← IGCSE Computer Science Paper 1

Pharming

An attack that redirects a user to a fake website, even when they type the right address, using malicious code or DNS poisoning, so the site can steal their login and payment details.

Part of: IGCSE Computer Science 0478 — 5.3 Cyber Security — Module 20, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 33, WA Computer Science ATAR Year 11 — Cyber Security — Module 45

Understanding Pharming in IGCSE Computer Science Paper 1

What it does: The code changes where the address leads, so the correct web address ends up at the attacker's fake website. With pharming the user types the correct address and is still redirected. Phishing relies on the user being tricked into clicking a link or opening a message. The fake site looks genuine so that users enter their login and payment details, which the attacker then steals. The redirect comes from malicious code or poisoned DNS records, not from how the user typed. The key feature of pharming is that the redirection happens even when the address is typed correctly.

Common mistakes: The program should look up the typed address stored in the variable address. Putting it in quotes looks up the word "address" instead. It should be ip ← lookup(address). An IF statement must end with THEN. The line should be IF dns_record = fake_ip THEN.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Pharming to a class →

This module's key terms are also in a printable crossword (Modules 520–546) and word search (Modules 510–546).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A student types the correct web address of their bank, but lands on a fake site that looks identical. Which attack is this?
PharmingBrute-force attack
Matches
Pharming happens when a user mistypes a web address and lands on a similar site.
↓
This describes typosquatting, not pharming. In pharming the user types the correct address and is still redirected by malicious code or DNS poisoning.
Applying
Meanings
Term
pharming
Meaning
An attack that redirects a user to a fake website, even when they type the right address, using malicious code or DNS poisoning, so the site can steal their login and payment details.
Practice
User types the correct web address
Testing
Gaps
dns["mybank.com"] ←
Check Answer
Spots
1address ← "www.mybank.com"
2ip ← lookup("address")

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Ermine' badge — Tundra Streak, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A student types the correct web address of their bank, but lands on a fake site that looks identical. Which attack is this?
A. Brute-force attack
B. Pharming ✓
Pharming redirects users to a fake website even when they type the correct address.
2. How can pharming be carried out?
A. Malicious code on the computer redirects the user to a fake site ✓
B. The attacker tries every possible password until one works
Pharming uses malicious code on the user's computer, or changes to DNS records, to send them to a fake site.
3. What is DNS poisoning?
A. Changing DNS records so a real web address points to a fake site's IP address ✓
B. Flooding a server with so many requests that it crashes
DNS poisoning alters DNS records, so the real address leads to the attacker's fake website. Flooding a server is a DoS attack.
4. What is the main aim of a pharming attack?
A. To make the real website run faster for users
B. To steal login and payment details entered on the fake site ✓
The fake site looks genuine so that users enter their login and payment details, which the attacker then steals.
5. Which statement about pharming and phishing is correct?
A. Pharming redirects the user automatically, but phishing needs the user to act on a message ✓
B. Pharming and phishing both rely on the user clicking a link in an email
Phishing tricks users with messages, such as a link in an email. Pharming redirects them without any message or click.

Match the Pairs

pharming → An attack that sends a user to a fake website even when they type the correct address
DNS poisoning → Changing DNS records so a real web address points to the IP address of a fake website
Malicious code installed on a computer can redirect the user to a fake site when they type a real address → bank.com -> fake IP address
Pharming is different from phishing because the user does not need to click a link in a message → type www.shop.com -> fake site
Pharming happens when a user mistypes a web address and lands on a similar site. → This describes typosquatting, not pharming. In pharming the user types the correct address and is still redirected by malicious code or DNS poisoning.
Pharming sends fake emails to trick users into clicking a link. → This describes phishing. Pharming redirects users to a fake website using malicious code or DNS poisoning, without needing a message.

Key Term

pharming
An attack that redirects a user to a fake website, even when they type the right address, using malicious code or DNS poisoning, so the site can steal their login and payment details.

Fill in the Blanks

1. fakeIP ← "203.0.113.9" dns["mybank.com"] ← fakeIP
Hint: Type the variable that holds the attacker's server address, so the real domain name now points to the fake site.
2. realIP ← "192.0.2.5" IF lookup(url) ≠ realIP THEN OUTPUT "Possible pharming"
Hint: Type the variable that stores the genuine address, which a poisoned DNS record would no longer match.
3. url ← "mybank.com" ip ← lookup(url) OUTPUT ip
Hint: Type the variable that holds the IP address returned by the DNS lookup, the result an attacker would poison.
4. attack ← "pharming" clicksLink ← FALSE redirected ← TRUE
Hint: Type the Boolean value showing that pharming, unlike phishing, does not need the user to click a bad link.
5. IF fakeSite AND userLogsIn THEN steal(username, password) ENDIF
Hint: Type the logical operator that needs both conditions to be true before the fake site can steal details.

Spot the Error

Question 1
A address ← "www.mybank.com"
B ip ← lookup("address")
C OPEN ip
Line B — The program should look up the typed address stored in the variable address. Putting it in quotes looks up the word "address" instead. It should be ip ← lookup(address).
Question 2
A IF dns_record = fake_ip
B OUTPUT "Fake site"
C ENDIF
Line A — An IF statement must end with THEN. The line should be IF dns_record = fake_ip THEN.
Question 3
A real_ip ← "198.51.100.4"
B fake_ip ← "203.0.113.9"
C cache["bank.com"] ← real_ip
Line C — In DNS poisoning the attacker stores the FAKE IP address in the cache so the bank's name leads to the fake site. It should be cache["bank.com"] ← fake_ip.
Question 4
A typed_correct ← TRUE
B redirected ← TRUE
C attack ← "phishing"
Line C — The user typed the correct address but was still redirected, which is pharming. Phishing relies on fake emails or links. It should be attack ← "pharming".
Question 5
A fake_ip ← "203.0.113.9"
B hosts[fake_ip] ← "mybank.com"
C OPEN "mybank.com"
Line B — Malicious code changes the hosts file so the domain name points to the fake IP. The domain is the key and the fake IP is the value: hosts["mybank.com"] ← fake_ip.

Student with a class code? Join your class →