What Is Pharming in Cybersecurity?

Pharming in cybersecurity is a type of cyber attack that redirects website traffic from a legitimate site to a spoofed site, or fake site, with the intent of stealing sensitive information such as passwords and credit cards. These fake sites look almost identical to legitimate sites and can be difficult to spot – but not impossible. 

Continue reading to learn how to identify a pharming attack and protect yourself from it.

Phishing vs Pharming: What’s the Difference?

Phishing and pharming are sometimes used interchangeably, but they are not the same thing. Although both try to steal a user’s private information, the differences are in the methods cybercriminals use. 

To put it simply, all pharming attacks are a type of phishing attack, but not all phishing attacks are considered pharming.

Phishing is a broad classification of cyber attack in which cybercriminals send messages to victims containing malicious links or attachments. When users click on these malicious links and attachments, cybercriminals can steal private information by installing malware or leading users to fake websites.

Pharming is a type of phishing attack that discreetly redirects users from legitimate sites to fake ones in order to steal their private information. Instead of relying on the user to click the link to a fake site, pharming directly takes the user to the fake site. Pharming attacks are much more dangerous than phishing attacks because users typically do not even know they are being attacked. 

How Does Pharming Work?

To understand how pharming works, you need to first understand Domain Name Systems (DNS). Every website has a unique set of numbers called an Internet Protocol (IP) address. Whenever a user attempts to access a website, such as google.com, their browser contacts a DNS server, which acts as a directory of IP addresses. The DNS server “translates” the URL you wish to visit into the corresponding IP address and sends it to your browser. This process is called DNS resolution. The browser then uses the IP address to connect and load the website it was looking for. Once the computer has visited a specific website, your computer or mobile device stores the site’s IP address in a DNS cache for future reference. 

Pharming works by manipulating the DNS resolution process and changing the settings of a DNS server. Once this happens, a user’s browser will ask a DNS server to find the IP address of the website they want to visit. However, the manipulated DNS server will give the user the IP address to a fake site that looks very similar to the legitimate website the user had intended to visit. The user will then believe the website they visit is correct and may enter in sensitive information such as a password or credit card number, which would cause them to fall victim to a security breach. 

Types of Pharming

There are two different types of pharming attacks. It’s important to understand each one to protect yourself from these attacks. 

DNS poisoning

In DNS poisoning, cybercriminals leverage vulnerabilities within the DNS infrastructure to alter DNS server lookup tables and redirect users to malicious websites. Cybercriminals manipulate the DNS cache or server. Once a machine’s DNS cache is altered, the user will be redirected to malicious websites completely without their knowledge. DNS servers are difficult to infiltrate, but if they are compromised, pose a significant threat because many users can be affected. 

Host-based pharming

Host-based pharming is when cybercriminals infiltrate a user’s local computer or mobile device and manipulate their host’s file or local DNS settings to redirect users to malicious websites. This can be accomplished through phishing attacks or brute force attacks on the local network router. Once they are in, they corrupt the locally hosted files and change the stored IP addresses, which redirects the victim to spoofed sites. 

Signs of a Pharming Attack

Pharming attacks can be dangerous since they are very difficult to spot and can affect a multitude of users without them even knowing.

Users need to look out for the following signs if they want to avoid a pharming attack:

• Unusual behavior or unexpected changes in a website you are familiar with, such as different colors, logos, or even fonts
• You are directed to websites that use HTTP instead of HTTPS
• Your browser generates SSL certificate errors 
• Sudden network or connectivity issues
• Unusual account activity, such as bank transactions you didn’t initiate

How to Prevent a Pharming Attack

Due to the dangers of pharming, users need to stay vigilant when they are online. Luckily, there are ways to prevent pharming attacks from happening to you.

Use a password manager 

A password manager is a tool that securely stores and manages credentials to your online accounts. Password managers securely store the login credentials in an encrypted vault that only you can access. Having an encrypted vault eliminates the need to remember passwords and ensures the security of your private information. A password manager also checks the strength of your passwords to help prevent your online accounts from being compromised by cybercriminals. 

When you visit the login page of a website, the password manager detects the login page and autofills the login credentials for that site. This feature also helps prevent cyber attacks– including pharming. Password managers store the login pages in their vaults and can detect legitimate sites from fraudulent ones. If a user lands on a fake site, the password manager will not autofill the login credentials since the web address won’t match the one stored in the vault. 

Use antivirus software

Antivirus software is a type of program that prevents, detects and removes known viruses and malware from your computer. Using reliable antivirus software can protect your computer from being compromised. However, antivirus software alone cannot protect you from DNS poisoning, because in that type of pharming attack, your computer isn’t compromised at all; the DNS server is. You will need the help of a password manager to stay safe from fake sites. 

Secure your home and office WiFi

The more you use the internet, the more vulnerable you become to cyber attacks. Securing your home WiFi is an essential cybersecurity practice. You can protect yourself from pharming attacks by choosing a trustworthy Internet Service Provider (ISP) that is secure from DNS cache poisoning. You should also change your WiFi network password from the default to something stronger. A weak password is the easiest way for a threat actor to compromise your WiFi network and expose yourself to pharming. 

Keep your operating systems and software up to date

Keeping your operating systems and software up to date ensures that your devices have the latest patches installed. Software updates frequently contain new security patches that fix vulnerabilities cybercriminals can exploit. Not installing new software updates puts you at risk of falling victim to pharming and other types of cyber attacks. 

Enable MFA for all of your accounts

Multi-Factor Authentication (MFA) is a security measure that requires more than one form of authentication to log in to an online account. This ensures that even if a cybercriminal compromises an account password, it will be useless without the additional authentication factor. MFA adds an extra layer of security for users to have total control over who has access to their private information. 

Don’t overshare on social media

Cybercriminals are constantly looking for any way to steal your private information for their personal gain. Oversharing on social media poses a huge risk to users, as cybercriminals can use your personal information to personalize cyber attacks and make them look legitimate. Avoid oversharing online and keep your social media accounts private. 

Use Keeper to Stay Vigilant From Pharming Attacks

Keeper Password Manager can help prevent pharming attacks by recognizing if the site you’re on matches the saved login record in your vault. Protecting your passwords is the first step to protecting yourself from the dangers of pharming. Stay safe from pharming attacks today by signing up for your free trial of Keeper Password Manager.