Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

A lot of people use a huge /etc/hosts file to simply redirect ads and scam sites to 127.0.0.1. The interesting part about this approach is that you can have the same hosts on your tablet, your android phone, your mac, your linux box, etc, and all applications in your machine are subject to the /etc/hosts, so you don't need to configure browsers, proxies...

An example of a HUGE hosts file is from this french website.

I would like to create some scripts and use these hosts files in an automated manner, but I was afraid of some security issues: imagine that someone hacked the server from where I get the hosts file, and now is pointing gmail.com to a scam site for example.

So, I thought of just doing a simple validation: each line of the hosts file must begin with 127.0.0.1 or with a comment (#).

Is this a valid precaution measure? Do you see any problems with this approach?

share|improve this question
I don't see an issue with those validation rules. It will prevent a hacker from redirecting users to malicious sites. However there may be a better method of securing your hosts file. – Hammo Oct 3 '12 at 22:40
I'm planning to create a script that downloads hosts from various sources, removes duplicates, and does a simple validation of the 127.0.0.1 to avoid "man in the middle" attacks. This is going to be my hosts file: always dynamic from those sources. It may have a "manual" hosts file that I concatenate as well, but only if needed, in the future. Do you see other security problems I may face when downloading hosts from other people beyond the "127.0.0.1 at the beginning of the line" check? – Somebody still uses you MS-DOS Oct 4 '12 at 2:06
1  
If a hacker was to compromise the hosts file, they could direct traffic for any hostname to the loopback address. – Hammo Oct 4 '12 at 5:42
1  
@Hammo Or worse, their own box. If they can get a DNS lookup on your-bank.web to point to their server, they can serve you with a phishing page. – Polynomial Oct 4 '12 at 7:34
I would like to point out. The script the author want's to create already exists in the form of a well known application. The name just escapes me for the moment. – Ramhound Oct 4 '12 at 15:43
show 3 more comments

1 Answer

up vote 1 down vote accepted

You might also want to allow for blank lines. But, "starts with #, 127., blank-line" should be sufficient if trying to validate 3rd party lists for inclusion in yours. Though this wouldn't stop malicious denial of service. For example, if you started performing this as a service, but then somebody placed your own domain name in the list with a 127.0.0.1.

Also,

A loopback address is not always 127.0.0.1 . I've seen some of these custom hosts files also use 127.0.0.2 or other 127.0.0.* addresses. RFC 3330 defines loopback as any 127.0.0.0/8 address.

Also, this may not directly apply, but IPv6 localhost values such as 0:0:0:0:0:0:0:1 or ::1 are also valid.

Redirecting a site such a gmail would already be somewhat mitigated by the use of SSL certificates along with HTTP Strict Transport Security which tells a browser to only use SSL to connect to a site.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.