[HN Gopher] Block Adware and Malware with /etc/hosts
___________________________________________________________________
Block Adware and Malware with /etc/hosts
Author : feross
Score : 102 points
Date : 2023-06-12 13:24 UTC (9 hours ago)
(HTM) web link (github.com)
(TXT) w3m dump (github.com)
| unethical_ban wrote:
| The only problem with this is that on interface up/down it can
| take a few minutes for the network to be available. This may not
| be an issue with a server or idle desktop but may be confusing
| for non tech people or laptop users.
|
| If you can manage it, a pihole/pivpn instance may be better. Both
| of those can be installed on any debian distro easily.
| star-glider wrote:
| This is the default list used by the pihole project as well; it's
| a very good list.
|
| FWIW, something like ublock origin is going to be better for in-
| browser blocking (for example, DNS poisoning won't work with
| youtube ads, which are served from youtube.com, but addins like
| UBO can remove them because they can hook into the actual
| traffic).
|
| The ultimate adblocking solution is to use UBO in your browsers
| AND spin up a pihole to block ads on your entire network:
| https://pi-hole.net/
| wnevets wrote:
| pi-hole also makes it super easy to block .zip and .mov TLDs.
| ozim wrote:
| Don't forget .com which is executable extension.
| wnevets wrote:
| I'm not worried about the non-techies being tricked into
| thinking .com is an executable, I doubt they even know its
| possible. They almost certainly know about .zips
| eli wrote:
| I still don't understand the threat model here. Is there
| an example of how this could be used as part of an
| attack?
| wnevets wrote:
| https://thehackernews.com/2023/05/dont-click-that-zip-
| file-p...
|
| edit: HN is actually erroring out if I post an example
| .zip domain of the problem
| eli wrote:
| I'm not doubting you can trick people into engaging with
| a phishing site that looks like WinRAR. I just don't
| think the domain makes any difference.
| wnevets wrote:
| You don't think a url like those in this article [1]
| makes any difference? You have more faith stopping
| phishing than I.
|
| [1] https://medium.com/@bobbyrsec/the-dangers-of-googles-
| zip-tld...
| eli wrote:
| If I hover over the link like my phishing training says
| to do, Chrome correctly shows it as "https://v1271.zip"
|
| If I don't bother hovering over the link then the domain
| never mattered at all. Could have hosted the file
| anywhere since the link text in HTML (including HTML
| email) need not have any relation to the destination. You
| can simply write a legitimate github.com link but the
| href goes somewhere else.
|
| Any situation where you're relying on users to visually
| inspect every link and decide if the domain looks
| plausible is already a security failure.
|
| If I'm downloading and executing files that are randomly
| in a Medium article or in my inbox from an untrusted
| source then we're in trouble whether they are hosted on
| github or not.
| wnevets wrote:
| > If I hover over the link like my phishing training says
| to do
|
| How do you hover on mobile? Instead of training my family
| members to hover on their phone's I will continue to just
| block these TLDs.
| eli wrote:
| I'm confused what you're advocating. If your family isn't
| checking the domain before downloading and executing
| files then the .zip tld doesn't matter. They're just as
| vulnerable to phishing without it.
| wnevets wrote:
| > I'm confused what you're advocating.
|
| I'm advocating using a pi-hole to block problematic
| domains on your network using list like the one from
| StevenBlack and entire TLDs that could be confusing. If
| you don't think .zip & .mov could be confusing then feel
| free to not block them.
| Kazrath wrote:
| To be fair all extensions are potentially executable.
| Extensions are just a mapping to an application maintained
| by the OS. .com is just mapped to a program that executes
| by default. File type is a whole different ball of yarn to
| untangle.
| afruitpie wrote:
| Pi-Hole and PiVPN [0] is a great setup for DNS filtering on-
| the-go. The setup for PiVPN makes it foolproof as well.
|
| When my Pi stopped working and I couldn't find a new one, I
| gave up and moved to NextDNS [1] and have been very happy.
|
| [0] https://www.pivpn.io/ [1] https://nextdns.io/
| ndsipa_pomu wrote:
| Reminds me of SlashDot where there was a relatively well known
| submitter that was a huge proponent of host-based ad blocking on
| Windows and was also a proponent of getting very angry at almost
| anyone else.
|
| (Edit: typo)
| TheNewsIsHere wrote:
| That's the most believable thing I've read on the Internet for
| ages.
|
| Slashdot has a, shall we say _engaged_, community.
| sumtechguy wrote:
| heh I made the mistake of engaging with that once. oh boy....
|
| They could not wrap their head around the idea that the hosts
| method is limited in some use cases.
|
| This could not be blocked without blocking the main host too.
| https://example.com/adverts-folder/advert.jpg
|
| Now it sort of works in practice as most of the advert networks
| do not host on the same domain.
|
| It is good at catching out whole bad domains but partial ones
| it is not very good at. Which some domains will do using a
| reverse proxy.
|
| Also at one point a hosts file was linear scan. No sort of
| hashing or binary search lookup. Not sure if that was ever
| fixed in windows or linux. So a small number of hosts it was
| ok. But as the file grows it starts to add up.
| ndsipa_pomu wrote:
| I'm half expecting a torrent of abuse in reply to you now
| from whoever that was
| fullstop wrote:
| Plus you can't forget Natalie Portman and Hot grits down
| your pants.
|
| What a strange place that was.
| sumtechguy wrote:
| oh no...
| danieldk wrote:
| On the Mac the new Little Snitch Mini is really nice for this:
|
| https://www.obdev.at/products/littlesnitch-mini/index.html
|
| Sure, you could manage /etc/hosts manually, but Little Snitch
| Mini has a nice interface for managing blocklists, auto-updates
| them, and has nice visualization, and you can also manage blocks
| per app.
| Tarq0n wrote:
| Portmaster is the best Windows alternative I've found.
| numpad0 wrote:
| Didn't work well for me last time I tried, I think entire IPv4
| stopped for ~5min on each reboot with this.
| miles wrote:
| To resolve in Windows 10[1]: Disable DNS Client by changing the
| value data for
| HKLM\SYSTEM\ControlSet001\Services\Dnscache\Start from 2
| (automatic) to 4 (disabled) (recent versions of Windows 10 no
| longer allow disabling DNS Client via services.msc).
|
| [1]
| https://tinyapps.org/blog/201809300700_large_hosts_file.html
| todorov84 wrote:
| Does anyone have any updates on Mike Burgess (from
| winhelp2002.mvps.org)? He used to keep my go-to hosts file, but
| his health seems to have declined in the last few years. I would
| like to know if he is still around and if there is currently any
| method to donate or support him. Any news would be greatly
| appreciated.
| miles wrote:
| To ensure there are no nefarious redirects in such a massive
| list, this one-liner comes in handy[1]: grep -v
| '#' steves_hosts | awk '{print $1}'| sort | uniq -c
|
| [1] https://news.ycombinator.com/item?id=11456562
| JdeBP wrote:
| Someone explicitly called out and removed the Useless Use of
| cat but yet left the Useless Uses of grep, sort, and uniq in, I
| see. (-:
|
| * https://porkmail.org/era/unix/award#grep
| awk '!/#/ { seen[$1]++; } END { for (k in seen) { print
| seen[k],k; } }' steves_hosts
| miles wrote:
| Guilty as charged!
| arp242 wrote:
| I love awk as much as the next person and I've written some
| pretty large scripts with it, but the original grep/sort/uniq
| is a lot easier to understand in two seconds. I don't think
| it's "useless" at all.
|
| Also your awk isn't exactly identical as it's not sorted, but
| in this case that probably doesn't matter.
| j0hnyl wrote:
| Same, I think I use grep | sort | uniq almost on the daily.
| tedivm wrote:
| I'd rather have the readability of the first command than the
| "efficiency" of your example.
| rovr138 wrote:
| find . -name hosts -exec grep -v '^#' {} \; | awk '{print $1}'|
| sort | uniq -c 43029 204 # 4289934
| 0.0.0.0 10763 127.0.0.1 18 255.255.255.255
| 54 ::1 1 analytics.shein.co.uk 1
| analytics.shein.com 1 auxilium.ftb.team 1
| bstats.org 1 fe00::0 17 fe80::1%lo0
| 33 ff00::0 17 ff02::1 17 ff02::2
| 17 ff02::3 1 mcmc.dev 1 mcstats.org
| 1 metrics.shmeeb.net 1 openeye.openmods.info
|
| And looking at those last ones, looks like some files have a
| different format. For example, the data/minecraft-hosts/hosts
| file, ~/D/P/hosts master grep -irn
| 'openeye.openmods.info' .
| ./alternates/fakenews/hosts:174307:0.0.0.0
| openeye.openmods.info ...
| ./hosts:174306:0.0.0.0 openeye.openmods.info
| ./data/minecraft-hosts/hosts:9:openeye.openmods.info
| ~/D/P/hosts master grep -irn 'metrics.shmeeb.net' .
| ... ./data/minecraft-hosts/hosts:8:metrics.shmeeb.net
| hda111 wrote:
| What is a nefarious redirect? Does it look for entries without
| 127.0.0.1?
| miles wrote:
| A redirect to some unexpected IP address. Here's what the
| output looks like: 190625 0.0.0.0
| 3 127.0.0.1 1 255.255.255.255 3 ::1
| 1 fe80::1%lo0 2 ff00::0 1 ff02::1
| 1 ff02::2 1 ff02::3
| 8organicbits wrote:
| There's a concern that a malicious list could point domain
| names to a malicious IP address. I don't think its a big
| concern with https:// since the cert will be invalid, but
| it's still a concern.
| DaiPlusPlus wrote:
| I suspect it's very likely that somewhere in the world is a
| domain-validation server, used by a trusted CA, which has
| this very anti-advertising hosts file installed onto it.
| charcircuit wrote:
| 0.0.0.0 connects to your own machine. You should not "block"
| domains by assigning them to 0.0.0.0. You should instead return
| NXDOMAIN.
| Havoc wrote:
| Much better to do so at router level via pihole or Adguard Home.
| That way it catches the calling home from all the various
| electronics too
| joeywas wrote:
| Yes. pihole coupled with a router that can intercept outbound
| traffic on port 53 and force it to the pihole is how my home
| network is configured. That way it catches all those sneaky
| devices that have hard coded dns servers.
| raptorraver wrote:
| Related to this, my best cure against procrastination has been
| adding some distracing websites to /etc/hosts and pointing them
| to localhost.
| nashashmi wrote:
| A tech as old as Kazaa lite. But people like to use heavy ram
| chrome browser extension to do the same thing.
| yjftsjthsd-h wrote:
| Er, _is_ uBo a RAM hog? Glancing at mine right now it 's
| consuming ~36 MB, i.e. about the same as a single small tab.
| jsheard wrote:
| It's not the same thing, browser extensions can block at a much
| more granular level than entire hostnames.
| xenophonf wrote:
| Those licenses are a little silly. You can't copyright a
| phonebook.
|
| https://en.wikipedia.org/wiki/Feist_Publications,_Inc.,_v._R....
| hungrigekatze wrote:
| I used to use this hosts file some years ago:
| https://someonewhocares.org/hosts/
|
| Forgot about it for a few years, but this post jogged my memory.
|
| We currently use a PiHole for house-wide, network-wide ad and
| telemetry blocking, though, but perhaps that hosts list is useful
| to someone else.
| tobinfekkes wrote:
| I've been using this list locally and on my PiHole for years.
| Love it!
| dbg31415 wrote:
| Works good for blocking fake news and sites you don't want your
| elderly parents getting tangled with.
| Dwedit wrote:
| Not gonna help if the malware authors decide to embed their own
| implementation of DNS.
| commandlinefan wrote:
| I use Brave (not so much for the built-in ad block, but mostly
| because it's not actually Chrome) and I've noticed that more and
| more sites have ad-block detection that appears to work by
| sending a unique token to their ad server and then not loading
| content until after the token has been verified to have been
| received. I imagine there are ways around this on a per-site
| basis, it's generally easier to just give in and disable the ad
| blocker.
| kevin_thibedeau wrote:
| NoScript usually bypasses this behavior. Especially when the
| content is delivered but hidden with JS DOM manipulation.
| zeruch wrote:
| I wish NS worked on Android as a generic domain blocker
| JdeBP wrote:
| It's almost the 40th anniversary of RFC 882. Back when the Domain
| Name System was being invented as the replacement for everyone
| sharing hosts files, I wonder whether anyone expected that 40
| years later there'd be a shared hosts file with its own copyright
| licence, Docker file, and code of conduct.
|
| Interestingly, from what I remember of the April Fools columns of
| electronics magazines of the time, one thing that people would
| not have been surprised by is that the purpose was zapping
| advertisements.
|
| * https://worldradiohistory.com/UK/Electronics-Today-UK/80s/El...
| alecco wrote:
| https://github.com/Ultimate-Hosts-Blacklist/Ultimate.Hosts.B...
|
| Don't forget about hosts.deny (but you probably need it at your
| router if you are behind one).
| jarebear6expepj wrote:
| Shell scripts that download more shell scripts. Kind of
| terrifying, no? I feel like I would personally rather take my
| chances getting scammed out of a CS skin than running these
| installers as root at will.
| alecco wrote:
| Download the raw file.
___________________________________________________________________
(page generated 2023-06-12 23:01 UTC)