AS & A Level Computer Science 9618: Pharming, Firewalls and Anti-Malware

GreenLeaf Grocers runs an online store at www.greenleafgrocers.com. Last week, several customers reported that after typing this address correctly into their browser themselves, without clicking any link in an email or message, they were taken to a convincing fake copy of the checkout page that asked for their payment card details. Investigators later found that malicious software running on GreenLeaf's own DNS server had altered the records used to direct traffic for the site, so that the correct web address now pointed to a server controlled by an attacker.

(a) Name this type of attack, and explain one way in which it is different from phishing. [2]

(b) Explain how installing a firewall on GreenLeaf's network could help to reduce the risk of an attacker being able to reach the DNS server and alter its records in the first place. [2]

(c) State one other technical measure, other than a firewall, that GreenLeaf could use to detect and remove the malicious software that altered the DNS records, and explain how it works. [2]

Part (a): Naming the attack

This is an example of pharming. In pharming, an attacker corrupts the records (in this case, on the DNS server) that a network uses to direct a correctly typed web address to the right server, so that the address now silently points somewhere else, a server the attacker controls.

This is different from phishing in an important way: the customers typed the genuine address themselves and did not click any link in an email or message. Phishing depends on tricking a user into clicking a deceptive link to reach a fake site; pharming redirects the user automatically, even when they type the correct address directly, because the underlying records used to route that address have been altered.

[2 marks]: [1] for correctly naming pharming, [1] for explaining that pharming redirects users automatically (via altered records) rather than relying on a clicked link, unlike phishing.

Part (b): How a firewall reduces the risk

A firewall sits between GreenLeaf’s internal network, which includes the DNS server, and external networks such as the internet. It examines network traffic attempting to cross this boundary and checks it against a set of rules, allowing traffic that meets the rules through and blocking traffic that does not.

If the firewall is configured to block unauthorised inbound connection attempts to the DNS server. For example, connections from unrecognised external addresses, or on ports/services the server does not need to expose to the internet. It becomes much harder for an outside attacker to establish the remote connection needed to install malicious software on the server and alter its DNS records in the first place.

[2 marks]: [1] for correctly describing a firewall as monitoring/filtering network traffic against a set of rules, [1] for explaining how blocking unauthorised inbound connections reduces the attacker’s ability to reach and compromise the DNS server.

Part (c): Detecting and removing the malicious software

A suitable additional measure is anti-malware (anti-virus/anti-spyware) software installed on the DNS server itself. This software scans the files stored on, or running on, the server, either when requested or continuously in the background, and compares them against a regularly updated database of known malware signatures, or checks for suspicious behaviour typical of malware. Any file identified as malicious is quarantined (isolated so it cannot run) or deleted, which removes the software that was altering the DNS records.

[2 marks]: [1] for naming anti-malware/anti-virus/anti-spyware software, [1] for explaining that it works by scanning against known signatures/behaviour and then quarantining/deleting anything identified as malicious.

Final answers

(a) Pharming; unlike phishing, no link needs to be clicked. The redirection happens automatically because the routing records themselves have been altered.
(b) A firewall filters network traffic against a set of rules and can block unauthorised inbound connections from reaching the DNS server.
(c) Anti-malware software scans the server for known malware signatures/suspicious behaviour and quarantines or deletes anything it identifies, removing the malicious software.