Slashdot Mirror
Microsoft Bypasses HOSTS File
whitehatlurker writes "Dave Korn announced on the Full Disclosure and Bugtraq security lists that Microsoft is bypassing local lookups for some hosts, meaning that you can't locally block some sites through your HOSTS file. All of these sites are MicroSoft controlled sites.
The general feeling in the rest of the thread is that this was to obfuscate these hosts and prevent them from being blocked by malware. However, there are no non-MicroSoft hosts listed, giving a competitive advantage for MicroSoft's anti-malware tools over other brands."
I would have thought that if you cant subvert the HOSTS file then all you have to do is to intercept any DNS lookup of these MS addresses and you would have the same effect.
If you are trying to stop MS software from talking to home, then just use an external firewall.
Michael
There is no cryptographic solution to the problem where the intended receiver and the attacker are the same entity.
It helps prevent Malware. Sure, MS might have a slim advantage, but it also prevents otherwise botted PCs from accessing MS Updates against things like Blaster. I don't see this as being such a big deal.
People should know by now, when you go MS, you don't buy the horse, you buy the farm. You wanna segment and pick and choose on the MS platform? Good luck.
Microsoft could also be using this to prevent users from blocking MSN messenger ad servers.
tom@localhost ~ $ ls -l /etc/hosts /etc/hosts
-rw-r--r-- 1 root root 519 Oct 19 12:13
....
Why can't windows just make the host files read only.
Someday, I'll have a real sig.
Why? Maybe someone will get a comment from MS.
The point is that mucking around with the inner workings of the OS is BAD, unless it is documented appropriately. Now, documentation doesn't make it good, but if they're departing from the expected behavior, they should let people know.
[Fuck Beta]
o0t!
Well, lucky I've got that brand new tinfoil-hat!
I enjoy large posteriors and I cannot prevaricate.
The main problem is not that you can't block MS addresses, it is that MS is only preventing their addresses from being blocked. Since they are now getting into the security business, this gives them what could be seen as an unfair advantage.
Let us say that Joe User gets a piece of Malware, so he decides to visit a security company to find a solution to his problem. However, the malware has modified his hosts file to block security company web pages from being accessed, which is extremely typical. Joe User is not experienced enough to even know there is a hosts file that he could change back.
Joe User's first attempt would likely be to norton.com, symantec.com (both go to Symantec's main page), or mcafee.com, since these names are pretty much synonymous with antivirus software. However, all of those are blocked and he can't access them.
However, if he goes to microsoft.com, he can go there since the hosts file is subverted in the OS. Since he can't spend the time to figure out why he can't access the others, he purchases Microsoft's AV solution.
"You spoony bard!" -Tellah
Hmm. This seems a bit ass-backwards to me.
Rather than having to ignore the HOSTS file because it may be malicious, shouldn't the solution be to prevent HOSTS from getting mangled in the first place?
(oh, and on an unrelated note: why on earth is the Win32 HOSTS file buried away under C:\Windows\System32\Drivers\etc\? I mean.... 'drivers'?!!? Bizarre.
What's the frequency, Kenneth?
The only thing that troubles me is the inclusion of MSN.com in the list.
The other hosts are used in Microsoft's patch distribution network and honestly is not something the average user would ever need to block. It is, however, something a virus/spyware program would love to block. So, if you want to block those hosts, buy a firewall, they're down to about $20.
As for MSN, my only guess is that they don't want to block updates for MSN messenger.
What we have to remember is that these sites are required to fix a broken system, so I don't view this as just an advantage for MS antispyware.
so...how is this a competitive advantage? why can't the competitors just use IP addresses instead of DNS?
The basic sleazeware produced in a drunken fury by a bunch of UCBerkeley grad students was still the core of BIND. --PV
they are not doing this on 2k...
ive blocked most of microsoft off at the hosts file.. saves time since i know i dont ever want to go there. even if my browser does.
Wouldn't this prevent malware from redirecting legitimate Microsoft update requests to an imposter site?
An automatic update of WMP and your PC gets owned, and nothing can be done to prevent it!
...if Microsoft had documented this behavior. Yet still, I fail to see what the big deal is. So you can't force an IP address to a domain with hosts.txt for some sites that microsoft controls. If you need to do that, for example for some corporate filter or updating solution, you could just modify your own dns server. Home users on the other hand get more reliable access to windows update, which is very important. Otherwise it would be trivial for malware to block the computer from recieving updates, and the automatic updates would silently fail.
Cheers, Fogger
Um... I didn't do it!
If the adware can change your hosts file then this is pretty useless anyway. Now all the software has to do is run a script that does the following
nslookup whatever.microsofts.domains
takes the list of return addresses and
route ADD destination MASK mask INVALID INVALID INVALID foreach
and your traffic to MS wont even leave the network card.
So do Windows users need to replace the entire TCP stack or just Windows resolver library?
Now I'll have to include a disclaimer...
Just another reason to continue using a more robust system :)
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
I don't see what the big deal is. Name resolution on a system/application level isn't set in stone. They are completely free to implement a DNS client/name lookup system any way they want to. You are also free to implement your own DNS client. If you don't want to use dnsapi.dll, then don't. If they want to implement a DNS client that skips a local hosts file for some names, then so be it.
Granted, I don't run any Microsoft operating systems anyway.
In fact, you could run your own DNS relay server locally or remotely and block the names from there.
what a gentle euphemism...
Politics is Treachery, Religion is Brainwashing
Not that I like it much but.. isnt it THEIR OS? Why cant they do whatever they want? Why does it have to support any 3rd party security software? Nintendo didn't get sued for not letting me run linux on my NES. I don't see how this is any different. Granted, if they take it too far they will lose marketshare.
I don't like any of the movements they are making toward being anti-competetive as far as software goes or w/e. The thing is though that if some media player manufacturer wants their player to stand up to WMP then they should make their own damn OS and get the kinda marketshare Windows has.
Just my $.02
Anyone can "bypass" the hosts file. Just make your program access hosts by their IP address rather than the DNS.
Who cares?
Nothing prevents you from not using the operating system's resolver. Its trivial to implement your OWN DNS client in your programs, bypassing any HOSTS settings and other DNS resolver issues.
I've never seen so many people who were so clueless and misinformed about the technical issues involved here.
I'm wondering if the behaviour will change if you just go into "services" and disable the DNS client.
I recommend this anyway. In theory it will increase the number of requests your machine does. But in practice it has saved me a lot of "try rebooting" calls.
Anyone out there with XP who can reproduce this?
A court of law has determined that Microsoft is a monopoly. One of the anti-trust regulations specifies that you cannot use your monopoly power to force your way into another market; that was the heart of the conviction against Microsoft in the Netscape case. Microsoft used their monopoly to oust Netscape as the dominant browser by bundling, which is illegal.
Now they are using that same monopoly power to take over the anti-malware market.
I'm rather ambivilent about this. On one hand, it is just one more case of Microsoft waiting for a market to mature, then forcing their way into it. On the other hand, this market wouldn't exist if it wasn't for their own shoddy products, so it's really Microsoft's reponsibility to fix it. However, malware protection software isn't the correct answer, it's just the most expedient, with a potential for additional profit.
All-in-all, it's just Microsoft's usual game: own the system, rig the system, use that to take over another system. Keep secrets, and act all coy when your secrets are discovered.
Microsoft is to software what Budweiser is to beer.
If they removed other sites from the host file then there would be an article on Slashdot about how XYZ site can't be blocked in the host file and about how that is some nefarious evil plot by Microsoft. Microsoft did just what they should logically do: Removed their own sites from host lookups.
:) yup yup!
The real problem with this is that: 1. It wasn't documented, so people had to discover this non-intuitive exception. 2. It defeats the purpose of the hosts file. Had they also included the other AV vendors in the list and made the function public it may have seemed like a practical band aid to the hosts file hijacking problem. Instead they made it M$ only and hid it so it looks slimy. The issue is being addressed is also PEBKAC related.. If Windows users weren't logged in as admin the hosts file would be off limits.
How come the Department of Justice, supposedly "closely monitoring" Microsoft's monopoly abuse, isn't stopping this? How come Microsoft isn't afraid to pull this Internet bundling stunt, illegally leveraging its monopoly, after the "landmark decision" against them 6 years ago?
--
make install -not war
Or do you think those Aliens are still working with the same technology they used in the 60s? OF COURSE they perfected the thought control beam, and OF COURSE the primary point of attack was tinfoil hats!
Now they're using a new, secret technology that controls you through your nose. Thankfully, I've designed new noseplugs that you can install in your nostrils, they're even almost invisible and throughly woven with gold and platinum. That makes them a little pricy, but it's the ONLY protection you can have!
Order now!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
How is that news anyway :)
I gave up with the idea of an useful sig...
. . . those other sites do not play into what MicroSoft sees as the "integrity" of their product.
Which integrity might that be? The same integrity that allows malware to infect a machine to the point where it can poison the hosts file? The same integrity that spawned the anti-malware business in the first place?
Yeah. Microsoft is big on integrity, both moral and technical.
Microsoft is to software what Budweiser is to beer.
"Safeguarding" your hosts file against tampering is pointless. Yes, a few trojans toy with it. The ONLY place that's ever redirected afaik is updates.microsoft.com.
So this is going to be celebrated as the hack against malware that keeps you from updating. Ohhhh great. Ok, next move from the malware writers is simply to keep a thread running that checks if something is coming in from the "unwanted" sites. If so, it's deleted before execution. Problem solved.
There is no techical solution for social problems.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
So.. they're bypassing my HOSTS file? Well, they're going to have to get past my linux router's DNS and HOSTS file too..
How can you read slashdot and not know how to correctly capitalize Microsoft?
How can CmdrTaco let something that obviously incorrect get posted?
You know, I would bet money that were Apple doing this, people would claim it's just vertical market integration .. why should they make things easy for spyware vendors etc.
.. it's considered ethical and benevolent.
Apple won't allow others to create DRM enabled files that play on the iPod. Other mp3 players are prevented from being able to play songs bought on iTunes (unless you go the roundabout, dubiously legal (read the contract), route of ripping to CD and then copying the mp3's on there). This is all considered "fair" and a brilliant example of vertical integration.
It seems to me that as far as people are concerned, anything Microsft does is evil, but if Apple does the exact same thing
Comment removed based on user account deletion
Do people CAPITALIZE the hosts file? I can't remember it being capitalized on any system that I've used. On WINDOWS it doesn't even matter about capitalization, and on both FreeBSD and Linux it is in all lower caps... WON'T SOMEONE THINK OF THE CHILDREN??!
well, knowing Microsoft, this have been happening for a long time ;)
and what more to expect?
Bypassing the hosts file is not some super-secret thing only Microsoft can do.
You can EASILY do this in your own programs by implementing your own resolver. Microsoft cannot and does not prevent you from doing this.
Microsoft is merely doing something smart. If other vendors cannot figure out this, its their fault. Microsoft shouldn't be penalized for being smart.
Lord High Crapflooder The Right Honourable Vlad Craig Esther McDavenpherson III
Destroyer of Mercatur.Net
You buy their crap you're chained at the hip anyway.
If you don't have bread, just eat cake.
If you want to bypass the hosts file all you need to do is connect by using the IP address as opposed to the DNS name. Sure it seems a bit more complicated or problematic (incase DNS->IP pointing changes) but Im sure all malware programs would rather specify an IP instead of DNS. I would if I was creating a malware program :-)
Please, for the good of Humanity, vote Obama.
It's trivial to directly perform a DNS query. Any third-party application (including malware) can do exactly the same thing Microsoft is doing, there's no "secret sauce" here that's only available to the coders in Redmond.
"Only two things are infinite, the universe and human stupidity, and I'm not sure about the former." --Albert Einstein
What would happen if you opened dnsapi.dll in a hex editor and changed the strings? I.E., where it says msdn.com, just change it to wxyz.abc. If the code is actually doing a string comparison (like strncmp()), this should cause it to fail. If this does work, it would be simple to write a patcher that changes all of those strings (both for the good guys and the bad guys).
(And my troll is in Haiku)
Windows xp still better
need to run useful software
Mac and Linux are toys
that is not quite right
both the troll and the haiku
are somewhat lacking
but please understand
Mac and Linux are not toys
just other systems
Windows has problems
while it does have more software
it is insecure
please try something else
you might find that you like it
don't stagnate yourself
if end users switch
developers will follow
more software for all
so please help yourself
and help the rest of the world
try something else
if you don't like them
that is your prerogative
simply don't use them
but I'm warning you
going back is much harder
but it is your choice
other OSes
few viruses and malware
true computing bliss
as for poetry
haiku sylable count is
5-7-5
Yes, Microsoft gives itself way too much control over their customers. But Apple isn't a better choice in this respect.
People should know by now, when you go MS, you don't buy the horse, you buy the farm.
See? Buy the farm.
Weaselmancer
rediculous.
It seems to me that as far as people are concerned, anything Microsft does is evil, but if Apple does the exact same thing .. it's considered ethical and benevolent.
So, since it seems you don't agree, then you're not a person?
(Hint: Plenty of people have problems with Apple for doing this kind of bullshit. Cory Docorow springs to mind. Spare us the tired 'You MS haters just luuuurve Apple when they do the same thing, hippo-crates' bull, OK?)
ip route [offending block] Null0
router ospf 1
redistribute static subnets route-map MSFT-GO-AWAY-NO
route-map MSFT-GO-AWAY-NO
mat ip addr prefix-list LOSER-MONOPOLIST
ip prefix-list LOSER-MONOPOLIST permit [offending block]
From memory, but should work under IOS. You have to be root on my desktop to change
I am very easy to get along with, but I don't have time to waste being nice to people who are being stupid. -Theo
Let's see what companies like Syamntec and McAfee will do now. Can't forget the EU either.
Zorix
Making it harder for malware to abuse our computers, or make sure that if not everybody can bypass hosts, then none can, so that we're all screwed. Think about it.
People are tired of being treated as stupid by you Microsoft.
You subvert their trust doing things like that.
On top of it, you do it quietly, hoping no one will catch on.
My computer is supposed to perform MY bidding, Microsoft, not yours.
Goodbye, Microsoft. I can't trust you, and I can't see any difference between you and the bad guys anymore.
I don't know the meaning of the word 'don't' - J
Sure, you'd have to list a few IP addresses to future proof it, or only use the emergency IPs if the host names don't validate.
-- these are only opinions and they might not be mine.
TWW
"Encyclopedia" is to "Wikipedia" what "Library" is to "Some people at a bus stop"
-Considering the most popular non-microsoft patches are to tcpip.sys and uxtheme.dll
First they came for those who knew about the HOSTS file, but I did not know about the HOSTS file, so I did not speak up.
I'm interested in developing such a plan, but it requires people in numbers. I have seen such a plan in works of fiction. Anyone care to contact me?
Real haiku is also supposed to be about nature. You can't just arrange a bunch of words in haiku format and call it haiku. You need to have some shit about trees and a sunset.
How would Symantec know that the user did not edit the host file himself to block updates from other AV vendors, for example because these detect Symantecs AV as a rootkit?
I'm still trying to figure out what people mean by 'social skills' here.
The thing that really makes me want to stay away from Microsoft software (and proprietary software in general, though Microsoft seems particularly prone to it) is exactly this sort of behavior. For a long time I've had the sentiment that Unix was more secureable than Windows (securable, not secure-out-of-the-box, since neither of them is that), precisely because I find it much easier to look at a Unix system (particularly one which I have the full sources to) and understand what it is doing than I do when using a Windows system.
I assume this is actually undocumented behaviour, since I haven't seen anyone claim to have known about it before now, nor can I find any references on MSDN about it. Having unintuitive and undocumented behaviour is exactly the sort of thing that makes it very hard to gain a correct mental model of how a system behaves, and if you don't even understand how the system works I don't see how one can secure or troubleshoot the system in a way that isn't essentially "shotgun debugging".
My $.02
Might take a little googling, and Im lazy at the moment, but I had the exact same problem. Its a small .com file fix that changes one bit in the IBM BIOS. Run it from a boot floopy and all is well... And once done it didn't display any messages, it just worked as it should.
Here's a threaded view of the Full Disclosure thread, rather than the first follow-up post to Dave Korn's OP, which the story submitter seems to have decided would be a better way... http://archives.neohapsis.com/archives/fulldisclos ure/2006-04/thread.html#268
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
This is not very practical advice. Most people don't understand any of this stuff and adding a firewall will only have limited effect unless tuned by someone with significant understanding.
Yet again, MS proves themselves to be untrustworthy.
Engineering is the art of compromise.
Microsoft just felt threatened by Google starting to wear the evil dress. So to make up for it MS has shown off some evil it has been keeping on a back burner.
Some time back I was doing some work for a particularly draconian client who wanted all web traffic restricted to pre-approved sites for all users at his business. I repeatedly suggested that we go with a server based solution but he was convinced that Content Advisor would solve the problem. He failed to realize that CA is a very poor tool for this as it just doesn't work well for several hundred workstations nor does it have a centralized administration point. But he was convinced that he knew more about the topic, "It'll work fine, just go ahead and do it." So...
He wanted anything not explicitly approved by him to be blacklisted and specifically named msn.com and a few other popular office time-waster sites (yahoo, etc.). It was through this process that I discovered that neither content advisor nor manipulation of the hosts file will block msn.com or other Microsoft sites. As MS has never made it public knowledge that you cannot block these sites in this manner I ended up looking rather foolish when I couldn't black-list. I had guessed at that time what was actually happening but I had no proof of documentation on which to fall back.
At least I reduced the list propagation time by setting up the list on one machine and pushing the registry to the remainder but the damn thing never did work right, it was such a hack job and I'm ashamed of it when I look back in retrospect. I wish they'd let me do it right.
If MS had disclosed this change (along with the Content Advisor change) I wouldn't have felt so foolish.
"09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0"
If you don't like the way that Microsoft software works, use something else already. Sheesh.
Oddly enough, I just noticed this today with OS X.
Try creating a host entry over configuration.apple.com on 10.4.6.
You know what this brings to mind? My block lists. In firestarter and Konqueror, Mozilla and Opera, I BAN the hell out of doubleshit! I also ban eqn, eqv, ad, point and some 150 or 200 subdomains.
But, it seems, though, double-dick caught on to people banning their asses, so what I have *I* noticed (don't know how long this/the following has been the case) is that our ***ISP's*** are hosting double click. That means that now, if you ban EVERY address spewing doubleshit, you're blocking your own ISP. It's pissing me off that Comcast **seems** to be hosting or handling doubleclick to make SURE something about your/my surfing habits WILL end up in doubledick's database.
This also, I guess could be similar to what ms **might** be doing. Has anyone traced their cookies, the bots, and the 1 pixel code crumbs, broken them open, and found their "home base"? I wouldn't be surprised if nowadays or in the past 6 years that the ms hosts file usage enables them to command your machine to randomly and in small bytes periodically send them some information about your activities, hardware, software, things your machine talks to on your LAN...
This could be the NEXT total information awareness arsenal piece: Wanna surf, doubledick (probably a federalized activity/government-funded entity by now) will get information. All your ISP has to do to assuage any "guilt" they may have is say what yahoo and others say: "WE COLLECT PRIVACY INFORMATION..." and create an umpteen-long document to deter rejection or complaint by MOST users.
I wish I could make heads or tails about what Ethereal finds, though. I wish I could find out enough about connections that try to come to my machine. Etherape helps, too, but I HATE doubledick with a passion. I block them and a slew of others, even though it nearly doubles or triples some page load.
Hmmm, interesting: image word/word image: "suffers"
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
I highly doubt they care as much about using this to stop malware as they say,.. but rather use it as a way to control product activations from being redirected.
IIRC, the court's finding was that Microsoft was a predatory monopoly. The lower court's findings of fact were upheld by the appeals panel. Merely being a monopoly is not illegal, if it were, almost all electricity companies would be illegal. Being a predatory monopoly is illegal. Where the appeals court failed was in the remedies.
OTOH, the MS EULAs give MS the right to do whatever they damn well please to your system, your applications and your data. It also states if you wishe to take them to court, you have to do it on their home turf in Washinton State. Good luck, bud.
If you want your life to be different, live it differently.
WHos' gonna step up to write the applet that shows:
- you your host file
- what it is blocking
- the known universe of competitors who are still in business (based on another file)
- how to disable the host file so you can bypass ms' crackware sites
- how to disable it or if you're not admin/local admin, inform your IT department
?
Or, does such a thing exist in some anti-virus software?
It could be that the host file some day will be accessible to a few "ms-anointed" sites that either fit in with ms' view, pay ms the requisite amount, or are homeland security. Wait-- dhls can just go the the ISP and track your hops via some special crumbs, right?
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
Well, let's say the EFF or some authoritative source (please, no ms and TCP crap) maintains a list of new, active, performing A/V vendors. They get rated much like in the BBB lists.
Being on the list would cost or show about or require of the vendor
- say, $50 a year,
- submission limitation of only ONE IP address
- the submitted IP has to resolve to their main site
- the IP cannot be changed for 1 year
- the company has to be registered with its nations IRS and similar equivalents
- the business gets a rating based on a preponderance of veried complaints
- court cases and arbitration and nefarious or questionable marketing, technology, or product behavior gets listed
- anti-competitive conduct or behavior gets noted
- the vendor site has to be signature verified
- the vendor site has to have a basic security of kind
More items? Anyone?
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
WFP was created to solve the problem of third party installers overwriting windows dlls with their own versions. This was a huge problem with Win9x. WFP pretty much solved that issue. WPF can be turned off by an administrative user, so it's not really equippped to deal with the actions of malicious programs.
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
...but there is no captial "S" in Microsoft.
If only most applications could run properly with user-level permissions.
I admin a tiny number of desktops and not one of them worked with user-level permissions.
-Mysterious errors
-Application functions that simply did not work.
These are *very* generic XPSP2/Win2k desktops with Office 2K/2003.
Initially, I was not deterred. With every hurdle crossed with ugly hacks, there was yet another error with no documented solution.
Someone posted a link to NIST(?) documentation that I eventually used. It's by far the best way to do a job that the OS was never designed to perform.
Mod parent way down
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
You are now your computer's bitch. Deal with it.
I don't know if it's been said already, but using the hosts file to reliably "block" anything is a very stupid idea to begin with.
The hosts file is there to provide name-to-address translation for crucial hosts which might be needed before DNS is available. It has no features like pattern matching or blocking by address range, because that's entirely out of its scope.
Another side effect of abusing the hosts file is ambiguous errors. Because access to ad servers in the hosts file is not "blocked" but rather redirected to 127.0.0.1, you are twisting semantics about why this or that URL doesn't work now.
If you need to block networks/URLs by pattern and for HTTP only, you should use a proxy like squid.
I won't even begin to rant how using the hosts file for more than 1 computer is phenomenally stupid. Seriously, the guy who came up with this abuse should be severely beaten over with a cluestick.
</rant>
Of course it runs NetBSD. BTC: 1NT7QvbetmANwaMzhpVL6
You don't see what the bid deal is about a second M$ imposed DNS system is? If they can bypass your hosts files, they can bypass anything and thereby censor anything they wanted for you.
Let's say M$ decided to censor Slashdot, for example. You type http://slashdot.org/ but get the Microsoft mirror instead, all cleaned up. It might take you a while to catch on. A more diabolical approach would be to make connections to this site or that unreliable. This would transparently censor selected sites and frustrated users would simply abandon them. They could FUD those sites with Astroturf like, "That site sure is slow." etc.
This is the ultimate price of non free software - you never know what it is really doing.
Friends don't help friends install M$ junk.
No one is defending that excuse.
The greatest potential problem is from M$ themselves. If they have a mechanism that defeats DNS and host files, they can direct your traffic where ever and whenever they want to. Used carefully, this power is undetectable and easily explained by the overall sorry Microsoft browsing experience. M$ can intermittently DoS sites and make life difficult for those they don't like.
Friends don't help friends install M$ junk.
I'm gobsmacked by this: corrupting the resolver is little short of an intentional dns poisoning attack. It's as if internet explorer had special code in it to see if you were doing an internet search for 'microsoft products' and then altered the results to only return favourable reviews that microsoft wanted you to see.
Actually, it's exactly like that. Special cases, which can be added or subtracted on Windoze update, can effectively censor the internet for you. Imagine they intermittently broke connections to sites they did not like. The user would never know, the site would be blamed and abandoned. That nasty and it's exactly what M$ likes to do to their perceived competition.
Friends don't help friends install M$ junk.
I wonder what version of DNS code MS uses. I find it rather interesting that the HOSTS file in MS Windows is located in ../etc/ directory.
They aren't spying on you any more than they already were. They're ensuring that you can always get to their sites for patches and support. They aren't doing it for anyone elses sites because it's not their business to do that.
I just really don't see what the big deal on this is, your average user will never use the hosts file, and you need to get to Microsoft sites to patch and maintain your microsoft system. If you don't want to deal with Microsoft don't use their OS, they're not doing anything particularly wrong here.
What it means is that if a rootkit alters the internal IP tables for a Microsoft address, most virus checkers won't pick up on it (the Hosts file will be untouched) and it will be impossible for the user to override the problem in order to get to Microsoft's website to download the necessary patches.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Hmmm, let me see... Oh yes, here we go:
"Windows has been found on your hard drive. Click [OK] to remove it."
:-P
If I can't play games, I might as well stop dual-booting and go 100% to Linux.
Heh. I guess this is just more evidance that Windows wasn't built with user sanity in mind.
Obligatory Soundbite Catchphrase
I tried a few on the localhost line. DNSAPI seems to honor them.
;)
For example:
127.0.0.1 localhost www.microsoft.com
PING www.microsoft.com resolves to 127.0.0.1 (and succeeds
and http://www.microsoft.com/ fails (resolvs to 127.0.0.1 then redirs to a search)
Move it to it's own line, and the "trigger" kicks in.
I'm running WXP SP2 (w/ all the latest patches)
Just look Here for more info:
= /library/en-us/dns/dns/dnsquery.asp
a ys=9999~start=20#15902844
http://msdn.microsoft.com/library/default.asp?url
Also you can defeat a Host file by simply changing the priority of lookups using the registry, more here:
http://www.dslreports.com/forum/remark,15900699~d
Black Gray White Hats Unite to protect http://testing.OnlyTheRightAnswers.com
They may well over-rule the HOST file ... but *I* administer the firewall, the router and the DNS server.
What's that URL you want to look up?
Where do you want to have that packet sent? Oh, THAT IP, huh? Sure, I will.
Bwahahaha!
I am anarch of all I survey.
hi-res rolling hills
adorn the windows desktop
red queen on black king
Here' a simple solution to the Microsoft controlled DNS HOSTS file:
http://treewalkdns.com/
Allows you to bypass Windows' own DNS server and gives you the useful feature of making DNS queries much quicker than resolving to your ISP all the time, among other benefits.
Very easy to install for Joe User and just as easy to uninstall.
HTH
Visceral Psyche Films
The privileged Microsoft links that Dave Korn has discovered
/windows/system32 and found 3 files that
are all accessed via go.microsoft.com.
I searched through
contain that address:
browselc.dll
themeui.dll
wmvcore.dll
I renamed them after booting into Bart's PE. Actually, I
renamed several instances of them in different locations.
But what, if you want to access MS updates? Don't access them
online, wait for a CD to be released.
Oh, but that is risky in the meantime! No, it is not: just
deactivate ActiveX and jscript and go online as simple user.
No firewall, no real-time anti-virus, nothing.
That's my approach and I have not been bothered by malware
in years. Also consider the bonus: you are out of reach for
web artists! That's happiness, folks.
Spyware using an LSP can circumvent this I'm sure. see this link on coding an LSP http://www.microsoft.com/msj/0599/LayeredService/L ayeredService.aspx
You most certainly can't own Linux. GPL, is, after all General Public LICENSE.
This is my sig.
Why use DNS at all? A vendor can easily hardwire a fixed IP address into their programs.
No sig today...
this is the just an example of what drm and trusted computing that your wonderful senators are pushing for.
this is just the beginning folks - be ready for the rest with vista - drm and trusted computing are so cool - now you will get spam from only companies that pay microsoft more money to send spam.
here is a solution to this problem - buy linux and you will be in control of your own computer.
try that post again using real names instead of they cutesy gimmicks and I'll read it again without thinking to myself "Wow, this guy is a real scrotum licking crackbaby."
Here Microsoft adds features to one of their products to increase security and the effectiveness of their antispyware products, and we call them evil. THIS IS A GOOD THING. They didn't extend this feature to their direct competitors - big deal? Guess what? That's what competitive marketplaces are all about.
What would you rather they did? I mean they could've not added these features - would that be better? They're NOT going to offer to extend these protections to their competitors - that's less evil to consumers but more evil to shareholders - what could they have done that would be less evil?
I am disrespectful to dirt! Can you see that I am serious?!
And yet another Slashdot anti-MS conspiracy threory bites the dust. LOL
There are two sad things about this.
1. Slashdotters demand that Microsoft document their API, yet are quite ignorant of the vast documentation that already exists.
2. You can be sure that in the future, a slashdotter filled with irrational MS-hatred and his own self-righteousness will cite this bypassing of the HOST file as evidence of Microsoft's evil, totally unaware of his absolute ignorance on the subject (or worse, well-aware that these functions are documented, but ignoring that so as to make is ill-founded point).
-- "I never gave these stories much credence." - HAL 9000
it can just get the dns server ips through iphlpapi and talk to them directly.
so no real competitive advantage
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
1: The same soname is kept until the library author makes a change that stops older applications from working. So you can (in theory) upgrade the library safely but you still have to be carefull about the possibility of stupid installers downgrading it.
2: library authors do sometimes make breaking changes without changing the soname. When they do so it puts distro makers (especially those that belive in distributed development like debian) in an awkward position. They either have to break compatibility with thier own older binaries or break compatibility with binaries built on other distros.
3: Library authors often make changes without changing the soname that while not effecting specified behavior do fix bugs that some applications may be relying on. Symbol versioning can sometimes solve this issue but only if the library authors know they are breaking undocumented functionality.
So the *nix situation is better than on windows one but still far from perfect.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
They have a way to make things work that is undocumented.
This works better than anybody else's methods.
When someone else starts to use it,
M$ changes it.
It is undocumented, so it is ok to chang it, WITHOUT NOTICE.
The other company's stuff crashes.
M$ Profit!!
-- They did this to WordPerfect and Lotus, now only Office survives.
MS and IE was like a blacksmith seeing the writing on the wall and bolting the new paradigm (web apps) onto the old. So now the horse hauls around a dangerous engine in the back of the wagon, doing things the same old way only worse.
The direction things were going - we could have standardized on web apps and thin/lean clients. We'd sacrifice a little usability in the UI for portability. Run a browser, run the app. Anywhere the browser runs, the app does.
Now the browser is encased in the cruft of Windows and the industry and art is held back. It's as bad as when IBM held back magnetic tape because they sold punch card makers.
If they also bypass ipsec that could mean real trouble. The organization I work for has told the employees not to upgrade to XP SP2 due to software incompatibility issues (I had to anyway, as I'm running SQL Server 2005 & VS 2005 which required SP2, and I'm not sure just what's supposed to be incompatible with what).
If an organization chose to try to use ipsec to distribute blocking filters as part of their security policy and MS bypassed them, I'd think there'd be some issues with that...
Haven't tried it yet, but may get around to it sooner or later...
that with use of iphlpapi its trivial to bypass the windows dns code (and therefore the hosts file) altogether right?
any anti-malware vendor could do this very easilly (writing a dns client isn't hard if you are a reasonable coder).
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
metasploit opcode in 3...2...
This reminds me of the worst website ever...which was trying to make a fool of a random bulletin voting service. This site does nothing but hosts bulletins, but yet you can vote as many times as you like if you remove the unique identifier from the action. here check it out. Worst Website Ever and please click vote like a hundred times it's amusing