Slashdot Mirror
Microsoft Bypasses HOSTS File
whitehatlurker writes "Dave Korn announced on the Full Disclosure and Bugtraq security lists that Microsoft is bypassing local lookups for some hosts, meaning that you can't locally block some sites through your HOSTS file. All of these sites are MicroSoft controlled sites.
The general feeling in the rest of the thread is that this was to obfuscate these hosts and prevent them from being blocked by malware. However, there are no non-MicroSoft hosts listed, giving a competitive advantage for MicroSoft's anti-malware tools over other brands."
People should know by now, when you go MS, you don't buy the horse, you buy the farm. You wanna segment and pick and choose on the MS platform? Good luck.
tom@localhost ~ $ ls -l /etc/hosts /etc/hosts
-rw-r--r-- 1 root root 519 Oct 19 12:13
....
Why can't windows just make the host files read only.
Someday, I'll have a real sig.
Why? Maybe someone will get a comment from MS.
The point is that mucking around with the inner workings of the OS is BAD, unless it is documented appropriately. Now, documentation doesn't make it good, but if they're departing from the expected behavior, they should let people know.
[Fuck Beta]
o0t!
The main problem is not that you can't block MS addresses, it is that MS is only preventing their addresses from being blocked. Since they are now getting into the security business, this gives them what could be seen as an unfair advantage.
Let us say that Joe User gets a piece of Malware, so he decides to visit a security company to find a solution to his problem. However, the malware has modified his hosts file to block security company web pages from being accessed, which is extremely typical. Joe User is not experienced enough to even know there is a hosts file that he could change back.
Joe User's first attempt would likely be to norton.com, symantec.com (both go to Symantec's main page), or mcafee.com, since these names are pretty much synonymous with antivirus software. However, all of those are blocked and he can't access them.
However, if he goes to microsoft.com, he can go there since the hosts file is subverted in the OS. Since he can't spend the time to figure out why he can't access the others, he purchases Microsoft's AV solution.
"You spoony bard!" -Tellah
Hmm. This seems a bit ass-backwards to me.
Rather than having to ignore the HOSTS file because it may be malicious, shouldn't the solution be to prevent HOSTS from getting mangled in the first place?
(oh, and on an unrelated note: why on earth is the Win32 HOSTS file buried away under C:\Windows\System32\Drivers\etc\? I mean.... 'drivers'?!!? Bizarre.
What's the frequency, Kenneth?
The only thing that troubles me is the inclusion of MSN.com in the list.
The other hosts are used in Microsoft's patch distribution network and honestly is not something the average user would ever need to block. It is, however, something a virus/spyware program would love to block. So, if you want to block those hosts, buy a firewall, they're down to about $20.
As for MSN, my only guess is that they don't want to block updates for MSN messenger.
What we have to remember is that these sites are required to fix a broken system, so I don't view this as just an advantage for MS antispyware.
An automatic update of WMP and your PC gets owned, and nothing can be done to prevent it!
...if Microsoft had documented this behavior. Yet still, I fail to see what the big deal is. So you can't force an IP address to a domain with hosts.txt for some sites that microsoft controls. If you need to do that, for example for some corporate filter or updating solution, you could just modify your own dns server. Home users on the other hand get more reliable access to windows update, which is very important. Otherwise it would be trivial for malware to block the computer from recieving updates, and the automatic updates would silently fail.
Cheers, Fogger
Um... I didn't do it!
Who cares?
Nothing prevents you from not using the operating system's resolver. Its trivial to implement your OWN DNS client in your programs, bypassing any HOSTS settings and other DNS resolver issues.
I've never seen so many people who were so clueless and misinformed about the technical issues involved here.
A court of law has determined that Microsoft is a monopoly. One of the anti-trust regulations specifies that you cannot use your monopoly power to force your way into another market; that was the heart of the conviction against Microsoft in the Netscape case. Microsoft used their monopoly to oust Netscape as the dominant browser by bundling, which is illegal.
Now they are using that same monopoly power to take over the anti-malware market.
I'm rather ambivilent about this. On one hand, it is just one more case of Microsoft waiting for a market to mature, then forcing their way into it. On the other hand, this market wouldn't exist if it wasn't for their own shoddy products, so it's really Microsoft's reponsibility to fix it. However, malware protection software isn't the correct answer, it's just the most expedient, with a potential for additional profit.
All-in-all, it's just Microsoft's usual game: own the system, rig the system, use that to take over another system. Keep secrets, and act all coy when your secrets are discovered.
Microsoft is to software what Budweiser is to beer.
The real problem with this is that: 1. It wasn't documented, so people had to discover this non-intuitive exception. 2. It defeats the purpose of the hosts file. Had they also included the other AV vendors in the list and made the function public it may have seemed like a practical band aid to the hosts file hijacking problem. Instead they made it M$ only and hid it so it looks slimy. The issue is being addressed is also PEBKAC related.. If Windows users weren't logged in as admin the hosts file would be off limits.
Absolutely, yes, it is a bad thing.
Microsoft has:
instituted not only License 6, but also "phone home" validation. At any time, MS may
decide to shut down any business worldwide that uses their products, at their (or a
malviolent government's) discretion;
embraced and extended(tm) LDAP with kerberos authentication that is not industry-
standard or cross-platform compatible;
embraced and extended(tm) web browser standards that have made Internet and
platform security a nightmare;
implimented a software firewall (XP SP2) that doesn't actually control/restrict all
incoming and outgoing packets, making the use of a third party (H/W?) firewall
less redundant and more actually necessary;
stripped nearly all OS improvements out of their upcoming flagship OS, excepting
Digital Rights Restrictions -- which may also remotely disable or remove products
and/or services which they choose to disallow for any reason.
Bypassing DNS and the hosts file on the OS platform is their "camel's nose under the
tent flap" for future modifications to the network stack, all in the name of their brand
of "security", which is (frankly) appalling. Given Microsoft's current product direction,
it is not outside the realm of possibility that the future average computer user's
experience will be some cross between a WebTV and an XBox.
"Safeguarding" your hosts file against tampering is pointless. Yes, a few trojans toy with it. The ONLY place that's ever redirected afaik is updates.microsoft.com.
So this is going to be celebrated as the hack against malware that keeps you from updating. Ohhhh great. Ok, next move from the malware writers is simply to keep a thread running that checks if something is coming in from the "unwanted" sites. If so, it's deleted before execution. Problem solved.
There is no techical solution for social problems.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
The problem I have is that it's My PC! It is not Microsoft's (as much as they want to believe it) or Sony's or Star Forces, but Mine. I am sick to death of companies trying to protect me from ME and preventing me from using my devices as I want. Try and put a good Cisco WiFi card in the mini-pci slot of a HP, Compaq, or IBM laptop. "Unauthorized wireless network card detected. System halted..." Try using a car charger for any RAZR phone on a Verizon RAZR phone. "Unauthorized Charger." When you sell me something, IT'S MINE DAMNIT!
Sorry, I just had to vent...
Maby because it's not illegal?
It's trivial to directly perform a DNS query. Any third-party application (including malware) can do exactly the same thing Microsoft is doing, there's no "secret sauce" here that's only available to the coders in Redmond.
"Only two things are infinite, the universe and human stupidity, and I'm not sure about the former." --Albert Einstein
Except it's not very effective, is it? Is there anything stopping a system-level process (eg, malware) from grabbing the window handle and sending the appropriate keystrokes to dismiss the prompt? I haven't tested it myself, but I've used that technique successfully for the "unsigned driver" warnings. WFP lets you keep the unsigned driver/DLL with no further warnings if you press two buttons.
LOAD "SIG",8,1
In a way, it is. This is a part of the price that you pay for these things actually existing, and existing for the prices you have them. When you get sold something it's yours as sold, not as you want it to do. If you don't like it, don't buy it, it's as simple as this.
Please realize that in order for the corporations to meet business targets, it is sometimes needed to cut off competition like that. If you had the right of getting every piece of equipment being compatible with everything else out there, then you might find yourself in a world where aforementioned pieces are delayed or don't exist at all, because selling these (and funding R&D in the first place) wouldn't be financially viable.
So this is a trade-off of sorts: you get a worse-compatibility item for better prices and better availiability. How much would that RAZR cost if you could use any charger you like? And would Verizon even bother?
Now, I'm not defending Microsoft in this particular case, since your post didn't either. I'm just trying to be fair to evil corps (gasp!). After all, there is still free market and if there is enough of likes of you who have a desire of "mine damnits", then there is demand and someone will surely fill the supply.
And if not... well then I guess there's a lot that I'd like myself to use, too, but does not exist/costs too much as well.
I think he must have had you in mind when the Sony exec said "Most people I think don't even know what a rootkit is, so why should they care about it?"
Upon further thinking, this whole article is flawed and perverted.
"Microsoft is bypassing local lookups for some hosts, meaning that you can't locally block some sites through your HOSTS file."
I already said why that's stupid anyway.
"All of these sites are MicroSoft controlled sites. The general feeling in the rest of the thread is that this was to obfuscate these hosts and prevent them from being blocked by malware."
Well, malware authors are just going to replace the resolver function instead of aiming for the easier target. If they can replace entries in the hosts file, they have sufficient privileges anyway.
"However, there are no non-MicroSoft hosts listed, giving a competitive advantage for MicroSoft's anti-malware tools over other brands."
That's really far-fetched. Let me see: Most users use their Windows as root-equivalent because of sucky software and because they don't know any better. Spyware can replace the hosts file to block access to Microsoft's auto-update because users are root. So instead of fixing the fundamental problem, Microsoft does what it does best: kludges, bandaids, bullshit. And now suddenly this is viewed as a "competitive advantage"?! Remember people: don't attribute to malice what can be explained with stupidity.
To me this is only proof again that anything related to Windows is a swamp of bad design, ugly hacks and inconsistencies. I wouldn't construct an evil intent on Microsoft's side here. It's just their usual incompetence.
Of course it runs NetBSD. BTC: 1NT7QvbetmANwaMzhpVL6
What it means is that if a rootkit alters the internal IP tables for a Microsoft address, most virus checkers won't pick up on it (the Hosts file will be untouched) and it will be impossible for the user to override the problem in order to get to Microsoft's website to download the necessary patches.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)