Cyber security threats: pharming

The idea

Pharming is a cyber attack that redirects a user to a fraudulent website without their knowledge, even when they type the correct address. Instead of relying on the user clicking a bad link (as in phishing), pharming corrupts the link between a web address and the server it should reach. Attackers may tamper with the domain name system so a trusted name resolves to a fake server, or install malware on the victim's device that silently swaps the real site for a copy. The fake page often mimics a bank or shop to harvest logins and card details. Learners should recognise pharming from a description, distinguish it from phishing, and explain how redirection happens and why it is hard to spot.

What earns the marks

• Pharming redirects a user to a fraudulent website without the user's knowledge or action.
• One method is tampering with the domain name system so a trusted domain name resolves to a fake server.
• Another method is malware on the device that silently redirects the browser to a counterfeit site.
• The purpose is usually to steal credentials or financial details by imitating a trusted site.
• Pharming is hard to detect because the address bar may still show the expected, correct-looking name.

Common mistakes and how to put them right

• Confusing pharming with phishing.

  Put it right: Phishing relies on the user clicking a deceptive link or message, whereas pharming redirects the user automatically even with a correct address.

• Assuming pharming always changes the visible web address.

  Put it right: In many cases the address looks correct because the name resolution itself has been corrupted.

• Thinking pharming is a type of virus only.

  Put it right: Malware is one route, but DNS tampering is a separate route that needs no malware on the victim's device.

Exam tips

• Define pharming in one sentence, then give a concrete method such as DNS tampering or on-device malware redirection.
• Contrast it explicitly with phishing so the examiner sees you know the difference in how the victim is drawn in.
• Link the attack to its motive, for example harvesting bank logins, to show why it is a security threat.