Patent Application
20080060054
Pharming is a hacker's attack aiming to redirect a Web site's traffic to another (bogus) Web site. Pharming can be conducted either by changing the host file on a victim's computer or by exploitation of a vulnerability in domain name system (DNS) server software. DNS servers are computers responsible for resolving Internet names into their real addresses—they are the “signposts” of the Internet. Compromised DNS servers are sometimes referred to as “poisoned”.
How DNS Works
Useful for several reasons, DNS makes it possible to attach easy-to-remember hostnames (such as “cyveillance.com”) to hard-to-remember IP addresses (such as 38.100.19.13). Humans take advantage of this when they recite URLs and e-mail addresses instead of IP addresses.
Users generally don't communicate directly with a DNS server. Instead DNS resolution takes place transparently in client applications such as Web browsers, email clients and other Internet applications. Referring to
The local DNS resolver 105 first looks up the IP address in a hosts file 110 (i.e., a file in most operating systems which has a mapping between Web addresses (such as example.com) and the corresponding IP addresses (such as 192.0.34.166)) to find the hostname to IP address mapping. If the answer is not found in the hosts file 110, the local DNS resolver sends the resolution, request to a designated DNS caching server 115. For most home users the DNS caching server 115 is hosted by their ISP. Some businesses also use DNS caching servers 115 hosted by their ISPs. Others host and administer their own DNS caching servers 115.
The DNS caching server 115 looks in its local cache 120 to see if it has the answer for the resolution request. For performance, scalability, and other reasons, DNS caching servers cache the answer of recent DNS queries in the local cache 120. If the answer is not found in the local cache 120, the DNS caching server queries an authoritative DNS server 145, which is authoritative for a certain domain. This information is obtained by the DNS caching server 115 by traversing the DNS hierarchy for that domain starting at the root DNS server. For example; to resolve www.cyveillance.com, the DNS caching server will query the authoritative DNS server 135 for the root. If the root authoritative DNS server 125 does not know the IP address for www.cyveillance.com, it will tell the DNS caching server 115 who to query to find this answer. In this example, the root authoritative DNS server 125 indicates that IP address 192.5.6.30 may know the IP address for cyveillance.com. The DNS caching server 115 can then query IP address 192.5.6.30, which is the .com authoritative DNS server 145 to resolve cyveillance.com. If the .com authoritative DNS server 135 does not know the requested IP address for cyveillance.com, it can indicate that IP address 205.171.9.242 may know the IP address for www.cyveillance.com. The DNS caching server 115 will then query IP address 205.17.1.9.242, the www.cyveillance.com authoritative DNS server 145, which knows that the IP address of the host www.cyveillance.com, is 38.100.19.13. Subsequent queries for this hostname to the DNS caching server 115 will be immediately resolved by the cached answer in the local cache 120 until the cached answer expires, as determined by time-to-live (TTL) attribute of the cyveillance.com domain set by the DNS administrator of that domain.
How Pharming Attacks are Carried Out
Malicious domain name resolution can result from compromises in large numbers of trusted nodes that participate in name resolution. As shown by 215, incorrect entries in the victim's computer's hosts file 110, which circumvents DNS name resolution with its own local name to IP address mapping, is a popular target for malware (malicious software).
As shown by 210, compromise of a local network router 220 can also induce pharming attacks. Since most routers 220 specify a trusted DNS caching server to clients as they join the network, misinformation here will spoil hostname lookups for the entire Local Area Network (LAN). Unlike host file rewrites, local router compromise is difficult to detect. Nearly every router 220 allows its administrator to specify a particular trusted DNS caching server in place of the one suggested by an upstream node (e.g., the ISP). An attacker could specify the DNS server under his control. All subsequent hostname resolutions will go through the bad server. Alternatively, many routers have the ability to replace their firmware. Like malware on the desktop systems, a firmware replacement can be very difficult to detect. The ubiquity of consumer grade wireless routers presents a massive vulnerability. Administrative access is available wirelessly on most of these devices. Moreover, since these routers often work with their default settings, administrative passwords are commonly unchanged. Even when altered, many are guessed quickly through dictionary attacks, since most consumer grade routers don't introduce timing penalties for incorrect login attempts.
As shown by 205, pharming attacks can also be propagated via DNS cache poisoning. This is a technique that tricks a DNS caching server 115 into believing it has received authentic information as part of a hostname resolution request issued by it when, in reality, it has not. Once the DNS caching server 115 has been poisoned, the information is generally cached for a while, spreading the effect of the attack to other users of the DNS caching server.
Normally, an Internet-connected computer uses a DNS caching server 115 provided by the computer owner's Internet Service Provider (ISP). This DNS caching server 115 generally serves the ISP's own customers only and contains DNS information cached by previous users of the server. A poisoning attack on a single ISP DNS caching server 115 can affect the users serviced directly by the compromised DNS caching server 115.
System and Method for Anti-Pharming
While various embodiments have been described above, it should be understood that they have been presented by way of example, and not limitation. It will be apparent to persons skilled in the relevant art(s) that various changes in form and detail can be made therein without departing from the spirit and scope. In fact, after reading the above description, it will be apparent to one skilled in the relevant art(s) how to implement alternative embodiments. Thus, the present embodiments should not be limited by any of the above described exemplary embodiments.
In addition, it should be understood that any figures which highlight the functionality and advantages, are presented for example purposes only. The disclosed architecture is sufficiently flexible and configurable, such that it may be utilized in ways other than that shown. For example, the steps listed in any flowchart may be re-ordered or only optionally used in some embodiments.
Further, the purpose of the Abstract of the Disclosure is to enable the U.S. Patent and Trademark Office and the public generally, and especially the scientists, engineers and practitioners in the art who are not familiar with patent or legal terms or phraseology, to determine quickly from a cursory inspection the nature and essence of the technical disclosure of the application. The Abstract of the Disclosure is not intended to be limiting as to the scope in any way.
Finally, it is the applicant's intent that only claims that include the express language “means for” or “step for” be interpreted under 35 U.S.C.112, paragraph 6. Claims that do not expressly include the phrase “means for” or “step for” are not to be interpreted under 35 U.S.C.112, paragraph 6.
This application claims the benefit of U.S. Provisional Application No. 60/824,521, filed Sep. 5, 2006, and entitled “SYSTEM AND METHOD FOR DNS-BASED ANTI-PHARMING,” which is hereby incorporated by reference in its entirety.
| Number | Date | Country | |
|---|---|---|---|
| 60824521 | Sep 2006 | US |
