Pharming Attack: How attackers use fake websites to steal data

Pharming definition

A pharming attack tries to redirect a website's traffic to a fake website controlled by the attacker, usually for the purpose of collecting sensitive information from victims or installing malware on their machines. Attackers tend to focus on creating look-alike eCommerce and digital banking websites to harvest credentials and payment card information.

How pharming attacks work
Though they share similar goals, pharming uses a different method from phishing. “Pharming attacks are focused on manipulating a system, rather than tricking individuals into going to a dangerous website,” explains David Emm, a principal security researcher at Kaspersky. “When either a phishing or pharming attack is completed by a criminal, they have the same driving factor to get victims onto a corrupt location, but the mechanisms in which this is undertaken are different.”
Pharming attacks involve redirecting user requests by manipulating the Domain Name Service (DNS) protocol and rerouting the target from its intended IP address to one controlled by the hacker. This can be done in two ways.

1. Attackers compromise the victim’s machine and change the local host's file (a local directory of IP addresses) on the device, which then redirects the user the next time they try to access a site (usually disguised to look like the victim’s intended destination). This attack is often preceded with a phishing attack or some other malware deployment method that then manipulates the host file. Routers are also a potential endpoint device targeted in pharming attacks (sometimes known as “drive-by” pharming).
2. Attackers redirect traffic via DNS poisoning by exploiting DNS server vulnerabilities so that the victims are rerouted to the IP address of an attacker-controlled machine. This can be an especially challenging threat as the victim doesn’t have to click on anything or make a mistake to be sent to the faked website. This is sometimes known as a phish without a lure.

“Hacking a Domain Name Server can be more difficult to achieve and is the reason why we do not see these types of attacks as often,” says Emm. “While injecting malware onto an individual’s device restricts damage to just that person, infecting a DNS has the potential to affect all devices that use that server to access web sites and can be extremely damaging.”

Pharming attack prevention
The following best practices will reduce the chances of a successful pharming attack:

1. Teach users about good security hygiene practices, such as how to spot suspicious links to fake websites. For example, invalid or outdated certificates might be a sign of a compromised website, as well as URLs that look similar but aren’t as expected.
2. Patch devices and perform regular virus scans and cache/browser cookie clearances.
3. Fully patch, audit, and monitor DNS servers to reduce the chances of them being exploited.
4. Deploying TLS certificates on enterprise websites to reduce the chance of those sites being spoofed.
5. Require employee machines to be patched and have active endpoint security controls and monitoring.
6. Ensuring strong password security on routers to help prevent drive-by attacks.
7. Set up threat intelligence to monitor for spoof domains similar to your own.
8. Enable two-factor authentication on services to help reduce the impact if user credentials are collected.