As an outsource security partner BAI provides managed security, managed firewall, managed ids, content filtering, internet security, network security, penetration testing, and vulnerability testing.

First there were Phishing scams, in which Hackers tricked unwary internet users one by one into compromising their personal data. Now the latest con, Pharming, threatens to reel in entire schools of new victims.

Pharmers simply redirect as many users as possible from the legitimate commercial websites they'd intended to visit and lead them to malicious ones. The bogus sites, to which victims are redirected without their knowledge or consent, will likely look the same as a genuine site. But when users enter their login name and password, the information is captured by criminals.

Pharming uses vulnerabilities within PCs to propagate viruses that modify configuration files, which in turn automatically redirect unsuspecting users to fraudulent sites.

Viruses like the Banker Trojan, have been used to conduct smaller-scale pharming attacks. These viruses modify a PC configuration file called a Host file that converts standard URLs into the numeric strings a computer understands. A computer with a compromised host file will go to the wrong website even if a user types in the correct URL.

The most alarming Pharming threat is DNS Poisoning, which can cause a large group of users to be redirected to bogus sites.  The Domain Name System (DNS) translates web and e-mail addresses into numerical strings, acting as a sort of telephone directory for the internet.  If a DNS directory is "poisoned" or altered to contain false information regarding which web address is associated with what numeric string, users can be silently redirected to bogus websites even if they type in the correct URL.

“DNS poisoning is not new and has been around for many years, but the impact of such attacks has heighten awareness and therefore the frequency has declined,” said Michael Bruck, President of BAI Security.  “With that said, we still find a surprising high number of such vulnerable systems within business environments and I suspect the home consumer’s PC is significantly more vulnerable.”

Phishing is essentially an old con game updated to take advantage of new technology. Similarly, although DNS attack tactics used by pharmers have been around for a while, the rise in internet banking, online shopping and electronic bill paying has created a wide potential profit zone for criminals eager to snag login information and credit card and bank account numbers.

According to information provided by the SANS Internet Storm Center and internet-monitoring firm Netcraft, this past summer would-be pharmers attempted to exploit a known vulnerability in Symantec's firewall, redirecting some users from eBay, Google and weather.com to three sites that attempted to install spyware on visitors' computers.

While this particular attack was not overly successful, it is very likely a sign of things to come.