Resources

Contact Us

Cyveillance Anti-Phishing - Pharming™

Over the past year pharming attacks have become a mainstream issue in the world of online criminal activity. The pharming attack vector offers the criminal unlimited options to lure unsuspecting victims into their fraud and ID theft scams. Even worse, organizations have a very difficult time detecting and mitigating these stealthy attacks, leaving their customers with virtually no safeguards against falling for the scams.

How pharming differs from phishing

In a traditional phishing attack the phisher attempts to lure the user to a Web site typically through the clicking of a link in an email. After the user clicks on the link, he or she is taken to the Web site via a Web browser. Once there, the Web site requests the user to enter personal information such as a social security number, username and password, or a variety of other data. The compromised data is then used to perpetrate fraud.

Like phishing, pharming is seeking to compromise sensitive information or distribute malware through the misuse of a brand or Web property. However, unlike traditional phishing, the user does not have to click on a link or do anything out of the ordinary. In fact, with pharming, the user simply needs to access a Web address through normal means such as entering the address in a Web browser address bar. This act will route the browser to a bogus address or Web page without any indication to the user.

Domain Name System (DNS)

The Domain Name System, or “DNS”, is a public Internet service loosely managed by a consortium of agencies to provide the resolution of domain names to IP addresses. This “resolution” process is a critical element in the widespread adoption and utility of the World Wide Web.

Each Web site or server connected to and providing content on the Web is identified by a unique address in the form of a four-part series of numbers (e.g. 38.100.19.13) called an IP address. However, since these numerical addresses are difficult for the average non-technical user to remember and cumbersome to use, DNS was developed to allow each machine or site to have a corresponding textual name that would be easy for the average person to remember and contact. For example, a Web site located at address 38.100.19.13, can be found by typing www.cyveillance.com through the resolution of DNS.

How pharming attacks work

Pharming refers to the methods to compromise the DNS resolution process. In most cases, it involves either hacking a legitimate DNS-resolution server or the operation of a private resolution server completely detached from the publicly managed DNS network. These servers are then populated with name-address pairs containing incorrect addresses for those domains the criminal or perpetrator would like to resolve to an address other than the domain owner intends. What makes pharming especially dangerous to the average user and their identity is that, without highly sophisticated knowledge, advanced tools and an established process, there is no way for the user to even know this is happening.

The Solution

Cyveillance Anti-Phishing - Pharming™ enables organizations to detect, respond to and recover from pharming attacks that target their brands or customers. Using its proprietary technology, proven processes and procedures, and industry-leading security operations team, Cyveillance quickly identifies malicious Domain Name System (DNS) manipulation activity typically related to pharming attacks. Once identified, customers are alerted of attacks and response and mitigation actions are initiated and handled by the industry’s fastest and most comprehensive response service.

Service Benefits

  • Minimization of fraud losses through industry’s fastest pharming detection and alerting capabilities
  • Detection of technically advanced pharming attacks
  • Turnkey service easily integrated into existing processes

Features

  • Real-time alerts of pharming attacks that target a customer’s brands or Web properties
  • Real-time status updates via Cyveillance Intelligence Center Portal
  • High-level analysis of the methods used in the attack
  • Detailed summary report for each attack mitigated
  • Access to subject matter expertise to fully recover from attacks