0

I know the hosts file is often deemed obsolete by an actual DNS, but what is/are the best way(s) to secure a hosts file (Current Best Practice)?

Example: Would I delete the hosts file, input known "good" addresses, assign specific permissions to the file/make read only, host on separate single machine/server (like DNS), etc.?


For reference location of hosts file(s):

In Windows %path% is for environment variable (since path may not be exact on every system)

  • For Windows (%SystemRoot%\system32\drivers\etc\hosts this has lmhosts too)
  • For *nix/OSX (/etc/hosts)
  • For mobile (Android and iOS are in /etc/hosts ... and for those Windows phones in registry HKEY_LOCAL_MACHINE\Comm\Tcpip\Hosts)
  • 2
    Leaving it alone usually works pretty well – cutrightjm Sep 10 '14 at 4:15
  • 1
    What threats are you trying to defend against? – Mark Sep 10 '14 at 4:19
  • @Mark most likely it would be site spoofing, or redirects. (www.google.com has IP of driveby download site) As analogy, if it was on a server I guess it would be end results of an attack like this would be similar to DNS poisoning. – No Time Sep 10 '14 at 4:56
  • 1
    @NoTime if the attacker can modify your hosts file you're already screwed anyway since the file requires root privileges to be modified and if the attacker has root he can do much more without even touching that file. – user42178 Sep 10 '14 at 10:56
3

An option is to create a hash of the file and have a program (or script) regularly compare the stored hash with the current hash of the file. While it will not prevent modifications, it will detect changes and alert you (detective vs preventative control)

  • Modern tools like CFEngine and Puppet can enforce this and guard the state of the file. – hspaans Jan 1 '16 at 3:29
2

A common tactic of malware is to rewrite part of the hosts file to redirect your browsing. For example, redirecting ads to the hacker's own ads, in order to generate revenue.

The easiest way to protect this file is to make it read only. This isn't a great level of protection, as it's easily disabled by malware on your machine.

A better way to protect it is to use an antivirus/antimalware. Many of these products include hosts protection as standard.

0

The default permissions on hosts files out of the box keep them as protected as they're going to be. You'll want to do what schroeder said and setup an alert that checks the hash of that file to see if it's been modified and if so it should notify you. It's not as common an attack path and is easily remedied so an alert and responsive security in this case should work just fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.