Slashdot Mirror
Windows 8 Changes Host File Blocking
An anonymous reader writes "Windows 8 has been confirmed to not only ignore, but also modify the hosts file. As soon as a website that should be blocked is accessed, the corresponding entry in the hosts file is removed, even if the hosts file is read-only. The hosts file is a popular, cross-platform way of blocking access to certain domains, such as ad-serving websites."
So, after reading the article this can be summarized as "Microsoft gives you one more reason to disable Windows Defender and use a third party AV app."
Just add the hosts file to the Defender's white list. If you know how to edit the hosts file, you should know how to add it to the white list.
Otherwise, who says the edits to that file were not malicious.
APK's sole existence seems to be reliant on advocating the hosts file as a means of host filtering, despite more modern, flexible, easier, convenient and powerful alternatives existing.
How will APK stay relevant with the demise of the hosts file in Windows 8? Stay tuned....
If you ignore ACs because they are anonymous - you're an idiot.
Before everyone gets all excited... the article has already been updated with the fact that this is a feature of “windows defender” (and imo a reasonable one) and can be disabled.
The hosts file is popular for blocking sites, but also popular for redirecting to phishing sites as well. This seems like a very ineffective way of solving that problem, but at least it doesn’t look like there is some evil malicious intent..
In other news, running certain anti-virus products will prevent you from writing to the boot sector while they are running
As comments in the article point out, this behavior can be turned off by going to the Windows Defender settings... But by and large this make sense for 95% of Windows users as they will have NO clue about the hosts file, and even less of a clue if it has been modified for a phising attack. Nice to see microsoft take another step forward in protecting the blindingly ignorant and inept.
Prepare them for the shitstorm.
This seems like one of those situations where someone didn't think of the potential side effects. The goal was to fix some attack on specific sites, but the solution failed to consider that the mere presence of entries like Facebook is not enough to determine of the entry is in fact malicious and/or unintended. Security and expected behavior is compromised in too high a number of situations to use this software imo.
Yeah, this is basically a cack-handed way of fixing malicious hosts redirects.
It'll prevent malicious programmes from sending you to fake Facebook, but at the expense of entirely overriding any preferences YOU as tthe computer owner might wish to make via the Hosts file.
It's a staggering level of incompetence that this is their solution. It needs to be changed and they need to find either another way of solving it or allow some form of granulation and user input.
Corporation, n. An ingenious device for obtaining individual profit without individual responsibility. - Ambrose Bierce
Hope you enjoy your new 'media consumption appliance'. Its becoming less and less of a 'general purpose computer' every day.
---- Booth was a patriot ----
This is another good reason to stick with Windows 7, giving Windows 8 a miss.
One common use of the hosts file is to test staging servers, particularly web servers before pushing them live, and without the complexity and time it takes to set up an additional DNS server.
The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50
Hardly. At the enterprise level there are multiple different ways of handling situations such as this. Which one(s) you choose depends upon how you've organized Active Directory and your network.
But a different point is that this is an OLD way of phishing. The phisher is publishing the IP addresses that need to be blocked. So, again, at the enterprise level this kind of phishing would not be an issue.
If a phisher really needed to redirect traffic like that he'd have an easier time just getting the information in the local machine's DNS cache. That way it would never show up in the hosts file which means that it would be that much harder to spot. Then just keep updating the DNS cache.
So this is the wrong solution to the wrong problem and it is implemented in the wrong way. And it will probably cause more issues in the future as 3rd party developers have to work around not having the hosts file as a reliable option any more.
Nice way to remove a useful tool that's been around for decades.
The option on one end is to allow the user to have full, unfettered access to everything on their system, from the highest levels down to the lowest. This was done back in the DOS and Win9x days, and although it does have a few benefits in certain niches, it's also very bad for security.
The option on the other end is to disallow access to modifying the underlying system and related settings, and only allow such actions from full administrator accounts, and maybe not even then (depending on the mindset of the development team). This pisses off a lot of the hardcore techies who like to modify everything they can, but to be fair it does help protect the average user.
Now, I'm not defending Microsoft on how they've implemented this silently and without notification to the user, but on the face of it I think it's a good idea for the average user, at least with regards to the Facebook part of it (not so much on the Doubleclick part). Think about it - the average non-techie person wants Facebook to work. They will want to get their notifications on the Start screen (and elsewhere).
I agree with other posters - they should have openly done this and notified the user before "fixing" it - something like "Your hosts file has been modified to prevent access to <site on this list>. Is this desirable to you?" with three options - "Yes", "No", "More information". That way, the techies can click "Yes" and go about their business, average users can click "More information" and maybe actually learn a little bit in the process, then come back and click "Yes" or "No" as per their wishes.
As with many things, the idea is sound, but the implementation is not. To those saying "well, malware wouldn't redirect to localhost, it'd redirect to a false Facebook", there's nothing stopping a piece of malware from being written that is similar to the existing rogue security software, but that also uses hosts to block access to various social media sites, in an attempt to give the uneducated user further reason to believe they're truly infected as bad as the rogue software tells them they are, and also as a weak attempt to prevent the user from going online and telling people about it even after the rogue software has been removed. They'll do anything to get a few more successful purchases of their crap software. I'm quite surprised they haven't really done this already, to be honest.
FC Closer
From the article, Two of the sites that you can’t block using the hosts file are facebook.com and ad.doubleclick.net
I started using the hosts file over a decade ago, when I traced crashes that I was having to doubleclick.net. Ad supported software that I was using was receiving files from them, but it was doing a lot more than just displaying the ads (which I would not have objected to). Many users were experiencing this, but the author would not fix it so I and others started blocking the site (which resolved the problem, although the author lost some small amount of revenue).
More recently I have also started blocking facebook. I never use it, have no account there, but I've noticed an awful lot of network traffic going to and from my site with facebook.com. I'm not even a member, so I don't feel the need for them to track most of the sites that I visit. The hosts file has so far worked very well for this.
And argument that this feature is in any way for the benefit of the clueless user is bogus. The common way to block a site via the hosts file is to equate it to the IP address 127.0.0.1, which is the local machine. If Microsoft were doing this for the benefit of their users then they would simply look at the hosts file and, if they found redirects for sites that they were concerned about that were not pointed to the local machine, they might well conclude that it was potentially an attempt to hijack a domain name and then, after warning the user (and even asking him) correct the problem. This would even show the user that Microsoft was doing something good for the user for a change. But if the address is redirected to the local machine, the only reasonable conclusion that I can see is that the user wanted it that way (as it provides no attack vector). It took me about 30 seconds to realize that changing 127.0.0.1 redirects was user unfriendly and could easily be avoided if Microsoft were really concerned about their users who paid for the software. They just have to look at the IP address that the hosts file contains and if it is 127.0.0.1 then allow it to stay! Clearly Microsoft realized this too. The only reasonable conclusion is that they are doing this because they have a motive that is against customers interests.
I'm an American. I love this country and the freedoms that we used to have.
The answer is simple enough:
If you're already smart enough to edit the hosts file, you should be smart enough to add hosts to Windows Defender exclusion list.
Is this a change from the way that things were done in the past? Of course it is. This is how systems become more secure for the average user. Average Joe isn't messing with hosts.
Chicken Little, the sky is not falling.
Advantages over "other things"? Two words:
Firewall entries.
More flexible, centrally maintained, more granular, more reliable, and not prone to user tampering. Yea, how horrible.
On what planet does it make sense to change entries in a file on the system and not even warn the user that you are doing so? And since they are reportedly making the changes selectively, then if there were really an attacker his attack could have made other changes, but the user was never warned that the host file had anything "suspicious" in it and so would not be aware to even look at it and see if there was anything that the Great and Powerful Microsoft had missed. This isn't for the user, it is purely for MS's own interests.
I'm an American. I love this country and the freedoms that we used to have.
the Hosts file is targeted my malware to redirect to malicious sites and to keep under the radar to infect systems after they have been clean. (or even to a locally hosted proxy to infect sites like Facebook) Personally, I've seen facebook and myspace targeted in it. Never seen doubleclick but my guess is doubleclick is a target so that they can redirect to their own profit generating ads, or more malware to attempt to extort money out of people.
My guess is that the sites defender removes from hosts are sites that have been targeted by malware in the past. Frankly, I'd like to see the list of domains it looks for, but I'm sure that I woudn't want any of them redirected to some scumware site trying to pawn off fake antivirus.
In Soviet Russia, Trojan exploits YOU!
If one redirect a site to 127.0.0.1 from the aforementionned double click, chance that it is a malware is nil. Before removing the entry windows defender should check the IP and leave it for those site at 127.0.0.1. OTOH if it is an anti virus site it should remove it if it is precisely 127.0.0.1. If they went the extra way to check for some specific web site, then they should have done the extra way and check for the IP. Or make a pop up windows warning of the behavior and how to stop it.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
def reverse(s):
try:
trollstring = ""
for apksays in s:
trollstring = apksays + trollstring
except:
print("error/abend in reverse function")
return trollstring
s = ""
print reverse(s)
try:
s = "Insert whatever 'trollspeak/trolllanguage' gibberish occurs here..."
s = reverse(s)
print(s)
except Exception as e:
print(e)
ParseError: bad input on line5
http://mathcs.holycross.edu/~kwalsh/python/