A pharming attack tries to redirect a website's traffic to a fake website controlled by the attacker, usually for the purpose of collecting sensitive information from victims or installing malware on their machines. Attackers tend to focus on creating look-alike ecommerce and digital banking websites to harvest credentials and payment card information.

[ Check out these 11 phishing prevention tips for best technology practices, employee education and social media smarts. | Get the latest from CSO by signing up for our newsletters. ]

These attacks manipulate information on the victim’s machine or compromise the DNS server and rerouting traffic, the latter of which is much harder for users to defend against.

Though they share similar goals, pharming uses a different method from phishing. “Pharming attacks are focused on manipulating a system, rather than tricking individuals into going to a dangerous website,” explains David Emm, principal security researcher at Kaspersky. “When either a phishing or pharming attack is completed by a criminal, they have the same driving factor to get victims onto a corrupt location, but the mechanisms in which this is undertaken are different.”

Pharming attacks involve redirecting user requests by manipulating the Domain Name Service (DNS) protocol and rerouting the target from its intended IP address to one controlled by the hacker. This can be done in two ways.

While DNS servers are harder to compromise because they sit on an organization’s network and behind its defenses, the attack can affect far more victims and offer greater reward for the attackers. Poisoning can also spread to other DNS servers. An internet service provider (ISP) receiving DNS information from a poisoned server can lead to the corrupted DNS entry being cached on the ISP’s servers, spreading it to more routers and devices. This happened by mistake in 2010 when an ISP fetched DNS information from a server behind China’s Great Firewall, which then began to spread China’s blocking of websites such as Twitter to other countries.

“Hacking a Domain Name Server can be more difficult to achieve and is the reason why we do not see these types of attacks as often,” says Emm. “While injecting malware onto an individual’s device restricts damage to just that person, infecting a DNS has the potential to affect all devices that use that server to access web sites and can be extremely damaging.”

The potential harm of a pharming attack depends on the attacker’s objectives. The goal could be to collect financial information to abuse or sell, or to harvest login credentials that could be sold. Sophisticated actors could also use pharming as an early-stage attack to steal credentials and then those credentials to launch further attacks into an organization.

However, the smaller payoff for attacks on individuals and the relative difficulty to exploit at scale means pharming attacks remain rare compared to phishing attacks. “Generally, pharming attacks are less common than phishing because they require significantly more work from the attackers,” says Emm. “Phishing attacks are easily achievable, which is why we see them more regularly.”

In 2019 Kaspersky identified a pharming attack in Venezuela. “The day after the public announcement [by President Juan Guadio asking people to submit details to an aid website], another almost identical website appeared with a very similar domain and structure,” explains Emm. “The two different domains, with different owners, were registered within Venezuela to the same IP address, belonging to the hackers. This meant it didn’t matter whether a volunteer opened a legitimate or fake domain name. Their personal information would be introduced into a fake site regardless.”

Other notable cases include a pharming attack in Brazil, spotted by Proofpoint in 2015, where attackers sent phishing emails to users of UTStarcom or TR-Link home routers pertaining to be from Brazil's largest telecommunications firm. Links in the emails downloaded malware designed to exploit router vulnerabilities and allow attackers to change the router's DNS server settings.

In 2016, Sucuri discovered an attack where attackers redirected visitors to sites that used NameCheap’s FreeDNS via changed DNS settings. Though not recent, an especially large 2007 campaign saw at least 50 financial institutions suffer a pharming attack that constructed for each target fake sites that harvested login credentials and then passed the victim back to the legitimate site.

The following best practices will reduce the chances of a successful pharming attack:

More on phishing:

This story, "Pharming explained: How attackers use fake websites to steal data" was originally published by CSO.