2

Lots of websites spread malware by publishing advertisements that distribute malware. Even YouTube's ad network has been compromised in the past. Browser ad blockers and related plugins have there own problems. Can I use iptables to protect against virus and malware attacks from specific web sites?

I recognize that the sites themselves are still vulnerable to attacks through their site software or server which could compromise the end user. I also recognize that using advanced malware software or a proxy can help with this but I'm specifically looking into how much I can do as it relates to iptables.

For example, say I have a home system setup just for online financial transactions (banking, paying bills) and no other web browsing. I have my iptables setup to only allow traffic to/from specific websites (Citi, HSBC, etc). All other sites and services are blocked.

Can iptables block redirect exploits from advertisements on the websites?

Can iptables block malicious downloads that originate from clicking advertisements on those websites?

Improve this question
2
  • I'm not a master of iptables so no answer from that angle. That said, a much less extreme path you can take is using a modified HOSTS file to block the actual inbound and even outbound connections to/from ad servers. You can set up Tomato or DD-WRT routers to do this over an entire network, modify a specific machines HOSTS file (some info here winhelp2002.mvps.org/hosts.htm but this is by no means the only site covering the topic), or even root your phone and use apps to modify your phones HOSTS file to even block free-app-embedded ads from appearing.
    – WorseDoughnut
    Commented Apr 25, 2016 at 20:18
  • Yes this can be done in IPTables by blacklisting known bad addresses. See the following related post for more details: security.stackexchange.com/questions/106866/…
    – Trey Blalock
    Commented Apr 25, 2016 at 20:27

1 Answer 1

Reset to default
2

If you have your system set up so that only connections to your bank (eg. www.bank.com and www.bankcompany.net IP addresses) were possible, a redirect to a third site wouldn't load. The exploit would need to be hosted on the same site as your bank (which is admittedly rare).

As with many security solutions, it's possible that some bank update makes the website not to work until you unblock some other hosts.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .