Any additional security with large blacklisting hosts file?

Question

I run Windows with a pretty hefty c:/windows/system32/drivers/etc/hosts file obtained from http://winhelp2002.mvps.org/hosts.htm. I update this file as regularly as I remember and layer it with appropriate add-ons in my modern web browser of choice, A/V, and firewall solutions.

Basically, I realize that a large (generally static) blacklisting hosts file is protection against KNOWN threats (and only those with names!), and very little help against unknown and emerging threats (or straight up IPs). I must admit that I have not checked to see if there are stats regarding the attack/infection rates of new threats vs. known threats though I would expect that old, known threats probably still outweigh new threats simply due to volume.

QUESTION: Is there any added value from running with a large (generally static) blacklisting hosts file when used with modern consumer-grade anti-virus and firewall solutions? Is it a redundant layer? I admit that A/V is generally a black box to me, so I'm not sure what kinds of signatures their engines scan for, and whether hostnames are part of those signatures.

Although this seems like a free extra security layer, there are "costs" with manually updating the file, and the fact that I turn off DNS caching to prevent the whole file from hanging the machine each time it reloads itself (which can be frequent). (I've migrated DNS caching to the router instead which doesn't help me when I use my laptop elsewhere.)

Answer 1

Hosts file blacklists only provide protection by mapping specific domains away from their intended targets (generally to local). This does not block IPs or data transfer, just the lookup of the IP. I'd say the added value is minimal, especially if you're using local blocking like AdBlock or Ghostery. If you want to blacklist "known threats", use IP blocking software with a well-maintained list. If you want to be totally secure, unplug the ethernet cable.

As you've pointed out, it causes a major slowdown with DNS lookups (it linearly parses the text file on DNS cache miss). That's because the hosts file was never intended to be used as a blacklist.

edit: Here's script to use Windows Firewall to block IPs: http://www.sans.org/windows-security/2011/10/25/windows-firewall-script-block-addresses-network-ranges

Answer 2

If nothing else, blacklisting known sites removes noise from your logs, so real threats are more likely to be noticed.

Answer 3

I say yes, there is an added value to using the hosts file. Below are a few benefits:

1. Less logs to hunt through when looking for suspicious traffic.
2. Most employees won't know what the hosts file is so you can also block traffic to Facebook, etc there as well. Plus on the firewall, but the host file will show "cannot display" error instead of blocked by firewall. This deters most users from trying to find a "way around" the block.
3. less bandwidth is used since it blocks most advertisements (which can also prevent ad poisoning).

Personally I use this structure in a HIPAA compliant required environment along with AV on the firewall (Kaspersky) and AV on the local machines (AVG). I purposely chose 2 different antivirus programs since there is never a cure all, especially for 0Day, 1Day, etc. infections so the probability of blocking it is higher.

Also most decent firewalls have some sort of GEO IP filtering to block all traffic from specific countries. It won't stop all attacks but it drastically decreased how many IDS alerts I was getting at 3am so I'm a fan of GEO IP blocking.

To make this less labor intensive to deploy you could either copy the hosts file with a logon script if connecting to a domain controller OR I just wrote a batch file that I run like:

copy hosts \\192.168.1.2\c$\windows\system32\drivers\etc
copy hosts \\192.168.1.3\c$\windows\system32\drivers\etc
copy hosts \\192.168.1.4\c$\windows\system32\drivers\etc
copy hosts \\192.168.1.5\c$\windows\system32\drivers\etc

etc.

and for the old Win2000/NT boxes still out there use:

copy hosts \\192.168.1.6\c$\winNT\system32\drivers\etc

Just replace the IP's and verify that you have access to the admin shares on the machines. This takes about 2 minutes to update close to 60 machines for me.