Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Block Adware and Malware with /etc/hosts

github.com

Post reply on HN
Print view View original

41–50 of 79 posts

Re: Block Adware and Malware with /etc/hosts

#41

Post by rovr138 »

miles wrote: post #7

To ensure there are no nefarious redirects in such a massive list, this one-liner comes in handy[1]: grep -v '#' steves_hosts | awk '{print $1}'| sort | uniq -c [1] https://news.ycombinator.com/item?id=11456562

    find . -name hosts -exec grep -v '^#' {} \; | awk '{print $1}'| sort | uniq -c
    43029
     204 #
    4289934 0.0.0.0
    10763 127.0.0.1
      18 255.255.255.255
      54 ::1
       1 analytics.shein.co.uk
       1 analytics.shein.com
       1 auxilium.ftb.team
       1 bstats.org
       1 fe00::0
      17 fe80::1%lo0
      33 ff00::0
      17 ff02::1
      17 ff02::2
      17 ff02::3
       1 mcmc.dev
       1 mcstats.org
       1 metrics.shmeeb.net
       1 openeye.openmods.info
And looking at those last ones, looks like some files have a different format. For example, the data/minecraft-hosts/hosts file,

     ~/D/P/hosts   master   grep -irn 'openeye.openmods.info' .
    ./alternates/fakenews/hosts:174307:0.0.0.0 openeye.openmods.info
    ...
    ./hosts:174306:0.0.0.0 openeye.openmods.info
    ./data/minecraft-hosts/hosts:9:openeye.openmods.info
     ~/D/P/hosts   master   grep -irn 'metrics.shmeeb.net' .
    ...
    ./data/minecraft-hosts/hosts:8:metrics.shmeeb.net

Re: Block Adware and Malware with /etc/hosts

#42

Post by wnevets »

eli wrote: post #39
wnevets wrote: post #24

Earlier quoted context omitted.

I'm not worried about the non-techies being tricked into thinking .com is an executable, I doubt they even know its possible. They almost certainly know about .zips

I still don't understand the threat model here. Is there an example of how this could be used as part of an attack?

https://thehackernews.com/2023/05/dont-click-that-zip-file-p...

edit: HN is actually erroring out if I post an example .zip domain of the problem

Re: Block Adware and Malware with /etc/hosts

#43

Post by fullstop »

ndsipa_pomu wrote: post #37
sumtechguy wrote: post #29

Earlier quoted context omitted.

heh I made the mistake of engaging with that once. oh boy.... They could not wrap their head around the idea that the hosts method is limited in some use cases. This could not be blocked without blocking the main host too. https://example.com/adverts-folder/advert.jpg Now it sort of works in practice as most of the advert networks do not host on the same domain. It is good at catching out whole bad domains but partia…

I'm half expecting a torrent of abuse in reply to you now from whoever that was

Plus you can't forget Natalie Portman and Hot grits down your pants.

What a strange place that was.

Re: Block Adware and Malware with /etc/hosts

#45

Post by alecco »

jarebear6expepj wrote: post #9
alecco wrote: post #5

https://github.com/Ultimate-Hosts-Blacklist/Ultimate.Hosts.B... Don't forget about hosts.deny (but you probably need it at your router if you are behind one).

Shell scripts that download more shell scripts. Kind of terrifying, no? I feel like I would personally rather take my chances getting scammed out of a CS skin than running these installers as root at will.

Download the raw file.

Re: Block Adware and Malware with /etc/hosts

#46

Post by zeruch »

kevin_thibedeau wrote: post #35
commandlinefan wrote: post #34

I use Brave (not so much for the built-in ad block, but mostly because it's not actually Chrome) and I've noticed that more and more sites have ad-block detection that appears to work by sending a unique token to their ad server and then not loading content until after the token has been verified to have been received. I imagine there are ways around this on a per-site basis, it's generally easier to just give in and…

NoScript usually bypasses this behavior. Especially when the content is delivered but hidden with JS DOM manipulation.

I wish NS worked on Android as a generic domain blocker

Re: Block Adware and Malware with /etc/hosts

#48

Post by eli »

wnevets wrote: post #42
eli wrote: post #39

Earlier quoted context omitted.

I still don't understand the threat model here. Is there an example of how this could be used as part of an attack?

https://thehackernews.com/2023/05/dont-click-that-zip-file-p... edit: HN is actually erroring out if I post an example .zip domain of the problem

I'm not doubting you can trick people into engaging with a phishing site that looks like WinRAR. I just don't think the domain makes any difference.

Re: Block Adware and Malware with /etc/hosts

#49

Post by wnevets »

eli wrote: post #48
wnevets wrote: post #42

Earlier quoted context omitted.

https://thehackernews.com/2023/05/dont-click-that-zip-file-p... edit: HN is actually erroring out if I post an example .zip domain of the problem

I'm not doubting you can trick people into engaging with a phishing site that looks like WinRAR. I just don't think the domain makes any difference.

You don't think a url like those in this article [1] makes any difference? You have more faith stopping phishing than I.

[1] https://medium.com/@bobbyrsec/the-dangers-of-googles-zip-tld...

Re: Block Adware and Malware with /etc/hosts

#50

Post by tobinfekkes »

hungrigekatze wrote: post #28

I used to use this hosts file some years ago: https://someonewhocares.org/hosts/ Forgot about it for a few years, but this post jogged my memory. We currently use a PiHole for house-wide, network-wide ad and telemetry blocking, though, but perhaps that hosts list is useful to someone else.

I've been using this list locally and on my PiHole for years. Love it!
Post reply on HN