Home page logo

bugtraq logo Bugtraq mailing list archives

Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup
From: "Geo." <geoincidents () nls net>
Date: Mon, 17 Apr 2006 13:09:28 -0400

I agree that there should have been better documentation of this, but I
think the noted objections are a bit hyperbolic.

While I don't disagree with what you said, I think there are some things you
didn't consider.

First, why is anything besides what is required for windows update being
bypassed? Why MSN.COM? Why NOT Symantec.com? I mean this looks more like a
way to keep passport functional than as a way to foil trojans.

Second, why is it that it's darn near impossible to screw with media player
or Messenger (both are protected by Windows file protection) yet hosts file
changes don't even popup a dialog box to ask the user if the change is ok? I
mean this is a really sneaky way of "fixing" things. Also before you say WFP
or a popup could be disabled by a trojan, so could this fix.

Third, this appears to me to be just more half witted fixes imo. The problem
is a trojan modifying hosts then fix the problem instead of ignoring hosts.
Provide a locking mechanism for hosts, remove the trojan, there are a
hundred ways to fix this that are far more proper ways to do things than


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]