Online Threats: Pharming

I once talked about phishing, which is essentially, a form of online identity theft through means of deceptions. Later, it occurs to me that i should talk about another online threat, pharming, which is closely related to phishing, though at a much lower scale.

Pharming is a type of hacker's attack with the motive of redirecting a website's traffic to another bogus website. Hackers achieve the feat of pharming through two techniques: first, the modification of the host file on a victim's PC or through exploitation of a vulnerability in DNS server software. Like phishing, the motive of applying pharming is also to trick users into revealing sensitive information over the internet, and both methods can be combined together for the greatest effect. An action of infecting DNS by pharming is normally called "DNS poisoning".

Illustration on how antipharming works. First, the attacker "poison" a DNS server, which provides user information on the web. When a user asked for information retrieval, the poisoned DNS server will point the user to another bogus website, where the hackers can start their information-thieving activities.

One thing that is so tricky about this online threat is that even though they are rarely used, they are practically undetectable by security software such as antivirus and antispyware software. Despite the fact that there are antipharming tools available out there, they are so rare that normal users will less likely able to find a really good one that offers real protection. One of the antipharming software i knew of is included in the Norman Security Suite v7, a very little-known antivirus and antispyware software. I will post something on Norman Security Suite in the future.

Norman Security Suite/ Norman Virus Control, one of the few available security software tools with pure antipharming protection.

There are little ways of protecting yourself against pharming, but beside using antipharming tools, one of the best free thing you can take notice of is to make sure that whenever you're making a transaction or exchange of personal information online, make sure that you are in a Secure Socket Layered (SSL) environment. As i had mentioned before (check my previous post on Online Threats), users can anticipate that they are in a SSL environment when the hypertext protocol is shown as https:// instead of the usual http://. That simply means that the transaction area you're in is certified by the company itself and therefore, safe to do anything you want to.