Windows 8 Changes Host File Blocking 1030
An anonymous reader writes "Windows 8 has been confirmed to not only ignore, but also modify the hosts file. As soon as a website that should be blocked is accessed, the corresponding entry in the hosts file is removed, even if the hosts file is read-only. The hosts file is a popular, cross-platform way of blocking access to certain domains, such as ad-serving websites."
Another reason... (Score:5, Insightful)
Re:Another reason... (Score:5, Insightful)
Microsoft gives you one more reason to switch to Mac OSX or Ubuntu.
So... (Score:5, Insightful)
Just add the hosts file to the Defender's white list. If you know how to edit the hosts file, you should know how to add it to the white list.
Otherwise, who says the edits to that file were not malicious.
This makes sense... for (most) Windows users (Score:5, Insightful)
As comments in the article point out, this behavior can be turned off by going to the Windows Defender settings... But by and large this make sense for 95% of Windows users as they will have NO clue about the hosts file, and even less of a clue if it has been modified for a phising attack. Nice to see microsoft take another step forward in protecting the blindingly ignorant and inept.
Re:Another reason... (Score:4, Insightful)
I completely agree. This is the nail in the Windows coffin for me.
Re:Another reason... (Score:1, Insightful)
Microsoft gives you one more reason to switch to Mac OSX or Ubuntu.
You think Apple or Canonical would never do this? What are you smoking? Maybe switch to Debian would sound a little more reasonable. Buy up routers that actually let you block things while you still can is more like it though. I wonder how long before you aren't ALLOWED to block certain addresses on pain of going to jail as a dirty pirate.
Re:This makes sense... for (most) Windows users (Score:5, Insightful)
MSE: Microsoft Screws Everything (Score:5, Insightful)
Yeah, this is basically a cack-handed way of fixing malicious hosts redirects.
It'll prevent malicious programmes from sending you to fake Facebook, but at the expense of entirely overriding any preferences YOU as tthe computer owner might wish to make via the Hosts file.
It's a staggering level of incompetence that this is their solution. It needs to be changed and they need to find either another way of solving it or allow some form of granulation and user input.
Where do WE want you to go to today? (Score:5, Insightful)
Hope you enjoy your new 'media consumption appliance'. Its becoming less and less of a 'general purpose computer' every day.
Re:Another reason... (Score:5, Insightful)
I completely agree. This is the nail in the Windows coffin for me.
If you are an enterprise IT manager this is your dream come true. You're not seeing this from the angle Microsoft is, they count on enterprise income more than they do home users.
Re:Calm down (Score:2, Insightful)
Linux isn't an operating system, just a kernel. Fedora 17 is an operating system. Windows is an operating system. All of windows is developed and produced by microsoft.
I think the point you were tryign to make is that its an optional part of windows.
Re:Calm down (Score:5, Insightful)
Considering that one of the sites they are unblocking is ad.doubleclick.net (which is often blocked because the user wants it blocked) then Microsoft is taking away an option from the user.
What will be interesting will be when someone compiles a list of the sites that will be unblocked ... and finds how many BANKS will still be subject to phishing like this ... but ad.doubleclick.net will be protected.
This is a stupid move by Microsoft done in a stupid fashion.
Re:Calm down (Score:5, Insightful)
The hosts file can only be modified by administrators. Any additional protection is useless because if malware has gotten itself running as administrator, it can just kill or modify windows defender anyway.
Another reason to skip Windows 8 (Score:5, Insightful)
This is another good reason to stick with Windows 7, giving Windows 8 a miss.
One common use of the hosts file is to test staging servers, particularly web servers before pushing them live, and without the complexity and time it takes to set up an additional DNS server.
Re:Calm down (Score:5, Insightful)
Yes, but among the vast majority of users (i.e., not Slashdot readers), the hosts file is an attack vector rather than an adblocker or development tool. All of that security training people should receive around double-checking what's in the address bar goes out the window when the hosts file has been compromised.
It sounds like MS's security tools have been a bit overzealous in trying to protect this file and can't determine what's a legitimate versus non-legit edit. But it's better to err on the side of being more rather than less secure here, especially with the amount of damage a maliciously-edited hosts file can do.
Basically: yes, it's Windows 8's fault that this happens, but it's not Microsoft trying to screw you over like the headline makes out. There should be a tool that can edit, save, and sign the hosts file to make this distinction, not entirely unlike visudo - and all operating systems should have something similar. My Cisco VPN client straight-up replaces my hosts file every time I connect, and while I was able to find and update the file it uses to make that less annoying (I have hosts for a lot of VMs in there), the fact that a non-privileged application can do that is quite scary.
Re:Calm down (Score:5, Insightful)
No, it's Microsoft being stupid and ignoring its own security. If a non-privileged program is permitted to ignore the fact that a file is set to be Read-Only, you have absolutely no protection against malicious code changing anything it wants. All it has to do is infect Windows Defender and it can do anything it wants. If I were still a Windows user, I'd be very reluctant to trust Windows 8 at this point because of this obvious lack of common sense in how it handles this.
Re:Another reason... (Score:5, Insightful)
If they're interested in 'enterprise' (I really hate that word these days), they may want to have a look at what's been happening. Good or bad security-wise, people have been pushing for using their own devices, devices they *like* to use. I think the only thing really stopping it from taking off for tablets and phones is the failure of Rim, Apple, etc, to open their protocols so a business does not need to pick a single type of device. If they ever figure that out, Microsoft is hosed.
Re:This makes sense... for (most) Windows users (Score:5, Insightful)
But it also does this for Doubleclick, which sounds more like someone sucking up to their corporate partners.
You do realize who owns DoubleClick, right? Google. Not exactly a partner of Microsoft. Microsoft has their own ad network that competes with DoubleClick, so that part actually helps make a case to me that this was not ill-intentioned.
Hamhandedness. (Score:5, Insightful)
Hardly. At the enterprise level there are multiple different ways of handling situations such as this. Which one(s) you choose depends upon how you've organized Active Directory and your network.
But a different point is that this is an OLD way of phishing. The phisher is publishing the IP addresses that need to be blocked. So, again, at the enterprise level this kind of phishing would not be an issue.
If a phisher really needed to redirect traffic like that he'd have an easier time just getting the information in the local machine's DNS cache. That way it would never show up in the hosts file which means that it would be that much harder to spot. Then just keep updating the DNS cache.
So this is the wrong solution to the wrong problem and it is implemented in the wrong way. And it will probably cause more issues in the future as 3rd party developers have to work around not having the hosts file as a reliable option any more.
Nice way to remove a useful tool that's been around for decades.
Re:Another reason... (Score:4, Insightful)
Umm, would you use the hosts file if setting up a Windows box for firewall purposes? I think not.
I actually think not allowing critical things like *.microsoft.com (especially windows update and MSE) being redirected is a good thing - but there should be a Big Fat Popup warning that this is being done, and extending the hosts-removal for things like facebook and doubleclick? That's dubious, to put it mildly.
Not user friendly, hostile (Score:5, Insightful)
From the article, Two of the sites that you can’t block using the hosts file are facebook.com and ad.doubleclick.net
I started using the hosts file over a decade ago, when I traced crashes that I was having to doubleclick.net. Ad supported software that I was using was receiving files from them, but it was doing a lot more than just displaying the ads (which I would not have objected to). Many users were experiencing this, but the author would not fix it so I and others started blocking the site (which resolved the problem, although the author lost some small amount of revenue).
More recently I have also started blocking facebook. I never use it, have no account there, but I've noticed an awful lot of network traffic going to and from my site with facebook.com. I'm not even a member, so I don't feel the need for them to track most of the sites that I visit. The hosts file has so far worked very well for this.
And argument that this feature is in any way for the benefit of the clueless user is bogus. The common way to block a site via the hosts file is to equate it to the IP address 127.0.0.1, which is the local machine. If Microsoft were doing this for the benefit of their users then they would simply look at the hosts file and, if they found redirects for sites that they were concerned about that were not pointed to the local machine, they might well conclude that it was potentially an attempt to hijack a domain name and then, after warning the user (and even asking him) correct the problem. This would even show the user that Microsoft was doing something good for the user for a change. But if the address is redirected to the local machine, the only reasonable conclusion that I can see is that the user wanted it that way (as it provides no attack vector). It took me about 30 seconds to realize that changing 127.0.0.1 redirects was user unfriendly and could easily be avoided if Microsoft were really concerned about their users who paid for the software. They just have to look at the IP address that the hosts file contains and if it is 127.0.0.1 then allow it to stay! Clearly Microsoft realized this too. The only reasonable conclusion is that they are doing this because they have a motive that is against customers interests.
Re:Another reason... (Score:3, Insightful)
Yes but my point is, I will now have to use a firewall to keep Adobe CS_ from phoning home.
Re:Another reason... (Score:5, Insightful)
An IT manager using Hosts is an IT manager that needs to be replaced.
First, if you are doing your web filtering on the workstation, you are doing it badly, badly wrong. Second, HOSTS is not somethin that is easily maintained or modified. Third, there are about a zillion better ways to accomplish blocking than using a HOSTS file.
Its basically a kludge from bygone days before DNS, and for 99% of use cases where you might think "I can use a HOSTS file for that", there are far better methods-- or else the thing you are trying to do is retarded.
The answer is simple enough (Score:5, Insightful)
The answer is simple enough:
If you're already smart enough to edit the hosts file, you should be smart enough to add hosts to Windows Defender exclusion list.
Is this a change from the way that things were done in the past? Of course it is. This is how systems become more secure for the average user. Average Joe isn't messing with hosts.
Chicken Little, the sky is not falling.
Re:Another reason... (Score:5, Insightful)
Even allowing for your premise....
Why on earth would MS destroy a simple, well known behavior that users might indeed have reason to want to use? Why 'fix' something that isn't broken? Why break something that wasn't hurting anything else on the OS?
No harm in leaving a well known tool and behavior be.....but plenty of reason not to fuck with it, no?
Re:Another reason... (Score:5, Insightful)
This is silly reasoning. "Since I don't have a good reason to use it, nobody else should either."
I use it to test services that are replacing old services with the same name. It works well as a temporary/quick way of testing. Yes, I could do it in DNS but it would take much longer to vet the change to our DNS servers than my local hosts file. Thankfully, I don't have to worry about this since I don't use Windows.
Comment removed (Score:5, Insightful)
Re:Another reason... (Score:2, Insightful)
Re:Another reason... (Score:4, Insightful)
If that was the legitimate reason, then the proper course of action would have been to remove the hosts file feature totally (not this half-assed bullshit).
Re:Another reason... (Score:5, Insightful)
Re:Another reason... (Score:2, Insightful)
If there were, malware would modify it in bad ways and all changes would end up being blocked by windows defender.
Malware. (Score:5, Insightful)
the Hosts file is targeted my malware to redirect to malicious sites and to keep under the radar to infect systems after they have been clean. (or even to a locally hosted proxy to infect sites like Facebook) Personally, I've seen facebook and myspace targeted in it. Never seen doubleclick but my guess is doubleclick is a target so that they can redirect to their own profit generating ads, or more malware to attempt to extort money out of people.
My guess is that the sites defender removes from hosts are sites that have been targeted by malware in the past. Frankly, I'd like to see the list of domains it looks for, but I'm sure that I woudn't want any of them redirected to some scumware site trying to pawn off fake antivirus.
Re:Another reason... (Score:5, Insightful)
I think what he wants is a firewall system that explicitly cannot be controlled by the operating system without his approval. So if he blocks something he can be assured it will stay blocked regardless of what kind of backroom deals Microsoft makes.
The most annoying thing about these latest versions of Windows is that there appears to be this new class of user with control that supersedes than the owner of the hardware.
Re:Another reason... (Score:5, Insightful)
Re:Another reason... (Score:5, Insightful)
no, but dev.realdomain.com might be... and yet I have to overwrite it to simulate on my local machine for development testing. Or perhaps I need to ensure when I load realdomain.com I go directly to a specific IP address instead of the default one that hits the load balancer.
There's a whole slew of reasons for having a hostsfile (especially for developers) that DNS doesn't solve.
Re:Another reason... (Score:5, Insightful)
Seems like they fixed the wrong problem.
Re:Another reason... (Score:4, Insightful)
These people defending MIcrosoft's behaviour are just tools... I wouldn't pay much attention to them. Microsoft can't "kill the hosts file off" because the behaviour is part of the IP specification (defined in the RFC's)
We expect implementations of the TCP/IP protocol in clients to behave in established ways and Microsoft has no right to change that.
I make use of the hosts file for various purposes, including getting my forum users set up with hosts file entries to the new server, beforehand, whenever our DNS entries are changing so they can still reach the forum while changes are propagating. THIS is a prime example of why the hosts file still exists and the behaviour should not be fucked with by those assclowns at Microsoft.
Hosts was never meant to be used for blocking sites, but it works well enough as a consequence and the behaviour should be left alone. Whatever the user puts in there, should work as intended. I don't fucking CARE that it's used for malware. Fight malware in other ways.
Re:Another reason... (Score:5, Insightful)
I would only be affected if I used Windows 8, which I don't plan to.
Re:Another reason... (Score:5, Insightful)
It is inherentily impossible to build something into an OS which cannot be controller by that OS itself. If you want these really secure firewalls, they should be on a separate appliance and all your traffic should be routed through them.
Re:Another reason... (Score:5, Insightful)
You seem to be a bit confused about how Windows works.
If it is your PC and you are the administrator then yes, you have full control over it. You can set any firewall rules you want and they won't be overwritten by "backroom deals" or anything like that. Hosts was always an unsupported system file hack, and there is a pretty powerful firewall in Windows 7.
On the other hand if it isn't your computer then the (network) administrator can overrule you with Group Policy Settings. This is exactly the same as on a Linux box if you don't have a root access. Your administrator can decide if you have access to the firewall, or even right down to what types of firewall rule you can make. There really is a huge amount of fine grained control available. Enterprise admins love it.
Re:Another reason... (Score:5, Insightful)
then the proper course of action would have been to remove the hosts file feature totally
IIRC you still need posix compliance (or the ability to claim it such that your claims can not be rubbished too easily) for your OS to be used in many US agencies, and the hosts file is one of the many minor points mentioned in that specification. Presumably that spec says something about having the feature, but does not say anything about effectively disabling it in this way.
Re:Another reason... (Score:5, Insightful)
Re:Another reason... (Score:4, Insightful)
There were no backroom deals here. Certain domains are commonly targetted by malware. If malware, or perhaps another user/IT with malicious intent, modifies your hostfile to redirect facebook.com to a phishing site, it will still appear to be at a legitimate domain of facebook.com but actually serving the phishing site. It won't have SSL but your average user won't notice. So you see, it is in the interests of preventing the hosts file from being a tool for malware or malicious users. It is not in the interest of some backroom deal MS made with facebook.