Pharming Out-Scams Phishing

Wired News: Pharming Out-Scams Phishing

It’s hard to tell which end of the security spectrum is advancing faster, the good guys who provide protection from cyber-criminals or the criminals themselves.

The big prize in the Internet scamming world is personal information. Spam and phising have been around for a while, and vendors like Mozilla have even added extensions for the Firefox browser like SpoofStick to provide protection against phishing sites.

Not content to attack us one by one, scammers are now employint tactics designed to sucker as many people at once as possible, and it goes by the name “pharming”.

“Pharmers simply redirect as many users as possible from the legitimate commercial websites they’d intended to visit and lead them to malicious ones. The bogus sites, to which victims are redirected without their knowledge or consent, will likely look the same as a genuine site. But when users enter their login name and password, the information is captured by criminals.”

“‘Phishing is to pharming what a guy with a rod and a reel is to a Russian trawler. Phishers have to approach their targets one by one. Pharmers can scoop up many victims in a single pass,’ said Chris Risley, president and chief executive officer of Nominum, a provider of IP address infrastructure technology for businesses.

E-mailed viruses that rewrite local host files on individual PCs, like the Banker Trojan, have been used to conduct smaller-scale pharming attacks. Host files convert standard URLs into the numeric strings a computer understands. A computer with a compromised host file will go to the wrong website even if a user types in the correct URL.

The most alarming pharming threat is DNS poisoning, which can cause a large group of users to be herded to bogus sites. DNS — the domain name system — translates web and e-mail addresses into numerical strings, acting as a sort of telephone directory for the internet. If a DNS directory is ‘poisoned’ — altered to contain false information regarding which web address is associated with what numeric string — users can be silently shuttled to a bogus website even if they type in the correct URL.

Phishing is essentially an old con game updated to take advantage of new technology. Similarly, although DNS attack tactics used by pharmers have been around for a while, the rise in internet banking, online shopping and electronic bill paying has created a wide potential profit zone for criminals eager to snag login information and credit card and bank account numbers.

According to information provided by the SANS Internet Storm Center and internet-monitoring firm Netcraft, this past weekend would-be pharmers attempted to exploit a known vulnerability in Symantec’s firewall, redirecting some users from eBay, Google and weather.com to three sites that attempted to install spyware on visitors’ computers.

Security experts believe the attack was just a trial run; it was limited in scope and few users seem to have been affected.

However, Mastoras says other sophisticated attacks that take advantage of the flaws in DNS protocols are also currently being tested.