0

I am trying to protect a macOS computer. Specifically, I want to prevent the machine from making unwanted connections over the internet. I am aware of firewalls of course. But I stumbled upon the idea of adding many domain names to /etc/hosts, and redirect them to 0.0.0.0 to prevent connections to them.

Is this method safe? I can see it does not prevent connecting directly to an IP. Would most malware be fooled by such a hosts configuration, or would they likely use directly an IP address, or not honour the /hosts file?

How should I compare using a firewall versus using the /etc/hosts file? I guess the most low level, the harder it is for malware to get around. So which method is lowest level?

Improve this question
2
  • 1
    I know you specified Mac, but as an aside: MS Windows will not honor host file entries blocking Microsoft servers.
    – user10216038
    Commented Jan 15, 2020 at 19:55
  • On routers there is the technique of static routing particular CIDR prefixes to the null0 interface, blackholing traffic destined for that IP range. I’m assuming static routes could be added to the Mac in a similar manner.
    – Darrell Root
    Commented Jan 16, 2020 at 8:45

1 Answer 1

Reset to default
1

If you're trying to protect against mostly-benign software, this should work fine. Some software might make its own DNS calls (bypassing the OS DNS resolver, which checks the hosts file) and some will probably use direct IP addresses, but most by far will just ask the OS to resolve the names.

If you want to restrict potentially-malicious software, this is definitely insufficient. Safely containing malware is tricky, and requires sandboxing far in excess of what you've talked about here. Malware will absolutely use hardcoded IPs and/or make its own DNS queries, but it will also do things like change firewall settings (if running with sufficient privileges), scan and attack local network hosts (which may not even have DNS entries, at least not ones the malware will see or care about), and of course monitor and/or interfere with legitimate traffic from the machine.

However, between the two options, a firewall is definitely "lower level" than the hosts file. An external firewall (which might be on the same physical host, but running in the host OS of a VM or container) will work better than a local one (which might be overridden by sufficiently-privileged software), but changing a hosts file provides no actual restrictions whatsoever; it's merely (taking away) a convenience.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .