CAPEC-89: Pharming
A pharming attack occurs when the victim is fooled into entering sensitive data into supposedly trusted locations, such as an online bank site or a trading platform. An attacker can impersonate these supposedly trusted sites and have the victim be directed to their site rather than the originally intended one. Pharming does not require script injection or clicking on malicious links for the attack to succeed.
Last updated
Overview
CAPEC-89 (Pharming) is a standard-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
How the attack works
The phases an attacker typically follows to carry out this attack.
- Step 1Exploit
Attacker sets up a system mocking the one trusted by the users. This is usually a website that requires or handles sensitive information.
- Step 2Exploit
The attacker then poisons the resolver for the targeted site. This is achieved by poisoning the DNS server, or the local hosts file, that directs the user to the original website
- Step 3Exploit
When the victim requests the URL for the site, the poisoned records direct the victim to the attackers' system rather than the original one.
- Step 4Exploit