Pharming Attack

On the other hand, most information security pen-testers focus only on the client and server exploits (how to gain shell in a server by interacting with the server directly). They don’t focus on how to exploit the weakest link in the information security chain—the humans (you could own the shell by luring the victim to run the shell for you on his own machine by using any of social engineering techniques). In this tutorial, let’s talk about pharming attack definition and techniques that an attacker can use to successfully such an attack. In the previous articles we have talked about phishing and social engineering techniques. So please refer to these previous articles if you don’t know what phishing is.

In a phishing attack, the attacker will try to trick his victim into visiting a fake website (attacker website) by using any phishing techniques that we have discussed before, but anyone can notice that the URL that he surfing is not the original URL for the website, So it’s so easy for a victim to detect that he is facing a phishing attack attempt by verifying the URL. Therefore, the attackers take the phishing attack to the next level with the pharming attack.

1. What Is a Pharming Attack?

The pharming attack definition, according to Wikipedia: “Pharming is an attacker’s attack intended to redirect a website’s traffic to another, bogus site. Pharming can be conducted either by changing the hosts file on a victim’s computer or by exploitation of a vulnerability in DNS server software. DNS servers are computers responsible for resolving Internet names into their real IP addresses. Compromised DNS servers are sometimes referred to as “poisoned.” Pharming requires unprotected access to target a computer, such as altering a customer’s home computer, rather than a corporate business server. The term “pharming” is a neologism based on the words “farming” and “phishing.” Phishing is a type of social-engineering attack to obtain access credentials, such as user names and passwords. In recent years, both pharming and phishing have been used to gain information for online identity theft. Pharming has become a major concern to businesses hosting ecommerce and online banking websites. Sophisticated measures known as anti-pharming are required to protect against this serious threat. Antivirus software and spyware removal software cannot protect against pharming. A pharming attack will redirect the victim to the fake website (an attacker website) even though the victim enters the correct address for the legitimate website. For Example: The victim intends to access www.twitter.com, so he writes the right URL to the browser, the URL will still be www.twitter.com, but he will surf the fake website instead.

2. Pharming Attack Methods

In this tutorial, we will concentrate on two major methods that we can use for performing a pharming attack: DNS Cache Poisoning The domain name SDNS definition, according to Wikipedia is: A domain name system server translates a human readable domain name (such as example.com) into a numerical IP address that is used to route communications between nodes. Normally if the server doesn’t know a requested translation it will ask another server, and the process continues recursively. To increase performance, a server will typically remember (cache) these translations for a certain amount of time, so that, if it receives another request for the same translation, it can reply without having to ask the other server again.” DNS Cache Poisoning Attack Scenario Here is the attack scenario that an attacker will follow when performing the pharming attack:

An attacker hacks into the DNS server (a cache poisoning attack). The attacker changes the IP address for www.targetsite.com to the IP of www.faketargetsite.com. The victim enters www.targetsite.com in the address bar and the computer asks the DNS server for the IP address of www.targetsite.com. Because the DNS server has already been poisoned by the attacker, it returns the IP address of www.faketargetsite.com. The victim will believe it is the original website, but it is the fake one.

Hosts File Modification The hosts file definition, according to Wikipedia, is: The hosts file is a computer file used by an operating system to map hostnames to IP addresses. The hosts file is a plain text file, and is conventionally named hosts.” The hosts file is a plain text file that contains lines of text consisting of an IP address followed by one or more host names where each field is separated by white space. An IP address may refer to multiple host names (see the following example), and a host name may be mapped to both IPv4 and IPv6 IP addresses (see the following example). By the way, you can leave comments in the hosts file by using the hash character (#), which indicates this line is a comment. Here is an example of hosts file content: [plain] # This is an example of the hosts file 127.0.0.1 localhost loopback ::1 localhost [/plain] The hosts file location differs from one operating system to another; for example, in the Linux operating system, it’s located in /etc/hosts” and in the windows operating system it’s located in “%SystemRoot%system32driversetchosts“. Hosts file Modification Attack Scenario There are many ways to replace the victim hosts file with the attacker (modified) hosts file. The attacker can do this either by using a SFX archive or by using a batch file. The SFX definition, according to Wikipedia, is: A self-extracting archive (SFX) is a computer application which contains a file archive, as well as programming to extract this information. Such file archives do not require a second executable file or program to extract from the archive, as archive files usually require. The files in an archive can thus be extracted by anyone, whether they possess the appropriate decompression program or not, as long as the program can run on their computer platform.” The batch file definition, according to Wikipedia, is: A batch file is the name given to a type of script file, a text file containing a series of commands to be executed by the command interpreter in windows operating systems.” In this tutorial, we will use the second way, which is creating a batch file. Here is the batch file content that we will use to modify the victim hosts file which will redirect www.facebook.com to the fake website (attacker website): [plain] @echo off echo X.X.X.X www.facebook.com » C:windowssystem32driversetchosts exit [/plain] Replace “X.X.X.X” with IP address of the attacker website and, finally, save it as Something.bat. To make it seem more like a legitimate file, we can use any binder software, which will help us to hide the malicious file in another file with any extension. Now we will send the file to our victim via email or upload the file and ask our victim to download and run it, once it has been run, his hosts file will be modified. Now when the victim tries to access facebook.com, he will access the fake website and the URL won’t change. Conclusion A pharming attack will help the attackers perform their phishing attack scenarios in a more sophisticated way to make it reliable and harder to discover that you’re under attack. References

1. What Is a Pharming Attack?#

2. Pharming Attack Methods#

1. What Is a Pharming Attack?

2. Pharming Attack Methods