Pharming

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A student types the correct web address of their bank, but lands on a fake site that looks identical. Which attack is this?

A Brute-force attack

B Pharming

2. How can pharming be carried out?

A Malicious code on the computer redirects the user to a fake site

B The attacker tries every possible password until one works

3. What is DNS poisoning?

A Changing DNS records so a real web address points to a fake site's IP address

B Flooding a server with so many requests that it crashes

4. What is the main aim of a pharming attack?

A To make the real website run faster for users

B To steal login and payment details entered on the fake site

5. Which statement about pharming and phishing is correct?

A Pharming redirects the user automatically, but phishing needs the user to act on a message

B Pharming and phishing both rely on the user clicking a link in an email

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1pharming		AThis describes phishing. Pharming redirects users to a fake website using malicious code or DNS poisoning, without needing a message.
2DNS poisoning		BThis describes typosquatting, not pharming. In pharming the user types the correct address and is still redirected by malicious code or DNS poisoning.
3Malicious code installed on a computer can redirect the user to a fake site when they type a real address		Ctype www.shop.com -> fake site
4Pharming is different from phishing because the user does not need to click a link in a message		DChanging DNS records so a real web address points to the IP address of a fake website
5Pharming happens when a user mistypes a web address and lands on a similar site.		Ebank.com -> fake IP address
6Pharming sends fake emails to trick users into clicking a link.		FAn attack that sends a user to a fake website even when they type the correct address

Definitions

pharming

Fill in the Blanks

Complete each line of code by filling in the missing parts.

fakeIP ← "203.0.113.9" dns["mybank.com"] ← ______

realIP ← "192.0.2.5" IF lookup(url) ≠ ______ THEN OUTPUT "Possible pharming"

url ← "mybank.com" ip ← lookup(url) OUTPUT __

attack ← "pharming" clicksLink ← _____ redirected ← TRUE

IF fakeSite ___ userLogsIn THEN steal(username, password) ENDIF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A address ← "www.mybank.com"

B ip ← lookup("address")

C OPEN ip

Question 2

A IF dns_record = fake_ip

B OUTPUT "Fake site"

C ENDIF

Question 3

A real_ip ← "198.51.100.4"

B fake_ip ← "203.0.113.9"

C cache["bank.com"] ← real_ip

Question 4

A typed_correct ← TRUE

B redirected ← TRUE

C attack ← "phishing"

Question 5

A fake_ip ← "203.0.113.9"

B hosts[fake_ip] ← "mybank.com"

C OPEN "mybank.com"

Answer Key

Pharming

Section A: Quick Questions

B — Pharming

A — Malicious code on the computer redirects the user to a fake site

A — Changing DNS records so a real web address points to a fake site's IP address

B — To steal login and payment details entered on the fake site

A — Pharming redirects the user automatically, but phishing needs the user to act on a message

Section B: Match the Pairs

pharming → An attack that sends a user to a fake website even when they type the correct address

DNS poisoning → Changing DNS records so a real web address points to the IP address of a fake website

Malicious code installed on a computer can redirect the user to a fake site when they type a real address → bank.com -> fake IP address

Pharming is different from phishing because the user does not need to click a link in a message → type www.shop.com -> fake site

Pharming happens when a user mistypes a web address and lands on a similar site. → This describes typosquatting, not pharming. In pharming the user types the correct address and is still redirected by malicious code or DNS poisoning.

Pharming sends fake emails to trick users into clicking a link. → This describes phishing. Pharming redirects users to a fake website using malicious code or DNS poisoning, without needing a message.

Section C: Definitions

pharming — An attack that redirects a user to a fake website, even when they type the right address, using malicious code or DNS poisoning, so the site can steal their login and payment details.

Section D: Fill in the Blanks

fakeIP ← "203.0.113.9"
dns["mybank.com"] ← fakeIP

realIP ← "192.0.2.5"
IF lookup(url) ≠ realIP THEN
    OUTPUT "Possible pharming"

url ← "mybank.com"
ip ← lookup(url)
OUTPUT ip

attack ← "pharming"
clicksLink ← FALSE
redirected ← TRUE

IF fakeSite AND userLogsIn THEN
    steal(username, password)
ENDIF

Section E: Spot the Error

B — The program should look up the typed address stored in the variable address. Putting it in quotes looks up the word "address" instead. It should be ip ← lookup(address).

A — An IF statement must end with THEN. The line should be IF dns_record = fake_ip THEN.

C — In DNS poisoning the attacker stores the FAKE IP address in the cache so the bank's name leads to the fake site. It should be cache["bank.com"] ← fake_ip.

C — The user typed the correct address but was still redirected, which is pharming. Phishing relies on fake emails or links. It should be attack ← "pharming".

B — Malicious code changes the hosts file so the domain name points to the fake IP. The domain is the key and the fake IP is the value: hosts["mybank.com"] ← fake_ip.