Pharming definitionA pharming attack tries to redirect a website's traffic to a fake website controlled by the attacker, usually for the purpose of collecting sensitive information from victims or installing malware on their machines. Attackers tend to focus on creating look-alike ecommerce and digital banking websites to harvest credentials and payment card information.These attacks manipulate information on the victim\u2019s machine or compromise the DNS server and rerouting traffic, the latter of which is much harder for users to defend against.How pharming attacks workThough they share similar goals, pharming uses a different method from phishing. \u201cPharming attacks are focused on manipulating a system, rather than tricking individuals into going to a dangerous website,\u201d explains David Emm, principal security researcher at Kaspersky. \u201cWhen either a phishing or pharming attack is completed by a criminal, they have the same driving factor to get victims onto a corrupt location, but the mechanisms in which this is undertaken are different.\u201dPharming attacks involve redirecting user requests by manipulating the Domain Name Service (DNS) protocol and rerouting the target from its intended IP address to one controlled by the hacker. This can be done in two ways.Attackers compromise the victim\u2019s machine and change the local hosts file (a local directory of IP addresses) on the device, which then redirects the user the next time they try to access a site (usually disguised to look like the victim\u2019s intended destination). This attack is often preceded with a phishing attack or some other malware deployment method that then manipulates the host file. Routers are also a potential endpoint device targeted in pharming attacks (sometimes known as \u201cdrive-by\u201d pharming).Attackers redirect traffic via DNS poisoning by exploiting DNS server vulnerabilities so that the victims are rerouted to the IP address of an attacker-controlled machine. This can be an especially challenging threat as the victim doesn\u2019t have to click on anything or make a mistake to be sent to the faked website. This is sometimes known as a phish without a lure.While DNS servers are harder to compromise because they sit on an organization\u2019s network and behind its defenses, the attack can affect far more victims and offer greater reward for the attackers. Poisoning can also spread to other DNS servers. An internet service provider (ISP) receiving DNS information from a poisoned server can lead to the corrupted DNS entry being cached on the ISP\u2019s servers, spreading it to more routers and devices. This happened by mistake in 2010 when an ISP fetched DNS information from a server behind China\u2019s Great Firewall, which then began to spread China\u2019s blocking of websites such as Twitter to other countries.\u201cHacking a Domain Name Server can be more difficult to achieve and is the reason why we do not see these types of attacks as often,\u201d says Emm. \u201cWhile injecting malware onto an individual\u2019s device restricts damage to just that person, infecting a DNS has the potential to affect all devices that use that server to access web sites and can be extremely damaging.\u201dHow common are pharming attacks?The potential harm of a pharming attack depends on the attacker\u2019s objectives. The goal could be to collect financial information to abuse or sell, or to harvest login credentials that could be sold. Sophisticated actors could also use pharming as an early-stage attack to steal credentials and then those credentials to launch further attacks into an organization.However, the smaller payoff for attacks on individuals and the relative difficulty to exploit at scale means pharming attacks remain rare compared to phishing attacks. \u201cGenerally, pharming attacks are less common than phishing because they require significantly more work from the attackers,\u201d says Emm. \u201cPhishing attacks are easily achievable, which is why we see them more regularly.\u201dIn 2019 Kaspersky identified a pharming attack in Venezuela. \u201cThe day after the public announcement [by President Juan Guadio asking people to submit details to an aid website], another almost identical website appeared with a very similar domain and structure,\u201d explains Emm. \u201cThe two different domains, with different owners, were registered within Venezuela to the same IP address, belonging to the hackers. This meant it didn\u2019t matter whether a volunteer opened a legitimate or fake domain name. Their personal information would be introduced into a fake site regardless.\u201dOther notable cases include a pharming attack in Brazil, spotted by Proofpoint in 2015, where attackers sent phishing emails to users of UTStarcom or TR-Link home routers pertaining to be from Brazil's largest telecommunications firm. Links in the emails downloaded malware designed to exploit router vulnerabilities and allow attackers to change the router's DNS server settings.In 2016, Sucuri discovered an attack where attackers redirected visitors to sites that used NameCheap\u2019s FreeDNS via changed DNS settings. Though not recent, an especially large 2007 campaign saw at least 50 financial institutions suffer a pharming attack that constructed for each target fake sites that harvested login credentials and then passed the victim back to the legitimate site.Pharming attack preventionThe following best practices will reduce the chances of a successful pharming attack:Teach users about good security hygiene practices, such as how to spot suspicious links to fake websites. For example, invalid or outdated certificates might be a sign of a compromised website, as well as URLs that look similar but aren\u2019t as expected.Patch devices and perform regular virus scans and cache\/browser cookie clearances.Fully patch, audit and monitor DNS servers to reduce the chances of them being exploited.Deploying TLS certificates on enterprise websites to reduce the chance of those sites being spoofed.Require employee machines to be patched and have active endpoint security controls and monitoring.Ensuring strong password security on routers to help prevent drive-by attacks.Set up threat intelligence to monitor for spoof domains similar to your own.Enable two-factor authentication on services to help reduce the impact if user credentials are collected.