Slashdot Mirror
Microsoft Bypasses HOSTS File
whitehatlurker writes "Dave Korn announced on the Full Disclosure and Bugtraq security lists that Microsoft is bypassing local lookups for some hosts, meaning that you can't locally block some sites through your HOSTS file. All of these sites are MicroSoft controlled sites.
The general feeling in the rest of the thread is that this was to obfuscate these hosts and prevent them from being blocked by malware. However, there are no non-MicroSoft hosts listed, giving a competitive advantage for MicroSoft's anti-malware tools over other brands."
I would have thought that if you cant subvert the HOSTS file then all you have to do is to intercept any DNS lookup of these MS addresses and you would have the same effect.
If you are trying to stop MS software from talking to home, then just use an external firewall.
Michael
There is no cryptographic solution to the problem where the intended receiver and the attacker are the same entity.
It helps prevent Malware. Sure, MS might have a slim advantage, but it also prevents otherwise botted PCs from accessing MS Updates against things like Blaster. I don't see this as being such a big deal.
People should know by now, when you go MS, you don't buy the horse, you buy the farm. You wanna segment and pick and choose on the MS platform? Good luck.
Microsoft could also be using this to prevent users from blocking MSN messenger ad servers.
tom@localhost ~ $ ls -l /etc/hosts /etc/hosts
-rw-r--r-- 1 root root 519 Oct 19 12:13
....
Why can't windows just make the host files read only.
Someday, I'll have a real sig.
Why? Maybe someone will get a comment from MS.
The point is that mucking around with the inner workings of the OS is BAD, unless it is documented appropriately. Now, documentation doesn't make it good, but if they're departing from the expected behavior, they should let people know.
[Fuck Beta]
o0t!
The main problem is not that you can't block MS addresses, it is that MS is only preventing their addresses from being blocked. Since they are now getting into the security business, this gives them what could be seen as an unfair advantage.
Let us say that Joe User gets a piece of Malware, so he decides to visit a security company to find a solution to his problem. However, the malware has modified his hosts file to block security company web pages from being accessed, which is extremely typical. Joe User is not experienced enough to even know there is a hosts file that he could change back.
Joe User's first attempt would likely be to norton.com, symantec.com (both go to Symantec's main page), or mcafee.com, since these names are pretty much synonymous with antivirus software. However, all of those are blocked and he can't access them.
However, if he goes to microsoft.com, he can go there since the hosts file is subverted in the OS. Since he can't spend the time to figure out why he can't access the others, he purchases Microsoft's AV solution.
"You spoony bard!" -Tellah
Hmm. This seems a bit ass-backwards to me.
Rather than having to ignore the HOSTS file because it may be malicious, shouldn't the solution be to prevent HOSTS from getting mangled in the first place?
(oh, and on an unrelated note: why on earth is the Win32 HOSTS file buried away under C:\Windows\System32\Drivers\etc\? I mean.... 'drivers'?!!? Bizarre.
What's the frequency, Kenneth?
An automatic update of WMP and your PC gets owned, and nothing can be done to prevent it!
...if Microsoft had documented this behavior. Yet still, I fail to see what the big deal is. So you can't force an IP address to a domain with hosts.txt for some sites that microsoft controls. If you need to do that, for example for some corporate filter or updating solution, you could just modify your own dns server. Home users on the other hand get more reliable access to windows update, which is very important. Otherwise it would be trivial for malware to block the computer from recieving updates, and the automatic updates would silently fail.
Cheers, Fogger
Um... I didn't do it!
If the adware can change your hosts file then this is pretty useless anyway. Now all the software has to do is run a script that does the following
nslookup whatever.microsofts.domains
takes the list of return addresses and
route ADD destination MASK mask INVALID INVALID INVALID foreach
and your traffic to MS wont even leave the network card.
Now I'll have to include a disclaimer...
Just another reason to continue using a more robust system :)
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
Who cares?
Nothing prevents you from not using the operating system's resolver. Its trivial to implement your OWN DNS client in your programs, bypassing any HOSTS settings and other DNS resolver issues.
I've never seen so many people who were so clueless and misinformed about the technical issues involved here.
I'm wondering if the behaviour will change if you just go into "services" and disable the DNS client.
I recommend this anyway. In theory it will increase the number of requests your machine does. But in practice it has saved me a lot of "try rebooting" calls.
Anyone out there with XP who can reproduce this?
A court of law has determined that Microsoft is a monopoly. One of the anti-trust regulations specifies that you cannot use your monopoly power to force your way into another market; that was the heart of the conviction against Microsoft in the Netscape case. Microsoft used their monopoly to oust Netscape as the dominant browser by bundling, which is illegal.
Now they are using that same monopoly power to take over the anti-malware market.
I'm rather ambivilent about this. On one hand, it is just one more case of Microsoft waiting for a market to mature, then forcing their way into it. On the other hand, this market wouldn't exist if it wasn't for their own shoddy products, so it's really Microsoft's reponsibility to fix it. However, malware protection software isn't the correct answer, it's just the most expedient, with a potential for additional profit.
All-in-all, it's just Microsoft's usual game: own the system, rig the system, use that to take over another system. Keep secrets, and act all coy when your secrets are discovered.
Microsoft is to software what Budweiser is to beer.
20 dollars, try free, like AVG. AVG is pretty nice it operates in stealth mode so your computers ports are invisible to probes and alerts you when any new program tries tries to phone home. And no I'm not affiliated or invested in AVG in any way I just think it's cool they make a good firewall available for free.
Yes it's propitiatory and closed source but at least free as in beer, shrug.
Anyway I only run Windows in a virtual pc. sandbox so it won't infect my real O.S.
Tired of all the isms, don't exploit people as an employer, or a government, mmmmK?
(And my troll is in Haiku)
Windows xp still better
need to run useful software
Mac and Linux are toys
that is not quite right
both the troll and the haiku
are somewhat lacking
but please understand
Mac and Linux are not toys
just other systems
Windows has problems
while it does have more software
it is insecure
please try something else
you might find that you like it
don't stagnate yourself
if end users switch
developers will follow
more software for all
so please help yourself
and help the rest of the world
try something else
if you don't like them
that is your prerogative
simply don't use them
but I'm warning you
going back is much harder
but it is your choice
other OSes
few viruses and malware
true computing bliss
as for poetry
haiku sylable count is
5-7-5
IIRC, it's a hangover from Windows 3.1 or maybe Win95.
-- You are in a maze of little, twisty passages, all different... --
Just look Here for more info:
= /library/en-us/dns/dns/dnsquery.asp
a ys=9999~start=20#15902844
http://msdn.microsoft.com/library/default.asp?url
Also you can defeat a Host file by simply changing the priority of lookups using the registry, more here:
http://www.dslreports.com/forum/remark,15900699~d
Black Gray White Hats Unite to protect http://testing.OnlyTheRightAnswers.com