61–70 of 79 posts
0.0.0.0 connects to your own machine. You should not "block" domains by assigning them to 0.0.0.0. You should instead return NXDOMAIN.
0.0.0.0 connects to your own machine. You should not "block" domains by assigning them to 0.0.0.0. You should instead return NXDOMAIN.
There's no host file syntax for NXDOMAIN, it has to be an IP. 127.0.0.1 with Port 80 assigned to a dummy page can be an alternative solution if you don't like 0.0.0.0.
Earlier quoted context omitted.
There's a concern that a malicious list could point domain names to a malicious IP address. I don't think its a big concern with https:// since the cert will be invalid, but it's still a concern.
I suspect it’s very likely that somewhere in the world is a domain-validation server, used by a trusted CA, which has this very anti-advertising hosts file installed onto it.
Earlier quoted context omitted.
Someone explicitly called out and removed the Useless Use of cat but yet left the Useless Uses of grep, sort, and uniq in, I see. (-: * https://porkmail.org/era/unix/award#grep awk '!/#/ { seen[$1]++; } END { for (k in seen) { print seen[k],k; } }' steves_hosts
I love awk as much as the next person and I've written some pretty large scripts with it, but the original grep/sort/uniq is a lot easier to understand in two seconds. I don't think it's "useless" at all. Also your awk isn't exactly identical as it's not sorted, but in this case that probably doesn't matter.
That's even if you end up sorting the output by frequency, as the summary listing is typically shorter than the overall input data:
{a[$1]++}
END {for (i in array) printf("%6i %s\n", a[i], i) | "sort -k1nr | cat -n";}
Earlier quoted context omitted.
I'm not worried about the non-techies being tricked into thinking .com is an executable, I doubt they even know its possible. They almost certainly know about .zips
I still don't understand the threat model here. Is there an example of how this could be used as part of an attack?
To me this attack sounds too convoluted to actually get people, since you'll need to buy a lot of domains to match someone's email's contents
Earlier quoted context omitted.
https://thehackernews.com/2023/05/dont-click-that-zip-file-p... edit: HN is actually erroring out if I post an example .zip domain of the problem
I'm not doubting you can trick people into engaging with a phishing site that looks like WinRAR. I just don't think the domain makes any difference.
E.g. "example.com" becomes "example.com" rel="nofollow noreferrer">http://example.com/">example.com".
Such features would now (potentially) also work on mentions of zip files, i.e. on messages that state "download install.zip from github".
Edit: ghi, HN actually does this. Not yet with zip TLDs though.
Earlier quoted context omitted.
I still don't understand the threat model here. Is there an example of how this could be used as part of an attack?
As I understand, the attack is preformed by when someone mentions attaching a file to an email (i.e. "I've attached invoice.zip"), then that filename becomes a clickable link, and the user clicks it expecting to download the file, but is actually taken to the attacker's website which looks like WinRAR, and download malware from there. To me this attack sounds too convoluted to actually get people, since you'll need t…