Understanding Pharming: A Definition from TechTarget

Pharming is a type of scam where bad software is secretly installed on a computer or server, leading users to fake websites without them knowing. The goal? To trick users into entering personal information on these phony sites. When someone inputs details like credit card numbers or passwords, criminals can use that data for identity theft or worse. Most attacks that result in stolen credentials often start with hacked business emails.

So, how does pharming work? It exploits the Domain Name System (DNS). When users try to visit a website, the DNS translates the domain name, like google.com, into an IP address. If a hacker, or “pharmer,” alters this IP address in the DNS, the computer ends up at a fake site instead of the real one, all without the user noticing.

Types of Pharming Techniques

1. Malware-based Pharming: Here, malware sent through email changes a computer’s local host files. Even if a user types in the correct web address, the modified settings will send them to a fake site. Some software can fix the corruption, but it often returns unless the user changes their browsing habits—like blocking pop-ups or cookies. Installing good cybersecurity software is essential for protection.

2. DNS Cache Poisoning: This technique modifies the DNS table on a server. As users attempt to visit legitimate websites, they get redirected to fraudulent ones. In this case, their personal computer remains unaffected, making it hard to pinpoint the issue since nothing is wrong with their machine.

3. Social Engineering Pharming: Here, criminals impersonate trusted entities and trick users into visiting fake sites through emails or messages. It resembles phishing attacks, as the goal is to get users to click links that lead to scams.

Examples of Pharming Attacks

Some common examples include:

• Credential Theft: Users land on fake banking sites where their usernames and passwords are captured.
• Malicious Software Distribution: Trojans masquerading as legitimate software can modify DNS settings.
• Compromised Social Media Pages: Fake links might appear on what seem to be authentic profiles.
• ISP Attacks: Cybercriminals target internet service providers, redirecting multiple users at once.
• Router Exploitation: Changing router settings can direct all connected devices to malicious sites.

Signs of Pharming

Look for these signs that you might be a victim of pharming:

• Slightly Off URLs: Any discrepancies in website links, logos, or colors could indicate a scam.
• Login Problems: Difficulty accessing familiar accounts or unexpected redirects may signal an attack.
• Rising Alerts: Frequent antivirus alerts about DNS problems or security warnings from ISPs can be a cry for help.
• Insecure Connections: If a website doesn’t use “https” in its URL, exercise caution, as it may be a fake site.

Protecting Against Pharming

To defend yourself against pharming, consider these steps:

• Regular Updates: Keep your operating systems and software current to protect against known vulnerabilities.
• Clear Your Browser Cache: This helps prevent unauthorized access to previously stored data when using a new connection.
• Use Antivirus Software: Solid antivirus and antimalware programs are your first line of defense.
• Opt for HTTPS: Always check for the secure “https” in your web addresses.
• Get a VPN: A virtual private network encrypts your internet connection, keeping your data safe even if DNS settings are compromised.
• Bookmark Sites: Instead of clicking on links in emails or messages, use bookmarks for frequently visited sites.

Pharming vs. Phishing

Pharming is often likened to “phishing without a lure.” Both methods aim to steal information, but they operate differently. Phishing often involves sending deceptive emails to lure individuals into revealing sensitive info, while pharming redirects users to fake sites without needing any action from them.

Notable Pharming Attacks

Several high-profile pharming attacks have occurred over the years:

• Rock Phish Attacks: In the early 2000s, this group successfully redirected users to fake sites targeting banks and e-commerce platforms.
• DNSChanger Malware: This altered DNS settings on infected computers, affecting millions before it was taken down in 2012.
• Brazilian Pharming Campaigns: In 2015, attackers exploited router and DNS vulnerabilities to steal banking credentials from users in Brazil.

Pharming remains a prevalent threat in cyberspace, and staying informed is crucial to protecting your personal information.