First Phishing, now Pharming
p2pnet.net News:- Phishing – tricking people into disclosing online passwords, user names and similar personal information for nefarious purposes – isn’t the only online financial danger.
DNS cache poisoning has raised concerns about a next-generation phishing scam called "pharming" in which malware or DNS hacks invisibly redirect victims to spoofed web sites.
“DNS cache poisoning injects false information into DNS servers, which route Internet traffic by matching domain names with IP addresses at web hosts, allowing hackers to redirect users to bogus web sites,” says Netcraft.”
On Saturday, a known vulnerability in Symantec firewalls was exploited to change information on a small number of local DNS servers, sending requests for Google.com, eBay.com and Weather.com to a trio of hacker sites (7sir7.com, 123xxl.com and abx4.com) that attempted to install spyware on vistors’ computers, it says, going on:
“Successful DNS poisoning attacks are rare, but could allow malicious web sites to spoof trusted web brands. Pharming attacks could use DNS cache poisoning to redirect requests from legitimate financial sites to look-alike fraud sites.”
Netcraft says the Anti-Phishing Working Group recently expanded its focus to address concerns about pharming and, "security professionals have warned of the potential for DNS-based pharming attacks in interviews with eWeek, C/Net and The Register – while acknowledging that no such attacks have yet been seen".
But, “That may not remain true for long,” it warns.
“Saturday’s incident has all the earmarks of a proof-of-concept, and phishing scams are quick at layering new techniques atop existing spoofs and social-engineering tactics.”
Something you think we should know? tips[at]p2pnet.net
===================
See:-
Netcraft – DNS Poisoning Scam Raises Wariness of ‘Pharming’, March 7, 2005
March 7th, 2005 at 5:43 pm
For the last few months, I cannot pull up this site, always getting a blank page. I can only get in through a web proxy. No other site does this.
March 7th, 2005 at 6:01 pm
Does it work if you try to access p2pnet by it’s IP address?
It is currently:
http://80.68.80.144
If that works your ISP may be blocking p2pnet’s DNS server.
March 7th, 2005 at 6:42 pm
It’s the first complaint I’ve had like this. What country are you in? And is anyone else having the same problem?
For now, see the post above, “Does it work if you try to access p2pnet by it’s IP address? It is currently: http://80.68.80.144 / If that works your ISP may be blocking p2pnet’s DNS server.” (And thanks to whoever posted this : )
Cheers!