legitimate website in the address bar of a browser, the browser gets the IP address of the fraudulent website instead, and the user gets redirected to the malicious website though he typed in the correct URL.

Pharming using DNS Cache Poisoning

When we type the URL of a website in the address bar of the browser, our computer contacts the Domain Name Servers or DNS Servers to resolve the IP address of the website. Now, the Internet does not have a single DNS Server, which would be very inefficient. Instead, our ISP runs its own DNS Servers, which cache information from other DNS Servers. Our home router has its own DNS Server, which caches information from ISP’s DNS Servers. Our computer has a local DNS cache, which stores responses to previous DNS queries made by the computer.

The function of a DNS cache is to store responses to previously made DNS queries so that the next time the same DNS query is made, it doesn’t have to contact the DNS Servers again. Instead, it can retrieve the IP address from its cache.

A DNS cache is said to be poisoned when it stores a malicious entry instead of a valid one. For example, if we type google.com for the first time, our computer will make a DNS query to the appropriate DNS Server. Once it gets a response, it will store the IP address of google.com in its DNS Cache, with a timestamp up to which the entry remains valid. Within that time, if we type google.com again, our computer will look at its DNS Cache for the entry.

Suppose our computer has made a DNS query and is waiting for a response from the DNS servers. But instead of an authentic response, it gets a response containing the IP address of the attacker’s website. So, its DNS cache will be poisoned, and from now on, whenever the computer tries to resolve the IP address of the same URL, it will end up at the attacker’s website.

In a similar way, the DNS cache of any DNS server may also get poisoned. The ISP’s DNS server gets responses from other DNS servers and stores them in its cache. If that cache is poisoned, the same poisoned entry will spread to all home routers and from them to all computers.

Attackers often use DNS cache poisoning for the purpose of pharming. They poison the DNS Cache to store the IP address of their malicious website so that even though a user types in the correct URL, the browser gets the IP address of the fraudulent website, and the user gets redirected to the attackers’ website even though he typed in the correct URL.

How to prevent pharming?

We can always take a couple of steps to protect ourselves better.

• It is always a good practice to look at the address bar of a browser and check whether there are any spelling mistakes in the URL before providing any credentials to the website.
• Pharmers often target banking and e-commerce websites. So, before typing in any financial details, it is always a good practice to verify whether HTTPS is being used. No legitimate website will transfer any sensitive information without using HTTPS.
• It is always a good practice to verify the digital certificate of a website when you have any doubts. You can go to the browser properties menu and click on the “Certificate” tab to verify whether the website is using a secure certificate from its legitimate owner
• Look at the padlock in a browser’s address bar to verify whether the connection is secure. An unlocked padlock indicates an unsecured connection.
• Use anti-malware programs from trusted sources and keep them updated regularly. Some anti-malware programs can detect pharming.
• Keep your Operating System and browser updated with recent security patches. Attackers often exploit security vulnerabilities present in a system to infect it. The more updated software is, the fewer its known security vulnerabilities.

The above article gives a brief overview of pharming. Interested readers who want to know more about various techniques used by attackers in a phishing scam may want to refer to the book “Phishing: Detection, Analysis And Prevention.”