An attacker uses a poisoned domain name on the domain name server to navigate users to the attacker's site. Which malicious attack strategy is…

Pharming is a cyberattack that redirects a website's traffic to a fraudulent, malicious site. The scenario describes a common pharming technique where an attacker compromises a Domain Name Server (DNS) and alters a legitimate website's DNS record to point to a malicious IP address. When users attempt to access the legitimate site by typing its domain name, the poisoned DNS server returns the attacker's IP address, transparently redirecting the user to the fake site. This method is effective because the user interacts with the correct domain name, making the deception difficult to spot.

B. Brute-force attack: This is an authentication attack that involves systematically guessing passwords or cryptographic keys until the correct one is found. It does not involve DNS manipulation or traffic redirection.

C. IP address spoofing: This involves forging the source IP address in a packet's header to conceal the sender's identity or impersonate another system, often used in denial-of-service attacks.

D. Session hijacking: This attack involves stealing a user's valid session token or cookie to gain unauthorized access to a system or service after the user has already authenticated.

1. Stallings

W.

& Brown

L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson. In Chapter 7.3

"Phishing and Pharming

" the text states: "A more sophisticated attack is pharming

in which a DNS server is compromised and its tables modified so that requests for a legitimate Web site are redirected to a fraudulent site." (p. 229).

2. Al-Houri

Y.

Al-Hassan

M.

& Al-Shdaifat

A. (2021). A comprehensive survey on pharming attack detection and prevention techniques. Journal of Information Security and Applications

59

102831. Section 2

"Pharming Attack

" defines the attack: "Pharming is a type of cyberattack that redirects a website’s traffic to another

fake site. This is accomplished by poisoning the DNS server or by changing the hosts file on the victim’s computer." https://doi.org/10.1016/j.jisa.2021.102831

3. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. Chapter 8

"Security in Computer Networks

" describes IP spoofing as the act of creating a packet with a false source address (Section 8.6.1) and session hijacking as taking over an ongoing TCP session (Section 8.7.2)

distinguishing them from DNS-based redirection.