Pharming

Pharming is a cyberattack that redirects you to a fake website which looks just like the real one. You might type the correct address of a site you trust, yet still land on a copy made by an attacker. The fake site is convincing, so you enter your username, password or card details without suspecting anything. Pharming is similar to phishing, because both trick you into typing personal details into a website that only looks legitimate. The difference is how you get there: with phishing you are usually persuaded to click a link, whereas with pharming you are sent to the fake site even when you typed the right address.

How the redirection works

A DNS server is part of the Domain Name System, which translates a website name into its IP address, the number computers use to find each other. When you type a name such as bookbarn.example, your device asks a DNS server for the matching IP address, then connects to it. If an attacker compromises a DNS server, they can change the answers it gives.

For example, suppose a college's DNS server is altered so that requests for the student portal are answered with the IP address of an attacker's server. Every student who types the correct name is taken to the attacker's copy of the login page. The address bar shows the real name, so nothing looks wrong, and the students type their logins into the fake page. The attacker collects them and can then sign in as those students.

Why it is called DNS spoofing

Pharming is also called DNS spoofing because the DNS server is made to give a false answer that pretends to be genuine. You cannot spot pharming by checking the web address carefully, because the address shown is correct. Pharming is not a kind of malware: it is a technique that relies on a compromised DNS server, set up so that many users are redirected at once rather than one person at a time.