| Name |
Pharming |
|
| Likelyhood of attack |
Typical severity |
| High |
Very High |
|
| Summary |
A pharming attack occurs when the victim is fooled into entering sensitive data into supposedly trusted locations, such as an online bank site or a trading platform. An attacker can impersonate these supposedly trusted sites and have the victim be directed to their site rather than the originally intended one. Pharming does not require script injection or clicking on malicious links for the attack to succeed. |
| Prerequisites |
Vulnerable DNS software or improperly protected hosts file or router that can be poisoned A website that handles sensitive information but does not use a secure connection and a certificate that is valid is also prone to pharming |
| Execution Flow |
| Step |
Phase |
Description |
Techniques |
| 1 |
Exploit |
Attacker sets up a system mocking the one trusted by the users. This is usually a website that requires or handles sensitive information. |
|
| 2 |
Exploit |
The attacker then poisons the resolver for the targeted site. This is achieved by poisoning the DNS server, or the local hosts file, that directs the user to the original website |
|
| 3 |
Exploit |
When the victim requests the URL for the site, the poisoned records direct the victim to the attackers' system rather than the original one. |
|
| 4 |
Exploit |
Because of the identical nature of the original site and the attacker controlled one, and the fact that the URL is still the original one, the victim trusts the website reached and the attacker can now "farm" sensitive information such as credentials or account numbers. |
|
|
| Solutions | All sensitive information must be handled over a secure connection. Known vulnerabilities in DNS or router software or in operating systems must be patched as soon as a fix has been released and tested. End users must ensure that they provide sensitive information only to websites that they trust, over a secure connection with a valid certificate issued by a well-known certificate authority. |
| Related Weaknesses |
|
CWE ID
|
Description
|
| CWE-346 |
Origin Validation Error |
| CWE-350 |
Reliance on Reverse DNS Resolution for a Security-Critical Action |
|
| Related CAPECS |
|
CAPEC ID
|
Description
|
| CAPEC-151 |
Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. Alternatively, an adversary may intercept a message from a legitimate sender and attempt to make it look like the message comes from them without changing its content. The latter form of this attack can be used to hijack credentials from legitimate users. Identity Spoofing attacks need not be limited to transmitted messages - any resource that is associated with an identity (for example, a file with a signature) can be the target of an attack where the adversary attempts to change the apparent identity. This attack differs from Content Spoofing attacks where the adversary does not wish to change the apparent identity of the message but instead wishes to change what the message says. In an Identity Spoofing attack, the adversary is attempting to change the identity of the content. |
|