| Nature | Type | ID | Name |
|---|---|---|---|
| ChildOf | M | 151 | Identity Spoofing |
| CanFollow | S | 98 | Phishing |
| CanFollow | D | 142 | DNS Cache Poisoning |
| CanFollow | D | 543 | Counterfeit Websites |
| CanFollow | D | 611 | BitSquatting |
| CanFollow | D | 630 | TypoSquatting |
| CanFollow | D | 631 | SoundSquatting |
| CanFollow | D | 632 | Homograph Attack via Homoglyphs |
Attacker sets up a system mocking the one trusted by the users. This is usually a website that requires or handles sensitive information.
Attacker sets up a system mocking the one trusted by the users. This is usually a website that requires or handles sensitive information.
| Technique |
|---|
The attacker then poisons the resolver for the targeted site. This is achieved by poisoning the DNS server, or the local hosts file, that directs the user to the original website
The attacker then poisons the resolver for the targeted site. This is achieved by poisoning the DNS server, or the local hosts file, that directs the user to the original website
| Technique |
|---|
When the victim requests the URL for the site, the poisoned records direct the victim to the attackers' system rather than the original one.
When the victim requests the URL for the site, the poisoned records direct the victim to the attackers' system rather than the original one.
| Technique |
|---|
Because of the identical nature of the original site and the attacker controlled one, and the fact that the URL is still the original one, the victim trusts the website reached and the attacker can now "farm" sensitive information such as credentials or account numbers.
Because of the identical nature of the original site and the attacker controlled one, and the fact that the URL is still the original one, the victim trusts the website reached and the attacker can now "farm" sensitive information such as credentials or account numbers.
| Technique |
|---|
The attacker needs to be able to poison the resolver - DNS entries or local hosts file or router entry pointing to a trusted DNS server - in order to successfully carry out a pharming attack. Setting up a fake website, identical to the targeted one, does not require special skills.
| Scope | Likelihood | Impact | Note |
|---|---|---|---|
| Confidentiality | N/A | Read Data | N/A |
| Taxonomy Name | Entry ID | Entry Name |
|---|