Editing Pharming (section)

== Vulnerabilities ==
{{unsourced section|date=January 2025}}
While malicious domain-name resolution can result from compromises in the large numbers of trusted nodes from a name lookup, the most vulnerable points of compromise are near the leaves of the Internet. For instance, incorrect entries in a desktop computer's ''[[hosts file]]'', which circumvents name lookup with its own local name to IP address mapping, is a popular target for malware. Once rewritten, a legitimate request for a sensitive website can direct the user to a fraudulent copy. Personal computers such as [[Desktop computer|desktops]] and [[laptop]]s are often better targets for pharming because they receive poorer administration than most Internet servers.

More worrisome than host-file attacks is the compromise of a local [[network router]]. Since most routers specify a trusted DNS to clients as they join the network, misinformation here will spoil lookups for the entire [[local area network|LAN]]. Unlike host-file rewrites, local-router compromise is difficult to detect. Routers can pass bad DNS information in two ways: misconfiguration of existing settings or wholesale rewrite of [[embedded software]] (aka [[firmware]]). Many routers allow the administrator to specify a particular, trusted DNS in place of the one suggested by an upstream node (e.g., the [[Internet Service Provider|ISP]]). An attacker could specify a DNS server under his control instead of a legitimate one. All subsequent resolutions would go through the bad server.

Alternatively, many routers have the ability to replace their [[firmware]] (i.e. the internal software that executes the device's more complex services). Like malware on desktop systems, a firmware replacement can be very difficult to detect. A stealthy implementation will appear to behave the same as the manufacturer's firmware; the administration page will look the same, settings will appear correct, etc. This approach, if well executed, could make it difficult for network administrators to discover the reconfiguration, if the device appears to be configured as the administrators intend but actually redirects DNS traffic in the background. Pharming is only one of many attacks that malicious firmware can mount; others include eavesdropping, active [[man in the middle attack]]s, and traffic logging. Like misconfiguration, the entire LAN is subject to these actions.

By themselves, these pharming approaches have only academic interest. However, the ubiquity of consumer grade [[wireless router]]s presents a massive [[vulnerability (computing)|vulnerability]]. Administrative access can be available wirelessly on most of these devices. Moreover, since these routers often work with their default settings, administrative passwords are commonly unchanged. Even when altered, many are guessed quickly through [[dictionary attack]]s, since most consumer grade routers don't introduce timing penalties for incorrect login attempts. Once administrative access is granted, all of the router's settings including the firmware itself may be altered. These attacks are difficult to trace because they occur outside the home or small office and outside the Internet.