Pharming
Pharming is an attack that redirects users to a fake website made to look like a legitimate one, so that they enter personal information such as usernames, passwords, or credit card numbers. Unlike phishing, it does not depend on a message. The attacker redirects users with malware or by manipulating the domain name system (DNS).
Updated
Overview
Attackers redirect users by modifying settings on the user's system or by exploiting vulnerabilities in DNS server software, which resolves web addresses into IP addresses. NIST SP 800-63-4 describes the same two routes: corrupting an infrastructure service such as DNS, or corrupting the user's own endpoint.
Typo-squatting depends on a user mistyping a web address, but pharming can redirect a user who types the address correctly. At a quick glance the fake site may look like the real one, and it can be used to deliver malware and collect personal or other sensitive information. In authentication, the fake site is typically a fraudulent login service, and the user may reveal a password to the attacker, download harmful software, or contribute to a fraudulent act.
NIST SP 800-63B lists authenticators that provide phishing resistance as the mitigation for phishing and pharming, in which the authenticator output is captured by fooling the user into thinking the attacker is the legitimate verifier. The Canadian Centre for Cyber Security also recommends a trusted anti-phishing DNS resolver, blocking domain names known to be malicious, and applying software updates and patches.
Similar Terms
1 termFrequently Asked Questions
What is the difference between phishing and pharming?→
Phishing relies on emails or messages to trick users into providing personal information. Pharming uses malware or manipulates DNS to redirect users to fraudulent websites designed to capture that information.
How does pharming work?→
The attacker either changes settings on the user's own system or exploits vulnerabilities in DNS server software, which translates web addresses into IP addresses. Either way, the user is redirected from the legitimate website to a malicious one, even when the address was typed correctly.
How can you protect against pharming?→
Use phishing-resistant authenticators, which NIST lists as the mitigation for phishing and pharming, use a trusted anti-phishing DNS resolver, block domain names known to be malicious, and keep software updated and patched.
Related
Sources
Definitions follow the government and standards body sources listed above. This site is not affiliated with the agencies or organizations cited.