Pharming, a sophisticated cyber threat born from the fusion of "phishing" and "farming". What is it?

Introduction

Pharming, a sophisticated cyber threat born from the fusion of "phishing" and "farming". What exactly is pharming? It's a form of social engineering cyberattack where malevolent actors manipulate a website's traffic, leading unsuspecting users to a fraudulent site.

In essence, these "spoofed" sites are designed to trick individuals into divulging their personally identifiable information (PII) and login credentials. Passwords, social security numbers, account details—the targets are extensive. The objective? Identity theft or the installation of pharming malware on victims' computers.

This cyber menace is particularly adept at targeting websites in the financial sector, including banks, online payment platforms, and e-commerce sites. Pharmers, as they are called, have identity theft as their ultimate goal.

Pharming: A sophisticated and dangerous cocktail

Pharming derives its name from the fusion of the terms "Phishing" and "Farming", two well-known techniques in the field of cyber attacks. While Phishing involves deceiving users to obtain their sensitive information, Farming focuses on manipulating Domain Name Systems (DNS) to redirect traffic to malicious sites. Pharming combines these approaches, creating a formidable hybrid threat.

The objective of Pharming is to obtain the Personally Identifiable Information (PII) of the user

Unlike other attacks that may have diverse objectives, Pharming has a clear goal: to prompt users to disclose their Personally Identifiable Information (PII). This information includes data such as names, addresses, social security numbers, and other personal details that can be exploited for malicious purposes.

Mechanisms

DNS pharming

Attackers exploit vulnerabilities in DNS servers to redirect traffic to fraudulent sites. This is done by altering the DNS records of a legitimate site, leading users to interact with a false and unsuspecting platform.

Amongst others, here are various approaches hackers are using to exploit DNS vulnerabilities:

• DNS enumeration: Hackers often begin by gathering information about the target's DNS infrastructure. This includes identifying the domain registrar, authoritative name servers, and associated records.
• Vulnerability scanning: Hackers use vulnerability scanners to identify potential weaknesses in DNS servers. These tools help discover outdated software, misconfigurations, or known vulnerabilities that could be exploited.
• DNS zone transfer: Performing a DNS zone transfer is a common practice to identify additional subdomains and gather more information about the target's DNS configuration. Hackers use this information to gather more details about the DNS records.
• DNS spoofing and cache poisoning: Hackers may use of DNS spoofing attacks on DNS servers. This involves sending false DNS responses to redirect traffic to fraudulent sites. Cache poisoning tests aim to manipulate the DNS cache and redirect users to malicious sites.
• DNSSEC evaluation: Hackers evaluate the implementation of DNS Security Extensions (DNSSEC) to check if the DNS data can be tampered with. They check for DNSSEC configuration and verify if DNS-related attacks can be performed.
• DNS firewall and filtering bypass: Hackers explore ways to bypass DNS firewalls and filtering mechanisms. This involves testing the effectiveness of security measures in place.

Use of malicious software

Pharming can also be executed through malicious software. These programs infect users' systems, altering the host files to redirect traffic to fraudulent sites. This can mislead users into thinking they are interacting with trusted sites.

Consequences

The consequences of a successful Pharming attack are significant. The disclosure of Personally Identifiable Information (PII) can lead to identity theft, financial fraud, and other criminal activities exploiting users' sensitive data.

Preventive measures

User awareness

Educating users about the risks associated with Pharming is crucial. By recognizing the signs of a potential attack, users can be more vigilant and avoid falling into the trap.

Use of reliable security solutions

Installing antivirus software, robust firewalls, and advanced scanning solutions helps detect and block Pharming attacks, thereby enhancing user security.

SSL certificates verification

Checking SSL certificates when accessing sensitive sites provides an additional layer of security by confirming the authenticity of a connection.

Use of serious blocklists to filter phishing domain and botnets' IP addresses

Blocklists, also known as blacklists, are datasets used in various contexts to block or restrict access to specific elements. These lists typically contain identifiers, IP addresses, domains, domain names, digital signatures, or other information that is deemed undesirable, malicious, or unauthorized.

In the field of cybersecurity, blocklists are frequently used to preventivly block access to IP addresses or domains linked with known threats, such as malware attacks, botnets, spam, or other malicious online activities. Firewalls and intrusion prevention systems may utilize blocklists to impede traffic originating from or destined for these potential sources of threats. These security measures help enhance the overall resilience of computer networks and systems by preventing unauthorized or harmful entities from gaining access.

In the context of combating unwanted email (Spam), blocklists are also useful. Email servers can reference blocklists to check whether the sender of a particular email is notorious for sending unwanted messages. If so, the email may be blocked or flagged as spam. This use of blocklists in email filtering helps in reducing the influx of unwanted and potentially harmful messages, contributing to a more secure and streamlined email communication.

Conclusion

Pharming, a clever amalgamation of Phishing and Farming, poses a serious threat in the cybersecurity landscape. Its clear objective of compromising Personally Identifiable Information (PII) makes it a major concern. By understanding its sophisticated mechanisms and implementing preventive measures, organizations can bolster their security stance against this insidious alliance. Stay informed, remain vigilant, and safeguard your valuable data against such attacks. The continuous awareness of evolving cyber threats, coupled with proactive security measures, is crucial in mitigating the risks associated with Pharming and ensuring the protection of sensitive information.

Learn more on how LetzRelay-MX can help your organization be secured with Internet inbound emails.