Trusted IP Address Reconnection for Pharming Attack Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Pharming attacks, which modify DNS or hosts file information, hinder connections to update servers, making it difficult to detect and counter malicious code infections, leading to information loss and failed updates.
Innovation Solution
An apparatus and method that connect to an update server using a pre-stored domain name address, acquire and store the corresponding IP address, and reestablish the connection using a trusted IP address if the initial connection fails, either due to DNS query failures or hosts file modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If DNS information or hosts file is modified during pharming attacks, then connection to fake web servers is enabled, but connection to legitimate update servers fails
Solution Approach 1:
The system performs preliminary actions by storing both domain name addresses and their corresponding IP addresses in advance. When connection is needed, it first attempts to connect using the domain name, and if that fails due to hosts file modification, it has the pre-stored IP address ready as a backup, enabling successful connection to the legitimate update server despite pharming attacks.
Solution Approach 2:
The system prepares compensatory measures in advance by maintaining a backup mechanism of pre-stored IP addresses. This cushioning mechanism ensures that if the primary domain-based connection method is compromised by pharming attacks, the system can switch to using the pre-prepared IP address to maintain connection reliability to update servers.
2Ease of operation
If domain name address is used for connection, then ease of operation is maintained, but vulnerability to pharming attacks increases
Solution Approach 1:
The system introduces an intermediary verification mechanism that checks whether the IP address obtained through domain name resolution matches the pre-stored trusted IP address. This intermediary check acts as a mediator between the ease of domain-based connection and the need to prevent pharming attacks, allowing the system to use domain names for simplicity while verifying legitimacy through IP address comparison.
Solution Approach 2:
The system implements feedback by comparing the IP address obtained through DNS resolution with the pre-stored trusted IP address. If they match, the connection proceeds; if they don't match (indicating possible pharming attack), the system can reject the connection or switch to using the pre-stored IP address directly, providing a feedback-based security mechanism that maintains both ease of operation and attack resistance.
3Object-affected harmful factors
If hosts file modification is undetectable, then pharming attacks become more effective, but ability to detect and counter attacks is reduced
Solution Approach 1:
The system creates a copy of the trusted IP address information and stores it in advance. By having this copy available, the system can compare it against the IP address obtained through domain resolution, effectively creating a detection mechanism that identifies when hosts file modification has occurred, thereby counteracting the undetectability of pharming attacks.
Data Source
AI summary
An apparatus for connecting to an update server includes an update unit configured to connect to the update server over a network using a pre-stored domain name address of the update server and an IP address acquisition unit configured to acquire an IP address of the connected update server. The IP address acquired by the IP address acquisition unit is stored as a trusted IP address in a storage unit. The apparatus further includes a reconnection processing unit configured to fetch the trusted IP address of the update server and try connecting to the update server using the trusted IP address in the case of failure to connect to the update server using the pre-stored domain name address.