METHOD AND SYSTEM FOR DNS-BASED ANTI-PHARMING

• US 20080060054A1
• Filed: 09/04/2007
• Published: 03/06/2008
• Est. Priority Date: 09/05/2006
• Status: Abandoned Application

• Current Assignee: Cyveillance, Inc. (ZeroFox Holdings, Inc.)
• Original Assignee: Cyveillance, Inc. (ZeroFox Holdings, Inc.)
• Inventors: SRIVASTAVA, Manoj
• Application Number:
  US11/849,478
• Publication Number:
  US 20080060054A1
• Time in Patent Office: Days
• US Class Current: 726/2
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic

Abstract

A method and system for discovering domain name system (DNS) pharming, comprising: obtaining an answer to a question from two different sources; comparing the answers; determining that the technology is not suspect when the answer is the same; and determining that the technology is suspect when the answer is different.

Claims

1. A method of discovering domain name system (DNS) pharming, comprising:

obtaining a Web address from a user'"'"'s computer in an Internet application;

requesting a DNS resolver on the user'"'"'s computer and/or the network to which the computer is connected to resolve the Web address to an IP address;

requesting a third-party DNS server to resolve the same Web address to an IP address;

comparing the IP addresses returned by the DNS resolver and the IP address returned by the third-party DNS server; and

determining the Web address is being pharmed when the compared IP addresses are different.

2. The method of claim 1, further comprising alerting the user the Web address is being pharmed.

3. The method of claim 1, further comprising:

determining that the Web address is not being pharmed when the compared IP addresses are the same.

4. A method for discovering domain name system (DNS) pharming, comprising:

obtaining an answer to a question from two different sources;

comparing the answers;

determining that the technology is not suspect when the answer is the same; and

determining that the technology is suspect when the answer is different.

5. The method of claim 4, wherein the question is “

What IP address corresponds to a Web address?”

6. The method of claim 5, wherein the answer is the IP address that corresponds to the Web address.

7. The method of claim 6, wherein the two different sources are a) a DNS resolver on a user'"'"'s computer and/or the network to which the computer is connected and b) a third-party DNS server.

8. A system for discovering domain name system (DNS) pharming, comprising:

a server coupled to a network;

a database accessible by the server; and

an application coupled to the server, the application configured for;

obtaining a Web address from a user'"'"'s computer in an Internet application;

requesting a DNS resolver on the user'"'"'s computer and/or the network to which the computer is connected to resolve the Web address to an IP address;

requesting a third-party DNS server to resolve the same Web address to an IP address;

comparing the IP addresses returned by the DNS resolver and the IP address returned by the third-party DNS server; and

determining the Web address is being pharmed when the compared IP addresses are different.

9. The system of claim 8, wherein the application further comprises:

alerting the user the Web address is being pharmed.

10. The system of claim 8, wherein the application further comprises:

determining that the Web address is not being pharmed when the compared IP addresses are the same.

11. A system for discovering domain name system (DNS) pharming, comprising:

a server coupled to a network;

a database accessible by the server; and

an application coupled to the server, the application configured for;

obtaining an answer to a question from two different sources;

comparing the answers;

determining that the technology is not suspect when the answer is the same; and

determining that the technology is suspect when the answer is different.

12. The system of claim 11, wherein the question is “

What IP address corresponds to a Web address?”

13. The system of claim 12, wherein the answer is the IP address that corresponds to the Web address.

14. The system of claim 13, wherein the two different sources are a) a DNS resolver on a user'"'"'s computer and/or the network to which the computer is connected and b) a third-party DNS server.