Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Block Adware and Malware with /etc/hosts

github.com

Post reply on HN
Print view View original

51–60 of 79 posts

Re: Block Adware and Malware with /etc/hosts

#51

Post by eli »

wnevets wrote: post #49
eli wrote: post #48

Earlier quoted context omitted.

I'm not doubting you can trick people into engaging with a phishing site that looks like WinRAR. I just don't think the domain makes any difference.

You don't think a url like those in this article [1] makes any difference? You have more faith stopping phishing than I. [1] https://medium.com/@bobbyrsec/the-dangers-of-googles-zip-tld...

If I hover over the link like my phishing training says to do, Chrome correctly shows it as "https://v1271.zip"

If I don't bother hovering over the link then the domain never mattered at all. Could have hosted the file anywhere since the link text in HTML (including HTML email) need not have any relation to the destination. You can simply write a legitimate github.com link but the href goes somewhere else.

Any situation where you're relying on users to visually inspect every link and decide if the domain looks plausible is already a security failure.

If I'm downloading and executing files that are randomly in a Medium article or in my inbox from an untrusted source then we're in trouble whether they are hosted on github or not.

Re: Block Adware and Malware with /etc/hosts

#52

Post by wnevets »

eli wrote: post #51
wnevets wrote: post #49

Earlier quoted context omitted.

You don't think a url like those in this article [1] makes any difference? You have more faith stopping phishing than I. [1] https://medium.com/@bobbyrsec/the-dangers-of-googles-zip-tld...

If I hover over the link like my phishing training says to do, Chrome correctly shows it as " https://v1271.zip " If I don't bother hovering over the link then the domain never mattered at all. Could have hosted the file anywhere since the link text in HTML (including HTML email) need not have any relation to the destination. You can simply write a legitimate github.com link but the href goes somewhere else. Any situ…

> If I hover over the link like my phishing training says to do

How do you hover on mobile? Instead of training my family members to hover on their phone's I will continue to just block these TLDs.

Re: Block Adware and Malware with /etc/hosts

#53

Post by DaiPlusPlus »

8organicbits wrote: post #16
hda111 wrote: post #13

Earlier quoted context omitted.

What is a nefarious redirect? Does it look for entries without 127.0.0.1?

There's a concern that a malicious list could point domain names to a malicious IP address. I don't think its a big concern with https:// since the cert will be invalid, but it's still a concern.

I suspect it’s very likely that somewhere in the world is a domain-validation server, used by a trusted CA, which has this very anti-advertising hosts file installed onto it.

Re: Block Adware and Malware with /etc/hosts

#54

Post by eli »

wnevets wrote: post #52
eli wrote: post #51

Earlier quoted context omitted.

If I hover over the link like my phishing training says to do, Chrome correctly shows it as " https://v1271.zip " If I don't bother hovering over the link then the domain never mattered at all. Could have hosted the file anywhere since the link text in HTML (including HTML email) need not have any relation to the destination. You can simply write a legitimate github.com link but the href goes somewhere else. Any situ…

> If I hover over the link like my phishing training says to do How do you hover on mobile? Instead of training my family members to hover on their phone's I will continue to just block these TLDs.

I’m confused what you’re advocating. If your family isn’t checking the domain before downloading and executing files then the .zip tld doesn’t matter. They’re just as vulnerable to phishing without it.

Re: Block Adware and Malware with /etc/hosts

#55

Post by wnevets »

eli wrote: post #54
wnevets wrote: post #52

Earlier quoted context omitted.

> If I hover over the link like my phishing training says to do How do you hover on mobile? Instead of training my family members to hover on their phone's I will continue to just block these TLDs.

I’m confused what you’re advocating. If your family isn’t checking the domain before downloading and executing files then the .zip tld doesn’t matter. They’re just as vulnerable to phishing without it.

> I’m confused what you’re advocating.

I'm advocating using a pi-hole to block problematic domains on your network using list like the one from StevenBlack and entire TLDs that could be confusing. If you don't think .zip & .mov could be confusing then feel free to not block them.

Re: Block Adware and Malware with /etc/hosts

#57

Post by Tarq0n »

microtonal wrote: post #25

On the Mac the new Little Snitch Mini is really nice for this: https://www.obdev.at/products/littlesnitch-mini/index.html Sure, you could manage /etc/hosts manually, but Little Snitch Mini has a nice interface for managing blocklists, auto-updates them, and has nice visualization, and you can also manage blocks per app.

Portmaster is the best Windows alternative I've found.

Re: Block Adware and Malware with /etc/hosts

#58

Post by fullspectrumdev »

star-glider wrote: post #10

This is the default list used by the pihole project as well; it's a very good list. FWIW, something like ublock origin is going to be better for in-browser blocking (for example, DNS poisoning won't work with youtube ads, which are served from youtube.com, but addins like UBO can remove them because they can hook into the actual traffic). The ultimate adblocking solution is to use UBO in your browsers AND spin up a p…

Extra fun: measure bandwidth use before and after implementing, the savings are fucking nuts. All that adtech webshit loading in hundreds of mb of obfuscated JS and assets to sell you widgets…

Re: Block Adware and Malware with /etc/hosts

#59

Post by briHass »

joeywas wrote: post #36
Havoc wrote: post #32

Much better to do so at router level via pihole or Adguard Home. That way it catches the calling home from all the various electronics too

Yes. pihole coupled with a router that can intercept outbound traffic on port 53 and force it to the pihole is how my home network is configured. That way it catches all those sneaky devices that have hard coded dns servers.

I've also added (pfSense with pfBlocker) a list-rule to block all Public DNS servers (https://public-dns.info/). If you want to resolve a name, you gotta go through my DNS server.

The UDP:53 block gets almost everything, but I'm preparing for DoH.

Post reply on HN