Pharming: definition, how it works and how to protect yourself

What is pharming?

Pharming is a cyberattack technique that hijacks Internet traffic in order to redirect users to a fraudulent site imitating a legitimate one.

Unlike phishing, which relies on sending a deceptive e-mail or message, pharming acts directly on the system that resolves Internet addresses. As a result, even when users type a site's address correctly, they can be redirected to a malicious copy designed to collect their confidential information.

The term pharming is a blend of the words phishing and farming, referring to the large-scale data harvesting carried out by cybercriminals.

How does a pharming attack work?

A pharming attack relies on manipulating the process that translates a web address into an IP address.

Two main methods are used.

The first consists of compromising a computer's "hosts" file. This file maps a web address to an IP address. By modifying it, an attacker can redirect users to a fake site without them noticing.

The second targets DNS (Domain Name System) servers. By compromising a DNS server or exploiting a configuration flaw, cybercriminals can redirect many users to a fraudulent site at the same time.

Once on this fake site, victims enter their usernames, passwords or banking details, believing they are on the official site.

What are the risks of pharming?

Pharming can have serious consequences for individuals and businesses alike.

The main risks are:

• Credential theft giving access to information systems;
• Compromise of business or personal accounts;
• Theft of confidential or strategic data;
• Financial fraud and identity theft;
• Spread of other malware, such as ransomware, spyware or backdoors.

In some cases, the stolen information is then used to carry out more targeted attacks, such as whaling against executives or man-in-the-middle attacks.

How can you recognize a pharming attack?

Pharming is particularly hard to detect, because users believe they are visiting a legitimate site.

Some signs can nevertheless raise the alarm:

• The HTTPS certificate is missing or invalid;
• The browser displays a security warning;
• The site shows visual anomalies or unusual errors;
• Requests for information seem abnormal;
• The site behaves differently from usual.

Even when these signs are present, some sophisticated attacks faithfully reproduce official sites, making them difficult to detect.

How can you protect yourself against pharming?

Prevention relies on several best practices.

We recommend that you:

• Keep operating systems and browsers up to date;
• Use secure and trusted DNS servers;
• Always check the HTTPS certificate of the sites you visit;
• Deploy antivirus and EDR solutions capable of detecting malicious changes;
• Set up multi-factor authentication (MFA) to limit the consequences of credential theft;
• Regularly raise user awareness of the risks associated with cyberattacks.

In businesses, a zero trust approach also helps reduce the risks associated with a compromised user account.

Why does backup remain essential against pharming?

Pharming is mainly aimed at stealing credentials. However, this information can then be used to access the company's information system and launch other cyberattacks.

It is not uncommon for access obtained through a pharming campaign to be used afterwards to install ransomware, doxware or a backdoor, causing system downtime or data loss.

Having a reliable, automated and regularly tested backup strategy limits the consequences of these attacks and ensures a fast return to business.

KiwiBackup's role in addressing pharming risks

At KiwiBackup, data is protected by encrypted, automated and monitored backup mechanisms. Backups are isolated from production environments to guarantee their availability, even if information systems are compromised.

This approach helps strengthen businesses' resilience against cyberattacks that may result from credential theft or a network compromise.

Conclusion

Pharming is a discreet but particularly effective threat, because it exploits users' trust in the sites they visit every day. By redirecting victims to perfectly imitated fake sites, cybercriminals can collect sensitive information and pave the way for larger attacks.

Combining cybersecurity best practices, infrastructure monitoring and a robust backup strategy is today the best way to limit the consequences of a pharming attack.