Is it harmful to redirect web bugs to localhost on hosts file?

Question

I was checking the article hosts file on Wikipedia, and I found this:

Blocking access to servers of unwanted content by redirecting them to the local host (127.0.0.1) may have security implications. As 127.0.0.1 is accessible only by the host itself, connections might be trusted. The link to be followed may be crafted to launch an attack on the local host.

Although it does not cite any reference, I wonder if this is true.

I thought about using hosts file to block some web bugs and trackers. Is this safe or not?

Answer 1

My guess it that the Wikipedia author is referring to IE Security Zones, where the DNS name or IP address grants additional functionality to things like

• ActiveX controls
• Javascript
• Execution of non-signed data
• Access to internal (read corporate file server) data.

More info here

Answer 2

Imagine you are running a network service (e.g. HTTP) on your local machine. This is bound to both the loopback interface (127.0.0.1) and an internet facing interface (80.1.1.1).

Now say you have a script on your machine that an attacker knows can be used to perform administrative tasks, but only if performed by an administrator.

The presumption is that your script only assumes the visitor is an administrator if they are connected from the server itself. An administrative function can be called using GET variables, like: http://127.0.0.1/?droptable=foo&setpwd=bar.

If a user tried to do this from the internet, the script could see that the connecting user was on a foreign IP and it would return with, say, HTTP 403.

Now you are browsing the internet on your server (silly you). You click on an attackers link whose domain name has been associated with something dodgy, and so it's in your hosts file. Now instead of this link taking you to http://blockeddomain.com/?droptable=foo&setpwd=bar, your own hosts file ensures that http://127.0.0.1/?droptable=foo&setpwd=bar gets loaded instead.

Your database tables are dropped and the attacker compromises your authentication mechanisms.

Of course this is a very basic example and it requires many assumptions to be made. However this is one real world possibility of how such a setup could cause you a headache.

Answer 3

I don't see any danger if you are the one setting up your own /etc/hosts to block specific web bugs/trackers; however, I can easily imagine a scenario where an attacker can use /etc/hosts to redirect to localhost to do some malicious things.

For example, let's say an attacker designs a malicious clone of a web site (like amazon.com) and install it on a local webserver and edits /etc/hosts to redirect to amazon.com to localhost. A user on that computer going to amazon.com would not know the difference and likely would input confidential information to the malicious web app running on localhost (that may say send off that confidential information to elsewhere).

I wouldn't worry too much about redirects to localhost being 'trusted'; using a client's IP address as a means of authentication to give them privileges to alter information is a mistake in the design of a web app.