Bugtraq mailing list archives
Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup
From: "Geo." <geoincidents () nls net>
Date: Mon, 17 Apr 2006 13:09:28 -0400
I agree that there should have been better documentation of this, but I think the noted objections are a bit hyperbolic.
While I don't disagree with what you said, I think there are some things you didn't consider. First, why is anything besides what is required for windows update being bypassed? Why MSN.COM? Why NOT Symantec.com? I mean this looks more like a way to keep passport functional than as a way to foil trojans. Second, why is it that it's darn near impossible to screw with media player or Messenger (both are protected by Windows file protection) yet hosts file changes don't even popup a dialog box to ask the user if the change is ok? I mean this is a really sneaky way of "fixing" things. Also before you say WFP or a popup could be disabled by a trojan, so could this fix. Third, this appears to me to be just more half witted fixes imo. The problem is a trojan modifying hosts then fix the problem instead of ignoring hosts. Provide a locking mechanism for hosts, remove the trojan, there are a hundred ways to fix this that are far more proper ways to do things than this. Geo.
Current thread:
- RE: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup Derek Soeder (Apr 14)
- Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup Thor (Hammer of God) (Apr 17)
- Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup Ansgar -59cobalt- Wiechers (Apr 18)
- Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup Paul Wouters (Apr 19)
- Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup Geo. (Apr 19)
- Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup Thor (Hammer of God) (Apr 23)
- Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup Geo. (Apr 23)
- Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup Thor (Hammer of God) (Apr 25)
- Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup Thor (Hammer of God) (Apr 17)
- <Possible follow-ups>
- Re: RE: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup john (Apr 19)
- Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup Thor (Hammer of God) (Apr 23)
- Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup John Biederstedt (Apr 23)
- Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup Thor (Hammer of God) (Apr 23)
- Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup John Biederstedt (Apr 23)
- Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup Thor (Hammer of God) (Apr 23)
- Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup Thor (Hammer of God) (Apr 23)