Attack Pattern ID: 89 (Standard Attack Pattern Completeness: Complete)Typical Severity: Very HighStatus: Draft
+ Description


A pharming attack occurs when the victim is fooled into entering sensitive data into supposedly trusted locations, such as an online bank site or a trading platform. An attacker can impersonate these supposedly trusted sites and have the victim be directed to his site rather than the originally intended one.

Pharming does not require script injection or clicking on malicious links for the attack to succeed.

Attack Execution Flow

  1. Attacker sets up a system mocking the one trusted by the users. This is usually a website that requires or handles sensitive information.

  2. The attacker then poisons the resolver for the targeted site. This is achieved by poisoning the DNS server, or the local hosts file, that directs the user to the original website

  3. When the victim requests the URL for the site, the poisoned records direct the victim to the attacker's system rather than the original one.

  4. Because of the identical nature of the original site and the attacker controlled one, and the fact that the URL is still the original one, the victim trusts the website reached and the attacker can now "farm" sensitive information such as credentials or account numbers.

+ Attack Prerequisites

Vulnerable DNS software or improperly protected hosts file or router that can be poisoned

A website that handles sensitive information but does not use a secure connection and a certificate that is valid is also prone to pharming

+ Typical Likelihood of Exploit

Likelihood: High

+ Methods of Attack
  • Spoofing
  • Analysis
  • Modification of Resources
+ Examples-Instances


An online bank website requires users to provide their customer ID and password to log on, but does not use a secure connection.

An attacker can setup a similar fake site and leverage pharming to collect this information from unknowing victims.

+ Attacker Skills or Knowledge Required

Skill or Knowledge Level: Medium

The attacker needs to be able to poison the resolver - DNS entries or local hosts file or router entry pointing to a trusted DNS server - in order to successfully carry out a pharming attack. Setting up a fake website, identical to the targeted one, does not require special skills.

+ Resources Required

Except having enough knowledge of the way the targeted site has been structured in order to create a fake version, no additional resources are required. Poisoning the resolver requires knowledge of a vulnerability that can be exploited.

+ Probing Techniques

The attacker observes the targeted website for use of secure connection to exchange sensitive information. If it does not use secure connections, victim users cannot distinguish between the original and fake versions of the website.

The attacker can also fingerprint the software running on the targeted system (DNS server, router or host) and look for vulnerabilities in order to poison the entries.

+ Solutions and Mitigations

All sensitive infomation must be handled over a secure connection.

Known vulnerabilities in DNS or router software or in operating systems must be patched as soon as a fix has been released and tested.

End users must ensure that they provide sensitive information only to websites that they trust, over a secure connection with a valid certificate issued by a well-known certificate authority.

+ Attack Motivation-Consequences
  • Information Leakage
+ Related Weaknesses
CWE-IDWeakness NameWeakness Relationship Type
346Origin Validation ErrorTargeted
247Reliance on DNS Lookups in a Security DecisionTargeted
292Trusting Self-reported DNS NameTargeted
+ Related Vulnerabilities
Vulnerability IDRelationship Description

Dnsmasq before 2.21 allows remote attackers to poison the DNS cache via answers to queries that were not made by Dnsmasq.


The DNS proxy (DNSd) for multiple Symantec Gateway Security products allows remote attackers to poison the DNS cache via a malicious DNS server query response that contains authoritative or additional records.

+ Related Attack Patterns
NatureTypeIDNameDescriptionView(s) this relationship pertains toView\(s\)
ChildOfAttack PatternAttack Pattern151Identity Spoofing (Impersonation) 
Mechanism of Attack (primary)1000
ChildOfAttack PatternAttack Pattern161Infrastructure Manipulation 
Mechanism of Attack (primary)1000
+ Related Security Principles
  • Reluctance To Trust

  • Promoting Privacy

+ Related Guidelines
  • Use Authentication Mechanisms, Where Appropriate, Correctly

  • Use Well-Known Cryptography Appropriately and Correctly

+ Purposes
  • Reconnaissance
+ CIA Impact
Confidentiality Impact: HighIntegrity Impact: HighAvailability Impact: Low
+ Technical Context
Architectural Paradigms
+ Content History
Chiradeep B. Chhaya2007-03-12First Draft
Sean BarnumCigital, Inc2007-04-16Review and revision of content