Pharming
A cyberattack that redirects website traffic from legitimate sites to fraudulent ones by corrupting DNS settings or host files.
Pharming is a cyberattack that silently redirects users from legitimate websites to malicious replicas without their knowledge or interaction. Unlike phishing, which requires a victim to click a deceptive link, pharming manipulates the underlying infrastructure of the internet — specifically the Domain Name System (DNS) or local host files — so that even when users type a correct URL into their browser, they are routed to a fraudulent site controlled by the attacker.
Pharming attacks can be executed at two levels. In local pharming, malware on the victim's device modifies the hosts file or local DNS settings to redirect specific domains to attacker-controlled IP addresses. In DNS poisoning (also called DNS cache poisoning), attackers corrupt the records stored on DNS servers, affecting every user who relies on that server for domain resolution. The latter is far more dangerous because it can redirect thousands or millions of users simultaneously without requiring malware on any individual device.
The fraudulent websites used in pharming attacks are typically indistinguishable from the legitimate sites they impersonate, complete with identical branding, login forms, and functionality. Victims unknowingly enter their credentials, financial information, or personal data, which is captured by the attacker. Pharming is particularly insidious because traditional anti-phishing advice — such as checking URLs carefully — is insufficient when the URL in the address bar appears correct. Defenses include DNSSEC implementation, HTTPS enforcement, and endpoint protection that monitors for unauthorized DNS or hosts file changes.
Pharming attacks can be executed at two levels. In local pharming, malware on the victim's device modifies the hosts file or local DNS settings to redirect specific domains to attacker-controlled IP addresses. In DNS poisoning (also called DNS cache poisoning), attackers corrupt the records stored on DNS servers, affecting every user who relies on that server for domain resolution. The latter is far more dangerous because it can redirect thousands or millions of users simultaneously without requiring malware on any individual device.
The fraudulent websites used in pharming attacks are typically indistinguishable from the legitimate sites they impersonate, complete with identical branding, login forms, and functionality. Victims unknowingly enter their credentials, financial information, or personal data, which is captured by the attacker. Pharming is particularly insidious because traditional anti-phishing advice — such as checking URLs carefully — is insufficient when the URL in the address bar appears correct. Defenses include DNSSEC implementation, HTTPS enforcement, and endpoint protection that monitors for unauthorized DNS or hosts file changes.
Examples
- Malware on a victim's computer modifies the hosts file so that typing a bank's URL leads to a fake banking site.
- An attacker poisons a DNS server's cache so that all users of that ISP are redirected when visiting a popular e-commerce site.
- A compromised home router changes DNS settings to redirect all connected devices to fraudulent versions of common websites.
Prevention
- Use DNSSEC-enabled DNS resolvers to validate the authenticity of DNS responses.
- Always verify that websites use HTTPS and check for valid SSL certificates before entering credentials.
- Keep operating systems, browsers, and routers updated to patch known vulnerabilities.
- Run reputable endpoint protection software that monitors for unauthorized hosts file or DNS modifications.