Defeating pharming attacks at the client-side

Sophie Gastellier-Prevost (1, 2, 3) , Maryline Laurent (4, 1, 2, 3)

1 TSP - RST - Département Réseaux et Services de Télécommunications
2 SAMOVAR - Services répartis, Architectures, MOdélisation, Validation, Administration des Réseaux
3 CNRS - Centre National de la Recherche Scientifique
4 R3S-SAMOVAR - Réseaux, Systèmes, Services, Sécurité

With the deployment of "always-connected" broadband Internet access, personal networks are a privileged target for attackers and DNS-based corruption. Pharming attacks - an enhanced version of phishing attacks - aim to steal users' credentials by redirecting them to a fraudulent login website, using DNS-based techniques that make the attack imperceptible to the end-user. In this paper, we define an advanced approach to alert the end-user in case of pharming attacks at the client-side. With a success rate over 95%, we validate a solution that can help differentiating legitimate from fraudulent login websites, based on a dual-step analysis (IP address check and webpage content comparison) performed using multiple DNS servers information

Mots clés: Pharming; Webpage content; DNS

Domaines: Réseaux et télécommunications [cs.NI]

Sophie Gastellier-Prevost, Maryline Laurent. Defeating pharming attacks at the client-side. NSS 2011 : 5th International Conference on Network and System Security, Sep 2011, Milan, Italy. pp.33 - 40, ⟨10.1109/ICNSS.2011.6059957⟩. ⟨hal-01303641⟩