websites, or by infecting DNS servers to make computers search for 'infected' results. In both cases, the next time users enter 'www.facebook.com' in the browser's address bar, they will load the harmful spoofed IP address.
Unraveling Phishing
DNS poisoning enables attackers to redirect users from a legitimate website to a malicious one, even though users enter the correct website address. However, this is just the initial step; the attacker will then use phishing in conjunction with DNS poisoning to turn those simple redirects into profits.
In this example, the attacker is redirecting users away from Facebook to access a website of their choice. While there are many options for attackers to choose from, in a Pharming attack, the attacker will opt for a website they have pre-designed to closely resemble Facebook. When users enter www.facebook.com into their browser's address bar, DNS poisoning will redirect them to the hacker's fake Facebook.
While on the fraudulent website, users will be prompted to use their credentials to log into Facebook. Users 'believe' this is the 'official' Facebook page and enter their information, which will be 'sent' to hackers to complete the Pharming attack.
How to Prevent Pharming?
Firstly, note that DNS servers are often owned by the ISP (Internet Service Provider) you use. To avoid Pharming attacks on DNS servers, ensure you have chosen a reliable ISP. Trusted ISPs are aware of Pharming and will take measures to protect their servers from infection.
The vulnerability of Pharming when infecting computer files is easily detectable by programs, antivirus software, and anti-malware. Ensure you have installed antivirus or anti-malware software. These programs can detect edits to the computer's cache memory address file and alert you before any damage occurs to your computer.
Even without antivirus software, you can thwart Pharming attacks using your own wits. When visiting popular or secure websites, such as social media or banking sites, you'll see a padlock icon and HTTPS in the URL bar.
This means the website has been verified by a trusted third party to confirm its legitimacy. The site has been issued a certificate, and the website's contact information is encrypted.
Of course, if a Pharming attack has redirected you to a fake page, that website won't provide a certificate to identify it as legitimate. Even if the fake URL looks identical to the real one, it won't have a certificate. When logging into any popular website, ensure it has an HTTPS certificate. If you notice the certificate is 'missing,' be cautious.
With a multi-step process like this, Pharming can be a rather formidable attack. After reading Mytour's article on what is Pharming? How to Prevent Pharming?, you should have gained more information about Pharming, its workings, and how to prevent Pharming. You no longer need to worry about becoming a victim of Pharming.
