Slashdot Mirror
Inside Cryptowall 2.0 Ransomware
msm1267 writes: If you need more evidence that ransomware is here to stay, and could turn into cybercriminals' weapon of choice, look no further than Cryptowall. Researchers at Cisco's Talos group have published an analysis of a Cryptowall 2.0 sample, peeling back many layers of known commodities around this threat, such as its use of the Tor anonymity network to disguise command-and-control communication. But perhaps more telling about the commitment around ransomware is the investment attackers made in its capabilities to detect execution in virtual environments, building in many stages of decryption present before the ransomware activates, and its ability to detect 32- and 64-bit architectures and executing different versions for each.
Cyptowall is very sophisticated. It will go into online backups and encrypt them too. If you are using a common online backup it can find those and encrypt those too. The best protection against this is a usb backup in a drawer. Cyptowall was recently being distributed by yahoo ads via a compromised flash ad http://news.yahoo.com/yahoo-ad.... You could have received it by going to your favorite news site.
Most malware is surprisingly benign. I've been saying it for years.
If you wanted to get really nasty, you can do these kinds of tricks and the thing will be damn-near scary to contract.
The problem is that we've bred a generation of people who see malware as nothing more than a distraction. Who will go to "uninstall" to remove it, thinking that's to be trusted, who don't realise that something running in the background is a problem once you close the advert it pops up.
At some point, something like this is going to be combined with a handful of never-seen-before exploits and it'll go across the globe and take weeks before there are effective patches to get rid of it. But the scary part is that the first few seconds of infection are all that's needed to totally control your ability to use your computer and access your data.
Maybe then we'll get proper application whitelisting / sandboxing by default in a desktop OS. And, hell, why do applications get the run of every file I use under my account? Should they not have to request such things first? Even on Unix-likes, if you get on as my user, you can trash all my data - why? Why is the data store not immutable and applications only get a link to the data IF they are allowed access to it? And thus nothing ever actually runs "as" the user, but only as its own separate user with similar permissions and only the files necessary.
Malware could be a lot worse than even this. Why it isn't yet, I haven't figured out - I presume because money-making is at the heart of it now rather than actually malintent with your data. But that won't last forever.
I'm sorry, but the very concept of a virus scan happening "at scheduled intervals" or after you've already double-clicked on the file just tells you that it's too late before you start. We've got away with it for decades in desktop OS, but it can't continue forever.
Getting a virus on my networks scares the crap out of me. People think I overreact when I just remote-off the machine (or tell them to pull the plug) and just re-image for even the most basic of adware. Fact is, I didn't install it and I have no idea what it ACTUALLY does. And I'll be damned if it's going to get the chance to go on my shared areas and do anything, even with file history, backups, etc. available.
I shall stay on my quad G5 under Linux or the time being. The market is too small for them to try to attack my machine.
Why didn't people realize that a single monoculture of CPU architecture (x86 in this case) would simplify the job of these guys. I've been clamoring against x86 monoculure ever since Apple became just another resale channel for Wintel clone hardware.
Monoculture is bad, it has always been bad and will always be.
- Disable, or at least require permission, for Flash
- Backup your backup to an offline, offsite location.
Not running Windows as the answer is not an option for most of us.
This seems like it could be a much larger threat to businesses than individuals.
But the 32/64 bit detection seems trivial. Why was it even mentioned? Makes me question the seriousness of the whole thing.
I'm assuming cloud based backup solutions can't be accessed by it, is that true?
The best protection is to pull your backups not push. You have whatever is performing you backups connect into the machine, and then pull the backups, not having your machine being backed up connecting to the destination and pushing. That way, the machine can be compromised but it has no clue that it's even being backed up (since it's simply a share that's being used.) When you use a usb drive, you'll be safe, until someone plugs it into that machine not knowing that as soon as they do, it will begin encrypting what's accessible on that usb drive. I aways try to backup from outside of the context of what is being backed up. If it's a VM, I backup from the host, not from inside of the VM I need the data from. If it's a storage end point, I don't back up the files, I snapshot the volumes.
It isn't always possible to do it that way, but doing it that way has saved my backside more than a few times.
In reading TFA, a prevention may be to add the Tor list into your hosts file so it cant download a Tor client to continue. Add the list into your router blacklist can be out of reach of the malware to bypass the block.
In the arms race this is effective on the current version. An update may have a new list of Tor download locations.
Not sure if blocking TOR at the router is possible or effective.
The truth shall set you free!
How is this crap spread?
Can I laugh at the people who have Flash enabled and let arbitrary sites run javascript? Or does this spread through some other vectors I don't know about?
I suspect the problem is the idiots who write websites, who demand your browser run in the most insecure possible configuration so you can see their ads and other shit they've hidden behind code which needs to run on your browser.
And I've always said I'm not willing to run my browser wide open just to make web sites work, because these things have been security holes for years.
Browsers need to be a whole lot less trusting, and not default to just running any old thing which comes along. And certainly stop trusting scripts from 3rd parties and running whatever crap pile of Flash comes along.
Unfortunately, users are used to seeing pages which give you detailed directions for re-enabling javascript and cookies.
So to all you web developers out there who have ever written that page ... fuck you, you slimy bastard. It's partly your fault the internet is a shit hole.
Lost at C:>. Found at C.
In reading TFA, having an executable called VBoxService.exe or vmtoolsd.exe seems like a sure fire way to have it skip right over you, as it thinks you're running inside a VM.
Do all your surfing on a VM. It will detect that it's running in a VM and do nothing.
Using windows is currently a real nightmare for the average guy. Most of the computers of un-computer-educated people I know are full of malware and adware.
At some point it was seen as a fatality. iOS and Android just showed people that it was not. That's why Microsoft Windows is (finally) dying. Ransomware may be the thing that will decide people to finally switch to something else.
And maybe 2015 will be the year of linux on the desktop :-)
Having a proper backup solution installed and running would protect you from this type of exploit as you could simply restore from backup.
My backups are done on a USB harddisk that's connected to the media server on my home network. Switch the HD on, and it'll appear and backups can be made.
How can I prevent malware from changing my backups? Would it be possible/effective to mount the drive as write-only, making it impossible to change existing files?
It's detecting the guest services, rather than the VM as such. VirtualBox at least will be no defense unless you run the guest services. OTOH, a fake guest service should defeat Cryptowall. Create a service named "VBoxService.exe" or "vmtoolsd.exe" which does nothing.
Ooh, moderator points! Five more idjits go to Minus One Hell!
Delendae sunt RIAA, MPAA et Windoze
A lot of people have been talking about backups and the fact that even your backups can be compromised. And that's true. The solution is versioning and rotation. If I'm compromised today, the files on Crashplan will be uploaded as encrypted files. But since they have versioning, I can go back 30 days or so and get the older versions. I may lose some data depending on how long I've been infected, but I'll be able to get some data back. The only other solution is to run a daily/weekly/monthly backup scheme that keeps your monthly backups for a year (or longer if you are really paranoid). It means you need 5 separate disks for each week and then another 12 for each month, which most people aren't going to want to do. Eventually the ransomware people will get patient and encrypt your files but allow access for 3-6 months before telling you.
There is a place in research labs for "true" virtualization/emulation, where a particular hardware environment is virtualized/emulated right down to the timing characteristics of the hardware it's pretending to be.
Obviously you can't do this with stock hardware - you'll probably have to use supercomputer-type hardware and do large chunks of it in an emulator but in principle and maybe in practice we should able to emulate at least a few mid-2000s motherboard/CPU/typical-other-hardware setups well enough to fool any software running on them.
The hard part will be doing all of the timing right while running the emulated clock at real-time speed rather than some slowed-down or other fake-time speed. If the timing isn't precisely right, when the evil software connects to its C&C and checks the "real world clock" it will know something is fishy if the emulation environment's clock isn't running at real time.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Assuming a Windows shop with a Windows server holding the online backups, the worst that any client-side app can do is corrupt the current version of the networked backup. It can't delete the shadow copies. Oh, I suppose it could try to fill up the disk so the earlier non-corrupted shadow copies get purged, but it can't outright delete them unless it infects the server first (or otherwise gets admin access to the server).
It also can't touch existing tape or other offline sever backups from an infected desktop/laptop.
In other words, if the server is being managed well, the worst that malware on an end-user device can do is obliterate anything that hasn't made its way to an offline backup, and it will be very difficult to obliterate server-side shadow copies.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I suspect most backup software on the computer pushes the backups to a network share somewhere that I suspect these ransomware packages go looking for and encrypt those files as well.
What if the backup system was remote and pulled the data from a network share on the client. If the client is infected, the infection cannot get to the backup file locations because they are not shared.
I realize this is not trivial for average users to setup, but I'm exploring this option for my home network. Setup NAS type server that looks for read only network shares accessable to userid BACKUP and slurps up any files it finds. Have it keep some kind of version control of a few days (multiple copies). Now when any new system is setup in my house (kid's laptops, wife's desktop, etc) I just have them create a read only share of their personal folders with a userid BACKUP and appropriate password.
Thoughts?
I'm in my right mind and I have the answer to everything!
Does the ransomware only work on Windows machines, or can it also affect *NIX/Mac/Android operating systems?
We use two strategies. First, the backup device is ONLY a backup device. It doesn't have a web browser and it's not used for email. We use very large servers to backup our customer data, but on a small scale you could use a Raspberry Pi, an old router with OpenWRT, or a smart NAS. Because the device handling backups has no desktop or services, it shouldn't get infected. Access is strictly limited - either console only or strong ssh keys, perhaps through a VPN first. The backup device can be so restricted because it doesn't need to be useable for anything but pulling backups.
Its access to the machines it backs up can also be extremely limited. The ssh key of the backup device is only allowed to run rsync with pull arguments. So even if the backup device were compromised, it can do no harm.
When you use a usb drive, you'll be safe, until someone plugs it into that machine not knowing that as soon as they do, it will begin encrypting what's accessible on that usb drive.
Disk drives - hard, floppy, etc. - used to have a hardware write protect feature. (Switch, punched-notch, etc.) Set it and there was no way the stored content could be changed. A backup that you'd set would not be vulnerable to rewrite attacks when plugged into an insufficiently-cleaned machine to restore the files.
Then drives came out where software could override the write protection.
Then the feature went out of fashion. Drives were apparently a bit cheaper that way.
A pity.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Wouldn't one way to stop it be to fake being a virtual machine? I'm sure that would start a cat & mouse game as they make their VM detection algorithm more sophisticated, but I'm thinking the faking code would be easier to write than the detection code.
Its not looking for virtualized operating systems. Its looking for virtualized application environments such as what you find within acrobat\adobe reader\flash when media files are being viewed. Adobe has, for a number of years, sandboxed their viewers so that malware could not use it as a vector. Now we have malware that is specifically designed to get around these security features.
Around 1% of RSA keys are easily broken, meaning you could decrypt your data without paying the ransom. This is because about 1% of keys are weak in one way or another. I wonder about the key generation function this malware uses. If they are using one of the weaker algorithms to generate keys, many victims may be able to decrypt fairly easily.
Done.
“It’s a pretty simple check looking for a common executable for VMware or (Oracle’s ) VirtualBox,” Carter said. “If it detects either, it assumes it’s in a virtual sandbox and will not execute. At that point, you don’t even have the [Cryptowall] code, just the dropper and not the actually Cryptowall binary that will run.
So would a simple defense be to "install" these files and/or registry keys on any system? Or perhaps identifying it as WINE with aregistry key would work?
Around 1% of RSA keys are easily broken, meaning you could decrypt your data without paying the ransom. This is because about 1% of keys are weak in one way or another. I wonder about the key generation function this malware uses. If they are using one of the weaker algorithms to generate keys, many victims may be able to decrypt fairly easily.
Please check with the NSA about this strategy.
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
Cryptowall specifically overwrites all shadow copies of files.
You missed my point. I was talking about a case where a user's desktop is infected but the user has a network share from a Windows Server mounted, and where the backup files are stored on that share.
Because it lacks administrative rights to the server, the infected desktop cannot directly erase the shadow copies on the server.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
See subject & this -> http://slashdot.org/comments.p...
There is a place in research labs for "true" virtualization/emulation, where a particular hardware environment is virtualized/emulated right down to the timing characteristics of the hardware it's pretending to be.
But randsomware authors are not interested at that. As in previous story they do price gouging how much you are willing to pay. As they won't get penny from vm they do not bother with these.
One purpose for research-lab "true" visualizations is to be successful honey-pots, allowing malware to be studied in a captive environment without giving away the fact that it's a captive environment.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Does anyone know if it aims to encrypt all your files quickly or over a time period to increase the chance of poisoning backups?
If the former, one mitigation might be to check file types on the backup? Assuming you do a backup to a different architecture, such as Linux, check file types - is a jpeg really a jpeg? Can it read plain text files? As soon as it finds one it can't, flag it up for investigation. Perhaps have a number of canary files, pull those first each time and compare them to known good copies stored in a non-shared filesystem on the backup machine, halting the backup if the file has changed in any way. It'd be a pain to set up, but once scripted it would all be automatic.
Question for cryptography gurus - does having a known good file or files increase the feasibility of decrpyting? I.e A file is encrypted. You have an unencrypted copy of it on read only media. Does that increase the chance of finding the keys used to encrypt A, and thus enable you decrypt other files for which you don't have good copies? Probably not, but thought I'd ask. Apologies if it's a stupid question before I get the piss ripped out of me ;)
Sigs are so 1990s. No way would I be seen dead with one.
I populate my custom hosts file via 12 reliable security community sources & articles + posts like yours (thanks) via APK Hosts File Engine 9.0++ 32/64-bit -> http://start64.com/index.php?o... to get more speed, security, reliability online & more (details shown in link as to those benefits specifically are enumerated there in that link).
* Courtesy "yours truly", 100% free & hosted + recommended by the BEST security team, MalwareBytes, on the planet per this very recent test of efficacy http://www.av-test.org/en/news... on their website here -> http://hosts-file.net/?s=Downl... )
Enjoy... & kudos to you!
APK
P.S.=> "Onwards & UPWARDS"... apk
It is more efficient & here's how you can get the best custom hosts there is easily http://it.slashdot.org/comment... from 12 reputable & reliable security community sources via this program of mine:
APK Hosts File Engine 9.0++ 32/64-bit:
http://start64.com/index.php?o...
(Details are there, or in the 1st link above, for what it can do for you for more speed, security, reliability, & even anonymity + more...)
* To quote Howard Stark from the film "Captain America":
"It's as strong as steel & a third the weight"
(Especially vs. browser addons,crippled by default OR owned by advertisers to be so, and in slower heavier messagepassing bound usermode vs. hosts in kernelmode, AND, vs. DNS, using less power, complexity + room for breakdown & slower remote queries by being the 1st default queried by the IP stack itself... complimenting DNS by lightening up request loads for admins of them AND fixing their redirect poisoned, DNS amp attacked, & downed issues...)
APK
P.S.=> Enjoy... apk
It uses your source + 11 others in the security community http://it.slashdot.org/comment...
APK
P.S.=> Good post from you too - nice to see yet another of 100's here alone on this site using custom hosts files for more security, speed, reliability & even anonymity (to an extent only on the latter unfortunately though) online... apk
Please provide your email address [1] and an encrypted file [2] that has been encrypted by CryptoLocker. This portal will then email you a master decryption key along with a download link to our recovery program that can be used together with the master decryption key to repair all encrypted files on your system.
Found it at this site.
Reputable security firms Fox-IT and FireEye collaborated on the free DecryptoLocker project, which provides a simple way for CryptoWall victims to recover their files and their privacy.
Disclaimer: I read this stuff but I know nothing more than that.
It little behooves the best of us to comment on the rest of us.
See subject: For specific payload + C&C Servers for cryptowall here -> http://blogs.cisco.com/securit...
* Enjoy...
APK
P.S.=> Gotta love the source articles & the folks producing the data for custom hosts files for blocking these malwares... apk
The article says that the malware works by creating temporary .exe files in the folder specified by the %appdata% environment variable. Eg "C:\Documents and Settings\[username]\Application Data". As does numerous other malware.
FoolishIT's "Cryptoprevent" utility uses Windows' "Software Restriction Policies" to try and stop .exe files from running in the %appdata% location. It is a good idea so for what it's worth, here's the URL: https://www.foolishit.com/vb6-...
I populate my custom hosts file via 12 reliable security community sources & articles + posts like yours (thanks) via APK Hosts File Engine 9.0++ 32/64-bit -> http://start64.com/index.php?o... to get more speed, security, reliability online & more (details shown in link as to those benefits specifically are enumerated there in that link).
* Courtesy "yours truly", 100% free & hosted + recommended by the BEST ( MalwareBytes ), on the planet per this very recent test of efficacyhttp://www.av-test.org/en/news/news-single-view/17-software-packages-in-a-repair-performance-test-after-malware-attacks/ on their website here -> http://hosts-file.net/?s=Downl...
Enjoy... & kudos to you for having the good sense to use hosts files where they apply (TONS of places for more speed, security, & reliability online) AND your pointing out the article source which has MORE DATA on blocking this malwares' C&C servers etc., here -> http://blogs.cisco.com/securit... specifically/for your & others' reference!
APK
P.S.=> IMPORTANT: ANOTHER EXCELLENT SOURCE (vs. CryptoLocker that's FAR MORE COMPREHENSIVE) -> http://garwarner.blogspot.com/... (Gar Warner's excellent - He posts here & did once, hence how I obtained his excellent works' analysis...)... apk
See subject: Vs. CryptoLocker - an excellent source (that's FAR MORE COMPREHENSIVE than the list from CISCO I provided from our article here today) -> http://garwarner.blogspot.com/...
* :)
Enjoy!
APK
P.S.=> On a SIDE note: Gar Warner's (researcher from that blog) an excellent THOROUGH security researcher - He posts here & did once (hence how I obtained his excellent works' analysis, & a HUGE very comprehensive list of CryptoLocker's C&C + infested rigs etc. online)
... apk
OK, take this comment as coming from someone who has little knowledge of how things work. Maybe a half step above JoeSurfer but barely.
Is there not a way to permanently ban your machine from ever encrypting all or certain files regardless of privileges? Perhaps two factor?
Is there even a way to get your machine to at least pop a window and ask if you actually want to encrypt all your files? Sometimes I can't even delete a file on my machine myself.
Is there ANY AV software that can detect Crypto stuff before it actually executes? What about DecryptoLocker?
Is there anyone in the cyber world that is tracking these people down (personally) and making an example of them? I would like to see what happens when they encrypt a cartel chief's computer. Then we'll see if these people can be tracked down if enough money (and violence) is thrown at it.
I wonder if anyone at Anonymous has had their files encrypted? I would be interested in seeing that cyber battle.
Hosts is of dubious efficacy compared to an actual DNS server.
Advantages:
APK is delusional and fundamentally doesn't understand DNS. Don't be APK.
Hosts by default is cached in memory by Windows, which if you have a huge hosts file is going to eat up a ton of memory. Unless it's paged to disk, or if you've disabled the DNS client service, and in that case you will be hitting the disk with every request. This is unlikely to be faster than a local network request. Also if you've disabled the client service (this is almost a requirement for an APK-style hosts file), you have disabled indexing, so you have to read the file line-by-line to figure out if a domain is a match, for each request. Any sites not in your list require reading the entire file.
If you care about security, you should run your own local DNS server. You should also use an ad blocker, which will prevent many requests to ad networks from even being made. The hosts file is for temporary and machine-specific DNS changes, like if you're developing a website and need http://test.local/ to point to your local web server. It's better to have an actual domain registered and and a subdomain, but it's not a big deal. Hosts is a bad solution for almost anything else. Having a program to manage your hosts file is just writing a really shitty, stupid DNS server.
I know I'm going to be trolled for weeks — again — for saying this, but someone has to.
Those who advocate genocide deserve every protection afforded by law, and none afforded by common human decency.
Older versions of CryptoWall didn't wipe the shadow copies.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
See subject: Can ghostery/adblock do 16 things hosts do for more speed, security, & reliability:
1.) Secure vs. known malicious sites/servers (beyond malicious adbanners: See 2-6 next)
2.) Protect vs. fastflux using botnet attack + stop their communications back to their C&C servers
3.) Protect vs. dyn dns using botnet attack + stop their communications back to their C&C servers
4.) Protect vs. DGA/domain generation algorithm botnet attack + stop their communications back to their C&C servers
5.) Secure vs. downed DNS servers (adds reliability)
6.) Secure vs. DNS redirect poisoned dns servers
7.) Protect vs. DNS Amplification attacks
8.) Get past a dnsbl you may not agree with
9.) Keep you off dns request logs
10.) Block trackers
11.) Block spam sources
12.) Block phishing sources
13.) Speedup websurfing not only adblocking but also hardcoding favorite sites
14.) Work on ANY webbound app (think stand-alone email programs, for example).
15.) Give you direct easily notepad/texteditor controlled data for all of the above
16.) Do all of those things & block ads (better than addons) more efficiently in cpu cycles + memory usage
* DNS = redirect poisoning (Kaminsky flaw & 99% of ISP DNS' are not patched), DNS Amplification attack, & more complexity/room for breakdown + exploit & higher power bills.
APK
P.S.=> The ANSWER ="NO" to each enumerated item above as far as Ghostery/AdBlock:
Ghostery's Advertiser owned - "A fox guards the henhouse"-> http://en.wikipedia.org/wiki/G...
AdBlock's 4++gb & 100% CPU usage inefficiency -> https://blog.mozilla.org/nneth... + ClarityRay defeats it.
Both do less than hosts do & less efficiently - hosts do MORE w/ less.
Both add more complexity/room for breakdown from a slower mode of operations (usermode = more messagepassing overheads vs. hosts in kernelmode).
Hosts start w/ the IP stack itself before REDUNDANT inefficient addons BEGIN to operate, w/ also as 1st resolver queried too
... apk The b
"Hosts by default is cached in memory by Windows, which if you have a huge hosts file is going to eat up a ton of memory. Unless it's paged to disk, or if you've disabled the DNS client service, and in that case you will be hitting the disk with every request." - by Tenebrousedge (1226584) on Thursday January 08, 2015 @02:33PM (#48767567)
WRONG: The local kernelmode diskcache caches hosts into RAM (hosts are just a file & that's what the diskcache does).
DNS doesn't use memory &/or CPU cycles? WRONG! It makes you use MORE OF THEM by using more moving parts complexity (which leads to its security issues & being down so much).
APK
P.S.=> Continued in my next 6 posts vs. your "so-called 'points'" I've easilly proven off/wrong... apk
"This is unlikely to be faster than a local network request." - by Tenebrousedge (1226584) on Thursday January 08, 2015 @02:33PM (#48767567)
You own machine's memory queries of hosts cached = FASTER than dns requests on a LAN (not local to your machine, hosts are in local machine RAM) & faster than remote DNS, for sure!
APK
P.S.=> Continuing addressing your bs & disproving it in my next 5 posts, point-by-"so-called 'point'" of yours, easily... apk
"Also if you've disabled the client service (this is almost a requirement for an APK-style hosts file), you have disabled indexing, so you have to read the file line-by-line to figure out if a domain is a match, for each request. " - by Tenebrousedge (1226584) on Thursday January 08, 2015 @02:33PM (#48767567)
WRONG - Hosts are cached by kernelmode faster OS diskcache & dnscache client is a USERMODE SLOWER service - for your favorite sites where you spend MOST OF YOUR TIME ONLINE @ THE TOP OF A HOSTS FILE = faster!
E.G. - I keep 25 favorite sites of mine @ the top of my hosts file: That is where I spend 95++% of my time online per my router logs analyzed!
I keep it in kernelmode with hosts using the diskcache & IP stack also (both are kernelmode vs. slower usermode)...
Clue & FACT: FOLKS SURF THAT WAY, not to "every possible host-domain/subdomain under the sun everyday"... that equates to approximately 2-3 MILLION indexed seeks in a SLOWER remote DNS (subject to TONS of security issues like redirect attacks, amplifications attacks, etc. that hosts aren't).
That USERMODE SLOWER dnscache also has issues with larger host files & BREAKS DOWN!
APK
P.S.=> P.S.=> Continued in my next 4 posts vs. your "so-called 'points'" I've easilly proven off/wrong... apk
"Any sites not in your list require reading the entire file." - by Tenebrousedge (1226584) on Thursday January 08, 2015 @02:33PM (#48767567)
I'd waste more time on adbanners if hosts didn't block them (they do along with MANY OTHER THREATS online) & for my favorite sites (25 here) @ THE TOP OF MY HOSTS FILE, that's 95++% of the time being as fast as possible, from LOCAL SYSTEM MEMORY & the kernelmode diskcache (keeping it pure kernelmode faster vs. dnscache client usermode slower, combining local kernelmode diskcache with the kernelmode PnP IP stack).
Covering this again vs. this b.s. from you (I did in my earlier 3 posts also):
CLUE: FOLKS SURF TO A FINITE NUMBER OF FAVORITE SITES, not "every host-domain/subdomain under the sun"... this is HOW & WHY hosts are faster than remote DNS & time taken querying it + resolving & returning it from a remote locale vs. local system memory (like hosts in kernelmode diskcache RAM with your fav. sites @ the TOP of the hosts file - immediate FASTER resolution by far vs. remote DNS).
APK
P.S.=> Continued in my next 3 posts vs. your "so-called 'points'" I've easilly proven off/wrong... apk
"If you care about security, you should run your own local DNS server" - by Tenebrousedge (1226584) on Thursday January 08, 2015 @02:33PM (#48767567)
DNS has security issues: Redirect poisoning, Amplification attacks, being downed etc. - hosts cure that, by not using DNS for your favorite sites hardcoded @ the top of hosts (immediate queries & faster from LOCAL system kernelmode diskcache memory (not slower usermode) + WHERE YOU SPEND MOST IF NOT ALL OF YOUR TIME ONLINE mostly - covered already in my earlier posts...).
DNS also adds complexity & thus, room for breakdown + exploits as well as inefficiency w/ more moving parts to power (raising powerbills thus, also).
APK
P.S.=> Continued in my next 2 posts vs. your "so-called 'points'" I've easilly proven off/wrong... apk
"You should also use an ad blocker, which will prevent many requests to ad networks from even being made.
" - by Tenebrousedge (1226584) on Thursday January 08, 2015 @02:33PM (#48767567)
Addons are WAY inferiority in abilities + less efficient than hosts http://it.slashdot.org/comment... + addons do far less than hosts for added speed, security, reliability, & anonymity even - by far!
Prove those points wrong!
* Go for it - you'll need a MIRACLE to prove your way out of that one...
FACT: Hosts do MORE with LESS & they do MORE BY FAR vs. addons - no questions asked + from a FASTER MODE OF OPERATIONS (kernelmode via local diskcache & IP stack in combination working with one another... vs. addons in usermode adding messagepassing overheads + layering on more... & for what? TO DO LESS THAN HOSTS?? Yes...)
APK
P.S.=> Prove these points from my other reply to you wrong also (good luck, you'll need it) regarding browser addons inferiority (& DNS') to hosts files -> http://it.slashdot.org/comment... ... apk
"APK is delusional" - by Tenebrousedge (1226584) on Thursday January 08, 2015 @02:33PM (#48767567)
You're no psych pro & use illogical adhominem attacks on me (thus you're NOT proving your "points" at all, whatsoever)
PROVE EACH OF MY POINTS HERE IN THESE LINKS WRONG THEN (from my prior replies to you that easily proved YOUR "so-called 'points'" WRONG):
http://it.slashdot.org/comment...
http://it.slashdot.org/comment...
http://it.slashdot.org/comment...
http://it.slashdot.org/comment...
http://it.slashdot.org/comment...
http://it.slashdot.org/comment...
http://it.slashdot.org/comment...
* You'll fail! You already have, point-by-"so-called-'point'" of yours!
---
"and fundamentally doesn't understand DNS. Don't be APK." - by Tenebrousedge (1226584) on Thursday January 08, 2015 @02:33PM (#48767567)
I understand it, + DNS shortcomings in efficiency (more complexity & higher power bills), & security (DNS amplification attacks, DNS redirect poisoning attacks, being downed, rogue DNS servers out there, etc.) - do you?
Evidently not.
I don't write a DNS server (I could with my own code - could you? Evidently not) since hosts cure all of those shortcomings in DNS with something you already have - hosts with less complexity, room for breakdown/exploit, & less power consumption + less of a learning curve than DNS - by far, on ALL of those grounds...
APK
P.S.=> b>Hosts also do DNS admins a HUGE FAVOR lightening up DNS request loads using fav. sites @TOP OF HOSTS cached in kernelmode diskcache driven RAM (which YOU COMPLETELY OVERLOOKED, genius)
Hosts also shore up DNS' numeroius efficiency shortcomings (higher power bills, more moving parts room for breakdown, layering on MORE to do the same things as hosts (needlessly) & security issues in DNS (redirect poisoning, amp attacks, etc.) that hosts stop by avoiding DNS & resolve faster from your own system vs. remote DNS)... apk
Can addons do all these things hosts can (NO) -> http://it.slashdot.org/comment... as well as more efficiently? Hell no, lol!
Hosts do MORE, from 1 single native kernelmode driven part you have already, with less!
(Which is WHY you're avoiding those points, clearly...)
---
When you use DNS servers, you expose yourself to security issues they have (DNS Amplification attacks, Redirect poisonings, etc.)!
By comparison - hosts overcome that easily with a native part you already have in KERNELMODE (IP stack & diskcache in combination in fact)... not slower usermode like addons.
DNS use adds complexity + a steeper learning curve
AND
YOU'RE INEFFICIENTLY LAYERING ON "MORE" needlessly - thus also raising your powerbill + CPU & RAM consumption too (putting on more layers of things you DON'T NEED, in addons + DNS even).
---
Hosts also lighten up DNS server request loads (bonus) & COMPLIMENT dns thus, as well as overcoming their security shortcomings (noted above) by avoiding remote DNS.
APK
P.S.=> Denying those points above? Go for it - you'll FAIL - just as you have on my points on hosts doing more than addons & more efficiently, for less, in the 1st link above... apk
See subject: What starts first - the IP stack + diskcache (kernelmode) or browsers (usermode slower & messagepassing overheads bound + inefficient as hell, ala AdBlock -> https://blog.mozilla.org/nneth... crippled by default (since it was bought out/'souled-out' to advertisers to do so, deceiving users since MOST WON'T CHANGE THAT DEFAULT & advertisers know it, & NOT DOING ITS JOB FULLY).
As to the rest of TenebrousEdge's "so-called 'points'"? I dusted them, point by point...disprove them (good luck - you'll need it... more like a miracle)... heck - he overlooked diskcaching of hosts into MEMORY for Pete's sake (his biggest fail).
Lastly, per my subject-line:
You better look at the resolver order in windows in the registry (which you can raise hosts to 1st easily as I do)... no matter what though, hosts are in operation since the IP stack hosts is part of operate before browser addons ever do (& before browsers they put more inefficient messagepassing + memory & cpu bloat onto).
Adding on MORE (addons) to do LESS (addons) != efficiency. Hosts do more, with less (from a single native part you already have).
APK
P.S.=> Answer = hosts start up first, since the kernelmode subsystems driving them do... no questions asked! ABOVE ALL ELSE, you can't show addons doing more with less, vs. hosts -> http://it.slashdot.org/comment... you have FAILED...
... apk