Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Block Adware and Malware with /etc/hosts

github.com

Post reply on HN
Print view View original

71–79 of 79 posts

Re: Block Adware and Malware with /etc/hosts

#71

Post by rldjbpin »

intiially i wanted to point out a potential issue with using large /etc/hosts file in windows, but ended up finding a (potential) fix in this thread.

regardless, after using this list for a long time, i do recommend setting up your own dns server or use a service that does (such as pi-hole and nextdns already suggested by others) with this list enabled.

on mobile, i found that ad-blocking dns services that offer DNS-over-HTTPS (such as adguard dns) offer a much more elegant option that does not require an app nor configuring every network you connect to.

Re: Block Adware and Malware with /etc/hosts

#73

Post by DaiPlusPlus »

8organicbits wrote: post #63
DaiPlusPlus wrote: post #53

Earlier quoted context omitted.

I suspect it’s very likely that somewhere in the world is a domain-validation server, used by a trusted CA, which has this very anti-advertising hosts file installed onto it.

Why? A CA would be unable to issue certificates for advertising sites with that configuration.

It could be a lesser-known CA, perhaps the national CA of a small country (under 2m people) that normally only issues less than tens-of-thousands of certs and only exists for regulatory reasons (e.g. the country requires all of its own gov services to use its internal CA, while all commercial/popular services use CA based in another country, usually LetsEncrypt)

Re: Block Adware and Malware with /etc/hosts

#74

Post by eli »

yonatan8070 wrote: post #67
eli wrote: post #39

Earlier quoted context omitted.

I still don't understand the threat model here. Is there an example of how this could be used as part of an attack?

As I understand, the attack is preformed by when someone mentions attaching a file to an email (i.e. "I've attached invoice.zip"), then that filename becomes a clickable link, and the user clicks it expecting to download the file, but is actually taken to the attacker's website which looks like WinRAR, and download malware from there. To me this attack sounds too convoluted to actually get people, since you'll need t…

Which email client automatically creates links? Virtually everyone uses HTML email, which can link any text to any destination. If your users are clicking links to download files that they got via email from untrusted sources...then the domain doesn't really matter.

Re: Block Adware and Malware with /etc/hosts

#75

Post by eli »

hulitu wrote: post #70
yonatan8070 wrote: post #67

Earlier quoted context omitted.

As I understand, the attack is preformed by when someone mentions attaching a file to an email (i.e. "I've attached invoice.zip"), then that filename becomes a clickable link, and the user clicks it expecting to download the file, but is actually taken to the attacker's website which looks like WinRAR, and download malware from there. To me this attack sounds too convoluted to actually get people, since you'll need t…

attachment.zip ?

attachment.zip" rel="nofollow noreferrer">https://malware.example.com/">attachment.zip

Re: Block Adware and Malware with /etc/hosts

#76

Post by justsomehnguy »

charcircuit wrote: post #62
numpad0 wrote: post #61

Earlier quoted context omitted.

There's no host file syntax for NXDOMAIN, it has to be an IP. 127.0.0.1 with Port 80 assigned to a dummy page can be an alternative solution if you don't like 0.0.0.0.

The hosts file is not the right tool to do this.

Preach.

99% of people don't understand (because they don't even try) what you can run a full resolver even on Windows machines. butmuhpihole

Re: Block Adware and Malware with /etc/hosts

#77

Post by yonatan8070 »

eli wrote: post #74
yonatan8070 wrote: post #67

Earlier quoted context omitted.

As I understand, the attack is preformed by when someone mentions attaching a file to an email (i.e. "I've attached invoice.zip"), then that filename becomes a clickable link, and the user clicks it expecting to download the file, but is actually taken to the attacker's website which looks like WinRAR, and download malware from there. To me this attack sounds too convoluted to actually get people, since you'll need t…

Which email client automatically creates links? Virtually everyone uses HTML email, which can link any text to any destination. If your users are clicking links to download files that they got via email from untrusted sources...then the domain doesn't really matter.

I just tried emailing myself a few links and they all got automatically hyperlinked by Outlook on Android. Here are the links I tried

testlink.com link.gov abc.zip test.xyz

I agree about being able to hyperlink pretty much anything having the same effect, that's why I don't think the .zip TLD is a big issue

Re: Block Adware and Malware with /etc/hosts

#78

Post by stblack »

Hey this is my repo!

I'm happy to answer any questions arising.

I must say: the lists we offer — 31 variants in all — result from fine work by all our curators. Some are extremely diligent and maintain their lists every day. It's just remarkable what dedicated people can do together over time.

Re: Block Adware and Malware with /etc/hosts

#79

Post by ibay770 »

I've noticed a speed increase by running these tools along with the hosts file: http://www.analogx.com/contents/download/Network/qdns/Freewa... http://www.analogx.com/contents/download/network/fc/freeware...

And https://mayakron.altervista.org/support/acrylic/Home.htm works as well, and it also accepts wildcards.

Post reply on HN