Practice
1. What is pharming?
You should already be well aware of phishing and the damage it can cause. In phishing, you are spammed with malicious, fraudulent emails asking you to visit fake websites that appear legitimate.
Pharming, on the other hand, poisons a DNS server by injecting false information into it, causing the user's request to be redirected elsewhere. However, your browser will show that you are on the correct website, which makes pharming more dangerous and harder to detect.
[Image: http://2.bp.blogspot.com/_6Y3t2oE/TPcvQI/AAAAAAU4/pyZssYgE/s400/pharming-small.jpg ]
Pharming is derived from phishing. Both use "ph" instead of "f" and are part of computer slang.
2. What is DNS?
The Domain Name System (DNS) is a hierarchical naming system that translates human-readable computer names into IP addresses. For example, www.example.com translates to 192.0.32.10.
[Image: http://1.bp.blogspot.com/_6Y3t2oE/TPfiIGxI/AAAAAAVA/7Ha7ydYY/s400/23D.png ]
3. DNS poisoning:
Pharming attacks do not use any new technique. They use well-known methods of DNS cache poisoning, domain spoofing, and domain hijacking, which have existed for quite a long time.
[Image: http://2.bp.blogspot.com/_6Y3t2oE/TPfjS7wI/AAAAAAVI/ZnmTPkMQ/s400/pharming.gif ]
i. The hacker breaks into the DNS server and changes the IP address for www.nicebank.com. He sets the IP to www.n1cebank.com (the hacker's site).
II. The user wants to go to www.nicebank.com and types the address into the web browser.
III. The user's computer asks the DNS server for the IP address of www.nicebank.com.
IV. Since the DNS server has already been poisoned by the attacker, it returns the IP address of www.n1cebank.com to the user's computer.
v. The user is now tricked into visiting the fake website controlled by the attacker instead of the original website www.nicebank.com.
4. Host redirection:
The hosts file is a computer file used in an operating system to map hostnames to IP addresses. The hosts file is a plain text file traditionally named hosts.
Location: %SystemRoot%\system32\drivers\etc\
[Image: http://3.bp.blogspot.com/_6Y3t2oE/TPRVEfEI/AAAAAAVg/RjkM4x5c/s400/hosts.JPG ]
Add an entry at the bottom where it says: 127.0.0.1 localhost
66.102.9.147 www.myspace.com
This will redirect the user from the myspace website to ip 66.102.9.147, which is the ip for google.com.
In this way, an attacker can manipulate the IP address and lead the victim to any fake website.
5. Preventing pharming:
i. Pharming-conscious websites that use forms to accept passwords or other sensitive information serve the page containing the form itself over HTTPS.
II. If you visit an SSL-supported website, pay attention to this warning window. If you receive it, double-check whether the site you visited matches an earlier session. Check whether the URL matches the one you intended to go to.
[Image: http://3.bp.blogspot.com/_6Y3t2oE/TPfmfWsI/AAAAAAVQ/AmMIGTJk/s400/security-alert.gif ]
III. SpoofStick is a simple browser extension that helps users detect fake websites. This tool is free and installs into your browser. It is available for Firefox and Internet Explorer. For more information, visit Spoofstick.
[Image: http://4.bp.blogspot.com/_6Y3t2oE/TPftwRaI/AAAAAAVo/9phDtSH4/s320/spoofstick.gif ]
Comments