‘Understanding and Preventing DNS-related Attacks by Phishers’

Summary

‘Exploiting well known flaws in DNS services and the way in which host names are resolved to IP addresses, Phishers have upped the ante in the cyber war for control of a customer’s online identity for financial gain.

A grouping of attack vectors now referred to as ‘Pharming’, affects the fundamental way in which a customer’s computer locates and connects to an organisations online offering. Enabling the Pharmer to reach wider audiences with less probability of detection than their Phishing counterparts, pharming attacks are capable of defeating many of the latest defensive strategies used customer and online retailer alike.

This paper, extending the original material of ‘The Phishing Guide’, examines in depth the workings of the name services of which Internet-based customers are dependent upon, and how they can be exploited by Pharmers to conduct identity theft and financial fraud on a massive scale.’

Credit:

‘The information has been provided by NGSSoftware Insight Security Research .
The original article can be found at: http://www.ngssoftware.com/papers/ThePharmingGuide.pdf


Details

Background:
This paper focuses upon a recent group of attack vectors used by criminals to target an organization’s customers for identity theft and financial fraud. Closely related to Phishing attacks, this new attack manipulates the ways in which a customer locates and connects to an organization’s named hosts or services through modification of the name lookup process.

The attack vectors, commonly referred to as Pharming, have the ability to bypass many traditional Phishing attack prevention tools and affect larger segments of an organizations customer-base.
Given the apparent complexity of this attack vector, this paper seeks to carefully explain many of the background processes all Internet-based customers use on a daily basis to connect to an organizations commercial service, and examines how frailties in them can be exploited by an attacker to conduct a Pharming attack.

Readers should ensure that they fully understand how traditional Phishing attacks are
conducted and the defensive strategies that have been adopted in the past to protect against them. Ideally the reader should be familiar with the author’s previous paper ‘The Phishing Guide’ as several sections of this paper reference information contained within the earlier whitepaper.

To read more about the guide please visit: http://www.ngssoftware.com/papers/ThePharmingGuide.pdf

Categories: Reviews