Pharming attacks are used by fraudsters to divert users from their online banking website to a fraudulent site. While phishing attacks lure in victims through social engineering tactics, such as a fake email from a bank, pharming attacks target DNS servers or location IP resolution tables via malware to redirect unsuspecting users to a fake website. On the fraudulent site, the customer experience mimics that of the online bank, and users are prompted to enter their online banking credentials.

Increasingly, cyber criminals are leveraging these attacks against new channels: small offices and home offices. A recent study released by Team Cymru looks at this attack vector in depth and shows that this is a growing trend in online bank fraud. In this method, malware is loaded to the router and automatically changes its DNS settings to malicious Web addresses for targeted sites. An end user attempting to access an online banking site will be redirected automatically to the malicious site without warning. When a user unsuspectingly logs in to the fraudulent site, their authentication credentials can be captured and stolen by cyber criminals and leveraged for online fraud.

Pharming Attacks on the Rise

Pharming attacks on small office and home office routers have become more prevalent in specific countries — like Brazil, for example — and have moved to other areas of the world. Since users typically do not change their default settings or passwords of their small office or home routers nor update them to patch security vulnerabilities in their software, this type of pharming attack is increasingly attractive for fraudsters. This attack affects all devices accessing the infected router from the local network, including computers, tablets and mobile devices.

Trusteer Rapport has demonstrated zero-day protections against this type of attack. Rapport verifies the secure communication between the browser and the online banking application, thus eliminating the threat transparently without requiring any involvement from the end user. Rapport’s protection extends to defend all devices running Trusteer Rapport, despite the attack occurring on the router and not the end user’s machine. With Rapport, customers are one step ahead of pharmers with the ability to prevent an attack before it even happens.

Read the white paper: Accelerating growth and digital adoption with seamless identity trust