Pharming
What is it and how can we defend against it.
Pharming is a type of cyberattack that redirects users from legitimate websites to fraudulent (fake) websites without their knowledge, even if the user types the correct URL into their browser. The goal is to steal sensitive information like login credentials, credit card numbers, or personal data.
Here's how it works:
DNS Poisoning (or DNS Spoofing):
- Attackers corrupt the Domain Name System (DNS) records, which translate website names (like
www.bank.com) into IP addresses. - When a user tries to visit a legitimate site, they are silently redirected to a malicious one that looks identical.
- Attackers corrupt the Domain Name System (DNS) records, which translate website names (like
Hosts File Manipulation:
- On individual computers, attackers can alter the hosts file, which maps domain names to IP addresses.
- This causes the browser to go to a fake site even when the correct URL is entered.
How to Protect Against Pharming:
- Use secure DNS services that offer protection against DNS spoofing.
- Keep your operating system and antivirus software updated.
- Look for HTTPS and valid security certificates on websites.
- Avoid clicking on suspicious links or downloading unknown files.
- Use multi-factor authentication (MFA) for sensitive accounts.