Phishers using DNS servers to lure victims?
Security experts warn that "pharming" could be the new frontier for online thieves looking to steal your personal data.
The warning follows reports Friday that some people's computers were being redirected from sites such as eBay and Google to malicious Web servers that attempted to install spyware. The compromises affected 30 to 40 networks, according to Jason Lam (PDF file), incident handler for the Internet Storm Center, which tracks network threats.
incident handler,
Internet Storm Center
"It's hard to tell how many people were impacted by this, but it wasn't very widespread," Lam said Tuesday.
The attacks compromised servers that act as the white pages of the Internet--a key part of cyberspace that's known as the domain name system, or DNS--to replace the numeric addresses of popular Web sites with the addresses of malicious sites run by the attackers. Known as DNS poisoning, the scheme redirects Internet users to bogus sites where they may be asked for sensitive information or have spyware installed on their PCs.
The Internet Storm Center, which represents a group of incident response professionals organized by the SANS Institute, a security training organization, said that a recent flaw in Symantec's firewall and gateway security appliances likely allowed some of the DNS poisoning to occur. However, other sites that do not use Symantec products also were victims, Lam said.
"We haven't really determined what caused this," he said. "We don't have enough reported cases, so it is hard to draw a conclusion from that."
Symantec did not immediately respond to a request for comment.
Using DNS poisoning to redirect customers to sites that appear to be legitimate but actually steal sensitive information is a relatively new threat. Some security companies have called this technique
Lam warned that future attacks, if more adeptly executed, could be nearly undetectable. It's possible users would believe they are going to a legitimate site and would get no indication from their browsers that the site that actually appears is not official.
"In this case, the content of the site was different," he said. "But with DNS poisoning, if they intended to use it for phishing, it would have been very bad."
Lam said that the site certificates used by financial Web sites and other sensitive services would give users some warning that something was amiss.