Pharming explained: How attackers use fake websites to steal data

Pharming definition

A pharming attack tries to redirect a website's traffic to a fake website controlled by the attacker, usually for the purpose of collecting sensitive information from victims or installing malware on their machines. Attackers tend to focus on creating look-alike ecommerce and digital banking websites to harvest credentials and payment card information.

These attacks manipulate information on the victim’s machine or compromise the DNS server and rerouting traffic, the latter of which is much harder for users to defend against.

How pharming attacks work

Though they share similar goals, pharming uses a different method from phishing. “Pharming attacks are focused on manipulating a system, rather than tricking individuals into going to a dangerous website,” explains David Emm, principal security researcher at Kaspersky. “When either a phishing or pharming attack is completed by a criminal, they have the same driving factor to get victims onto a corrupt location, but the mechanisms in which this is undertaken are different.”

Pharming attacks involve redirecting user requests by manipulating the Domain Name Service (DNS) protocol and rerouting the target from its intended IP address to one controlled by the hacker. This can be done in two ways.

1. Attackers compromise the victim’s machine and change the local hosts file (a local directory of IP addresses) on the device, which then redirects the user the next time they try to access a site (usually disguised to look like the victim’s intended destination). This attack is often preceded with a phishing attack or some other malware deployment method that then manipulates the host file. Routers are also a potential endpoint device targeted in pharming attacks (sometimes known as “drive-by” pharming).
2. Attackers redirect traffic via DNS poisoning by exploiting DNS server vulnerabilities so that the victims are rerouted to the IP address of an attacker-controlled machine. This can be an especially challenging threat as the victim doesn’t have to click on anything or make a mistake to be sent to the faked website. This is sometimes known as a phish without a lure.

While DNS servers are harder to compromise because they sit on an organization’s network and behind its defenses, the attack can affect far more victims and offer greater reward for the attackers. Poisoning can also spread to other DNS servers. An internet service provider (ISP) receiving DNS information from a poisoned server can lead to the corrupted DNS entry being cached on the ISP’s servers, spreading it to more routers and devices. This happened by mistake in 2010 when an ISP fetched DNS information from a server behind China’s Great Firewall, which then began to spread China’s blocking of websites such as Twitter to other countries.

“Hacking a Domain Name Server can be more difficult to achieve and is the reason why we do not see these types of attacks as often,” says Emm. “While injecting malware onto an individual’s device restricts damage to just that person, infecting a DNS has the potential to affect all devices that use that server to access web sites and can be extremely damaging.”

How common are pharming attacks?

The potential harm of a pharming attack depends on the attacker’s objectives. The goal could be to collect financial information to abuse or sell, or to harvest login credentials that could be sold. Sophisticated actors could also use pharming as an early-stage attack to steal credentials and then those credentials to launch further attacks into an organization.

However, the smaller payoff for attacks on individuals and the relative difficulty to exploit at scale means pharming attacks remain rare compared to phishing attacks. “Generally, pharming attacks are less common than phishing because they require significantly more work from the attackers,” says Emm. “Phishing attacks are easily achievable, which is why we see them more regularly.”

In 2019 Kaspersky identified a pharming attack in Venezuela. “The day after the public announcement [by President Juan Guadio asking people to submit details to an aid website], another almost identical website appeared with a very similar domain and structure,” explains Emm. “The two different domains, with different owners, were registered within Venezuela to the same IP address, belonging to the hackers. This meant it didn’t matter whether a volunteer opened a legitimate or fake domain name. Their personal information would be introduced into a fake site regardless.”

Other notable cases include a pharming attack in Brazil, spotted by Proofpoint in 2015, where attackers sent phishing emails to users of UTStarcom or TR-Link home routers pertaining to be from Brazil's largest telecommunications firm. Links in the emails downloaded malware designed to exploit router vulnerabilities and allow attackers to change the router's DNS server settings.

In 2016, Sucuri discovered an attack where attackers redirected visitors to sites that used NameCheap’s FreeDNS via changed DNS settings. Though not recent, an especially large 2007 campaign saw at least 50 financial institutions suffer a pharming attack that constructed for each target fake sites that harvested login credentials and then passed the victim back to the legitimate site.

Pharming attack prevention

The following best practices will reduce the chances of a successful pharming attack:

• Teach users about good security hygiene practices, such as how to spot suspicious links to fake websites. For example, invalid or outdated certificates might be a sign of a compromised website, as well as URLs that look similar but aren’t as expected.
• Patch devices and perform regular virus scans and cache/browser cookie clearances.
• Fully patch, audit and monitor DNS servers to reduce the chances of them being exploited.
• Deploying TLS certificates on enterprise websites to reduce the chance of those sites being spoofed.
• Require employee machines to be patched and have active endpoint security controls and monitoring.
• Ensuring strong password security on routers to help prevent drive-by attacks.
• Set up threat intelligence to monitor for spoof domains similar to your own.
• Enable two-factor authentication on services to help reduce the impact if user credentials are collected.

Comments are closed.