[REVS] Understanding and Preventing DNS-related Attacks by Phishers

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Understanding and Preventing DNS-related Attacks by Phishers
------------------------------------------------------------------------


SUMMARY

Exploiting well known flaws in DNS services and the way in which host 
names are resolved to IP addresses, Phishers have upped the ante in the 
cyber war for control of a customer's online identity for financial gain.

A grouping of attack vectors now referred to as "Pharming", affects the 
fundamental way in which a customer's computer locates and connects to an 
organisations online offering. Enabling the Pharmer to reach wider 
audiences with less probability of detection than their Phishing 
counterparts, pharming attacks are capable of defeating many of the latest 
defensive strategies used customer and online retailer alike.

This paper, extending the original material of "The Phishing Guide", 
examines in depth the workings of the name services of which 
Internet-based customers are dependent upon, and how they can be exploited 
by Pharmers to conduct identity theft and financial fraud on a massive 
scale.

DETAILS

Background:
This paper focuses upon a recent group of attack vectors used by criminals 
to target an organization's customers for identity theft and financial 
fraud. Closely related to Phishing attacks, this new attack manipulates 
the ways in which a customer locates and connects to an organization's 
named hosts or services through modification of the name lookup process.

The attack vectors, commonly referred to as Pharming, have the ability to 
bypass many traditional Phishing attack prevention tools and affect larger 
segments of an organizations customer-base.
Given the apparent complexity of this attack vector, this paper seeks to 
carefully explain many of the background processes all Internet-based 
customers use on a daily basis to connect to an organizations commercial 
service, and examines how frailties in them can be exploited by an 
attacker to conduct a Pharming attack.

Readers should ensure that they fully understand how traditional Phishing 
attacks are
conducted and the defensive strategies that have been adopted in the past 
to protect against them. Ideally the reader should be familiar with the 
author's previous paper "The Phishing Guide" as several sections of this 
paper reference information contained within the earlier whitepaper.

To read more about the guide please visit:  
<http://www.ngssoftware.com/papers/ThePharmingGuide.pdf> 
http://www.ngssoftware.com/papers/ThePharmingGuide.pdf


ADDITIONAL INFORMATION

The information has been provided by  <mailto:nisr@xxxxxxxxxxxxx> 
NGSSoftware Insight Security Research .
The original article can be found at:  
<http://www.ngssoftware.com/papers/ThePharmingGuide.pdf> 
http://www.ngssoftware.com/papers/ThePharmingGuide.pdf



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@xxxxxxxxxxxxxx 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@xxxxxxxxxxxxxx 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.