Phishing & Pharming

Devendra Yadav31/05/2007

Introduction11

Phishing Techniques22

Pharming Techniques33

Phishing Statistical Highlights44

Phishing/Pharming Demo55

In Computing both Phishing and Pharming are criminal activity

Both Phishing and Pharming are methods used to steal personal information over the Internet

User Id/Password Credit Card Number PIN

Phishing is typically carried out using email or an instant message, and often directs users to give details at a website

Pharming is a hacker's attack aiming to redirect a website's traffic to another (bogus) website.

Pharming is more dangerous than Phishing

In Phishing incorrect client request is sent and if user is little bit intelligent he/she can identify it very easily

In Pharming correct Client request is sent and that get redirected to wrong server. So identifying it is difficult for intelligent users also

Hacker Creates Fake website

Send link of website to user using mail/instant messaging

User opens link provided by Hacker

User start sending/receiving information from Fake website

Hacker 1

Fake website

Technique -1 Link manipulationIn this technique hackers manipulate links in such manner that it’s difficult for user to identify whether is page is served form correct website or fake website. Few of such techniques are 1. Misspelled URLs e.g. http://www.0rkut.com

2. Sub domains e.g. http://www.yourbank.com.example.com/ 3. Using “@” e.g. http://www.google.com@members.tripod.com/

Technique -2 Website forgeryIn this technique hackers alter the address bar 1. Hiding Address bar 2. Altering the content of Address bar using scripts 3. putting image with legitimate URL over address bar

In Pharming attackers try to redirect the user’s requests (web traffic) to a bogus website, for doing this commonly used techniques are:

◦ Altering Host File Host File location

%windir%/system32/drivers/etc/hosts (Windows) /etc/hosts (Unix) Sample Host file

◦ Hijacking DNS Server/Local Network Router

Web ServerIP : 64.233.187.99

google.com

64.233.187.99

google.com1

IP add. is not specified in Host file

IP add. is specified in Host file

DNS & Host File

Number of unique phishing reports received in April: 23656 Number of unique phishing sites received in April: 55643 Number of brands hijacked by phishing campaigns in April: 172 Country hosting the most phishing websites in April: United States No hostname just IP address: 6 % Percentage of sites not using port 80: 1.5 % Average time online for site: 3.8

days Longest time online for site: 27 days

Source: APWG(http://www.antiphishing.org)

1. United State 28.44%2. France 26.9%3. Republic of Korea 21.05%,4. Romania 2.04%5. China 1.9%6. Germany 1.9%7. Russia 1.75%8. United Kingdom 1.46%9. Turkey 1.46%,10. Netherlands 1.17%.

Source: APWG(http://www.antiphishing.org)

Live Phishing URLs http://website.lineone.net/~farrago/cia/phish/ebay2.htm http://www.popsite-almere.nl/fotos/nieuws/data/

www.anz.com/anzbank/ANZ/Bankmain.htm http://posssit.freehostia.com/bancoposta.online.it/bpol/

poste//login-privati1.html http://www.safe-surf.org/cgi-bin/cgiproxy/nph-proxy.pl/

000100A/http/www.myspace.com/ http://halifax-online-co-uk.idiotica.co.uk/_mem_/

formslogin.asp/ http://session-7393533.nationalcity.com.userpro.tw/

corporate/onlineservices/TreasuryMgmt/

Thank You !

Phishing & Pharming

Technology

Phishing, Pharming, and the latest potholes on the Information Highway A Presentation by Ian Loe, CISSP

SDN 3.0 Protegiendo la Red Humana - cisco.com · Protege contra las ultimas amenazas ... Pharming Phishing especial – ingeniería social ... Defensa contra el malware multi-capa

INFLUENCE OF SECURITY AND TRUST ON ELECTRONIC … · banking of its users (e.g. phishing, pharming etc.) might be a source of risk that dissuades ... out the difference between security

Kids and Prescription Drugs (Pharming)

PROTECTION AGAINST PHARMING AND PHISHING ATTACKS …docs.apwg.org/sponsors_technical_papers/easysol_wp_phishing_p... · PROTECTION AGAINST PHARMING AND PHISHING ATTACKS The intention

Phishing, Pharming, and the latest potholes on the Information Highway

Molecular Pharming

SUBSCRIBE NOW MISSION PATWARI 2020 · A. Phishing B. Pharming C. Piracy D. Both (1) and (2) E. None of these . Answer ... Ans – B. Clickjacking SUBSCRIBE NOW MISSION PATWARI 2020

The Pharming Guide - NCC Group€¦ · helped protect against many popular forms of Phishing attack. As has been the case for many years, the thrust and parry between attacker and

PROTECTION AGAINST PHARMING AND PHISHING ATTACKS · Phishing attacks have been increasing over the last years. According to a study conducted by the ... Browsing detects this type

The Pharming Guide

International Telecommunication Union - ITU · of Internet security threats: viruses, phishing, pharming, endless permutations of scams, and advance fee fraud.11 Spam is also harming

At School & On-Line: Helping Students Avoid Security ......Phishing, Pharming & Email Scams • "Phishing” - elicits secure information through an e-mail message that appears to

Cyber risk in advanced manufacturing - deloitte.com · in revenue) report their largest cyber risk concern focuses on phishing and pharming threats, which most often target financial

PREVENTING IDENTITY THEFTlincoln.ne.gov/city/police/crime/TIPS/idtheft.pdf · sonal records, together with the advent of phishing and pharming thefts (see page 5), may well change

Phishing and Pharming New Identity Theft Threats Presentation by Jason Guthrie

Drive-By Pharming - Sid Stammresearch.sidstamm.com/papers/driveby-pharming-icics-slides.pdf · Drive-By Pharming ISP ISP Attacker’s DNS + Web Server ISP’s DNS Server ISP’s Gateway

· Pharming, like Other types Of phishing, aims to gather personal information from the unsuspecting victims; the difference is that pharming does not rely on email solicitation

Phishing & Pharming. 2 Oct. 2004 to July 2005 APWG

protection against pharming and phishing attacks - APWG · PDF filePROTECTION AGAINST PHARMING AND PHISHING ATTACKS ... networks such as Facebook are increasing for which ... A code