Testing Microsoft Security Essentials + the Hosts file

[Night Hawk]

October 23, 2009 - 10:23 P.M.

Testing Microsoft Security Essentials and the Hosts file

Computers on the Internet address each other with numbers. What appears as computerworld.com to a human being is 65.221.110.98 to a computer. The system that translates between names and the underlying numbers (really IP addresses) is called DNS and it works very well. Too well, for some bad guys.

Many years ago, before the Internet, the translation between computer names and numbers was done by a file on each computer called the "hosts" file. Needless to say, as the number of computers got large, maintaining a hosts file on every computer became unrealistic. Now, when a computer is called on to reference another computer by name, it first makes a call into the DNS system to retrieve the underlying IP address.

Why the history lesson?

Microsoft never retired the hosts file* and bad guys abuse it.
For example, screwing up the mapping of names to numbers can prevent antivirus software from self-updating. Another tactic is to change the entry for bank websites. A computer with a maliciously modified hosts file can send someone to a duplicate copy of a bank web site, one that looks totally legit, but is designed to steal userids and passwords.

More at: Testing Microsoft Security Essentials and the Hosts file - Computerworld Blogs

 

[tw33k]

Very good find

 

[zx81]

Thanks for the information, I did know a little about the hosts file, but I did not know how some abusers prevented a windows user from updating virus software.

Have a nice day!

zx81

 

[hackerman1]

hi !

THANKS Night Hawk !

the article points to a very good advice: "DO NOT RUN AS ADMIN !"
you should use a normal "USER-account" and only use your "ADMIN-account" when you really have to, fx. when installing new software or doing system maintenance.

 

[Tews]

hi !

THANKS Night Hawk !

the article points to a very good advice: "DO NOT RUN AS ADMIN !"
you should use a normal "USER-account" and only use your "ADMIN-account" when you really have to, fx. when installing new software or doing system maintenance.

+1 Sound advive!!

 

[logicearth]

Microsoft never retired the hosts file* and bad guys abuse it.

Ooooooooh so I imagined the hosts file in Linux/Mac OS/Unix did I? :sarc:
http://en.wikipedia.org/wiki/Hosts_file

By default, the hosts file is used before DNS, a poor design decision by Microsoft.

Okay....makes me question the knowledge of the writer...Microsoft did not design the hosts file. It has always been used BEFORE DNS. And it is in fact helpful to have it come before a DNS request.

 

[hackerman1]

hi !

thanks again Night Hawk, i just checked my HOSTS-file, and found an "empty" (default) file !

it seems i had completely forgotten to update it, after i reinstalled W7 a few days ago...

but it´s no big problem, i got other security-software running,
A2 checks every site, actually it even checks the links on the pages i visit,
that´s because i´m using Firefox 3.5 which has DNS-prefetching.

however, after updating the HOSTS-file MSE did gave me a warning,
if i remember correctly it was something like: "unrecognized file, submit to Microsoft for analysis ?", which is a bit weird...

anyway, MSE reacted to the modified HOSTS-file !

but when i modified it a second time, just to check the warning message again, it didn´t react !?

Winpatrol is a very nice *FREE* program, recommended by experts,
it will give you a warning if your HOSTS-file its modified.

BillP Studios - WinPatrol 2010

http://www.winpatrol.com/

 

[Jacee]

Hopefully with the ongoing testing of MSE, this will be fixed.

When I see an infected machine ... one that has an obviously messed up Hosts file... I have the OP download Hosts File Manager HostsXpert v4.3
This restores Microsoft's Hosts file. Flushing DNS comes next.

You may also want to read more about the Hosts file here: http://www.mvps.org/winhelp2002/hosts.htm

 

[echrada]

Thanks Jacee.

 

[hackerman1]

hi !

update:
i changed UAC to max.
i then tried to modify the HOSTS-file, UAC immediately reacted and asked for "ADMIN-permissions" !
i then tried to rename the HOSTS-file, which gave the same result.

this once again shows why it is so important to have UAC on !

so actually it´s no big deal if MSE doesn´t react to changes to the HOSTS-file, since UAC does...

 

[Night Hawk]

I've been running each install of the betas then RCs with the UAC off and haven't run into any problems with the hosts file. Most of this of course has been addressed in the 64bit 7. And probably one reason for not being vulnerable here.