We describe a new attack against web authentication, which we call dynamic pharming. Dynamic pharming works by hijacking DNS and infecting the victims browser with malicious Javascript, which then exploits the name-based same-origin policy to hijack a legitimate session after authentication has taken place. As a result, the attack works regardless of the authentication scheme used. Dynamic pharming enables the adversary to eavesdrop on sensitive content, forge transactions, key logsecondary passwords, etc.
