Editing Pharming

{{Short description|Form of cyberattack}}
{{hatnote group|
{{about|a kind of cyberattack|other uses|Pharming (genetics)|and|Pharming party}}
{{distinguish|Farming}}
}}
{{More citations needed|date=August 2024}}
'''Pharming''' is a [[cyberattack]] intended to redirect a [[website]]'s traffic to another, fake site by installing a malicious program on the victim's computer in order to gain access to it.{{citation needed|date=November 2021}} Pharming can be conducted either by changing the [[hosts file]] on a victim's computer or by [[Exploit (computer security)|exploitation]] of a [[vulnerability (computing)|vulnerability]] in [[Domain name system|DNS server]] [[software]]. DNS servers are computers responsible for resolving Internet names into their real [[IP address]]es. Compromised DNS servers are sometimes referred to as [[DNS spoofing|"poisoned"]]. Pharming requires unprotected access to target a computer, such as altering a customer's home computer, rather than a corporate business server.{{citation needed|date=November 2021}}

The term "pharming" is a [[neologism]] based on the words "farming" and "[[phishing]]". Phishing is a type of [[social engineering (computer security)|social-engineering]] attack to obtain [[Authentication|access credentials]], such as [[user name]]s and [[password]]s. In recent years, both pharming and phishing have been used to gain information for [[online identity theft]]. Pharming has become of major concern to businesses hosting [[ecommerce]] and [[online banking]] websites. Sophisticated measures known as [[anti-pharming]] are required to protect against this serious [[threat (computer)|threat]]. [[Antivirus software]] and [[spyware removal software]] cannot protect against pharming.

== Vulnerabilities ==
{{unsourced section|date=January 2025}}
While malicious domain-name resolution can result from compromises in the large numbers of trusted nodes from a name lookup, the most vulnerable points of compromise are near the leaves of the Internet. For instance, incorrect entries in a desktop computer's ''[[hosts file]]'', which circumvents name lookup with its own local name to IP address mapping, is a popular target for malware. Once rewritten, a legitimate request for a sensitive website can direct the user to a fraudulent copy. Personal computers such as [[Desktop computer|desktops]] and [[laptop]]s are often better targets for pharming because they receive poorer administration than most Internet servers.

More worrisome than host-file attacks is the compromise of a local [[network router]]. Since most routers specify a trusted DNS to clients as they join the network, misinformation here will spoil lookups for the entire [[local area network|LAN]]. Unlike host-file rewrites, local-router compromise is difficult to detect. Routers can pass bad DNS information in two ways: misconfiguration of existing settings or wholesale rewrite of [[embedded software]] (aka [[firmware]]). Many routers allow the administrator to specify a particular, trusted DNS in place of the one suggested by an upstream node (e.g., the [[Internet Service Provider|ISP]]). An attacker could specify a DNS server under his control instead of a legitimate one. All subsequent resolutions would go through the bad server.

Alternatively, many routers have the ability to replace their [[firmware]] (i.e. the internal software that executes the device's more complex services). Like malware on desktop systems, a firmware replacement can be very difficult to detect. A stealthy implementation will appear to behave the same as the manufacturer's firmware; the administration page will look the same, settings will appear correct, etc. This approach, if well executed, could make it difficult for network administrators to discover the reconfiguration, if the device appears to be configured as the administrators intend but actually redirects DNS traffic in the background. Pharming is only one of many attacks that malicious firmware can mount; others include eavesdropping, active [[man in the middle attack]]s, and traffic logging. Like misconfiguration, the entire LAN is subject to these actions.

By themselves, these pharming approaches have only academic interest. However, the ubiquity of consumer grade [[wireless router]]s presents a massive [[vulnerability (computing)|vulnerability]]. Administrative access can be available wirelessly on most of these devices. Moreover, since these routers often work with their default settings, administrative passwords are commonly unchanged. Even when altered, many are guessed quickly through [[dictionary attack]]s, since most consumer grade routers don't introduce timing penalties for incorrect login attempts. Once administrative access is granted, all of the router's settings including the firmware itself may be altered. These attacks are difficult to trace because they occur outside the home or small office and outside the Internet.

== Instances of pharming ==

On 15 January 2005, the domain name for a large New York ISP, [[Panix (ISP)|Panix]], was [[Domain hijacking|hijacked]] to point to a website in [[Australia]]. No financial losses are known. The domain was later restored on 17 January, and [[ICANN]]'s review blames [[Melbourne IT]] (now known as "Arq Group") "as a result of a failure of Melbourne IT to obtain express authorization from the registrant in accordance with ICANN's Inter-Registrar Transfer Policy."<ref>{{cite news
| url=https://www.smh.com.au/national/icann-review-blames-melb-it-for-hijack-20050316-gdkxks.html
| title=ICANN review blames Melb IT for hijack
| date=March 16, 2005
| work=The Sydney Morning Herald}}</ref>

In February 2007, a pharming attack affected at least 50 financial companies in the U.S., Europe, and Asia. Attackers created a similar page for each targeted financial company, which requires effort and time. Victims clicked on a specific website that had a malicious code. This website forced consumers' computers to download a [[Trojan horse (computing)|Trojan horse.]] Subsequent login information from any of the targeted financial companies was collected. The number of individuals affected is unknown but the incident continued for three days.<ref>{{Cite web|date=2007-02-22|title=Pharming Attack Targeted Bank Customers Worldwide|url=https://www.pcworld.com/article/129270/article.html|access-date=2020-07-24|website=PCWorld|language=en}}</ref>

In January 2008, [[NortonLifeLock|Symantec]] reported a drive-by pharming incident, directed against a Mexican bank, in which the DNS settings on a customer's home router were changed after receipt of an e-mail that appeared to be from a legitimate Spanish-language greeting-card company.<ref>{{cite news
| url=https://www.networkworld.com/article/809822/lan-wan-first-case-of-drive-by-pharming-identified-in-the-wild.html
| last=Messmer
| first=Ellen
| title=First case of "drive-by pharming" identified in the wild
| date=January 22, 2008
| publisher=Network World}}</ref>

== Defences ==
Traditional methods for combating pharming include: Server-side software, DNS protection, and [[web browser]] add-ins such as [[toolbar]]s. Server-side software is typically used by enterprises to protect their customers and employees who use internal or private web-based systems from being pharmed and phished, while browser add-ins allow individual users to protect themselves from [[phishing]]. DNS protection mechanisms help ensure that a specific [[Domain Name System|DNS]] server cannot be [[Hacker (computer security)|hacked]] and thereby become a facilitator of pharming attacks. [[Spam (electronic)|Spam]] filters typically do not provide users with protection against pharming.

Currently the most efficient way to prevent pharming is for end users to make sure they are using secure web connections ([[HTTPS]]) to access privacy sensitive sites such as those for banking or taxing, and only accept the valid [[public key certificate]]s issued by trusted sources. A certificate from an unknown organisation or an expired certificate should not be accepted all the time for crucial business. So-called active cookies<ref>{{cite web |title=Active Cookies for Browser Authentication |url=http://www.ravenwhite.com/files/activecookies3.pdf |url-status=dead |archiveurl=https://web.archive.org/web/20061217065201/http://www.ravenwhite.com/files/activecookies3.pdf |archivedate=17 December 2006 |accessdate=December 3, 2006}}</ref> provide for a server-side detection tool.

Legislation also plays an essential role in anti-pharming. In March 2005, [[United States Senate|U.S. Senator]] [[Patrick Leahy]] ([[United States Democratic Party|D]]-[[Vermont|VT]]) introduced the [[Anti-Phishing Act of 2005]], a [[Bill (proposed law)|bill]] that proposes a five-year prison sentence and/or fine for individuals who execute [[phishing]] attacks and use information garnered through online fraud such as [[phishing]] and pharming to commit crimes such as [[identity theft]].

For home users of consumer-grade routers and wireless access points, perhaps the single most effective defense is to change the password on the router to something other than the default, replacing it with a password that is not susceptible to a [[dictionary attack]].

==Controversy over the use of the term==
The term "pharming" has been controversial within the field. At a conference organized by the [[Anti-Phishing Working Group]], [[Phillip Hallam-Baker]] denounced the term as "a [[marketing]] [[neologism]] designed to convince banks to buy a new set of [[security service (telecommunication)|security services]]".

==See also==
* [[Phishing]]
* [[DNS spoofing]]
* [[IT risk]]
* [[Mutual authentication]]
* [[Trusteer]]

==Notes==
{{notelist}}

==References==
{{Reflist}}
; Sources
* {{cite news
 |url         = http://www.windowsitpro.com/Article/ArticleID/46789/46789.html?Ad=1
 |title       = Security: Phishing and Pharming
 |date        = June 22, 2005
 |publisher   = Windows IT Pro Magazine
 |url-status     = dead
 |archive-url  = https://web.archive.org/web/20050811085205/http://www.windowsitpro.com/Article/ArticleID/46789/46789.html?Ad=1
 |archive-date = August 11, 2005
}}
* {{cite news|url=http://www.csoonline.com/talkback/071905.html |title=How Can We Stop Phishing and Pharming Scams? |date=July 20, 2005 |publisher=CSO Magazine |url-status=dead |archive-url=https://web.archive.org/web/20051124105904/http://www.csoonline.com/talkback/071905.html |archive-date=November 24, 2005 }}

==External links==
*[https://web.archive.org/web/20060701040504/http://www.csoonline.com/read/100105/pharm.html After Phishing? Pharming!]

[[Category:Types of malware]]
[[Category:Computer security exploits]]