News for hackers. Stuff that matters.

A comment on Blocklist Facebook domains. Parent comment

Re:Blocklist Facebook domains by fbelzile on Tuesday March 20, 2018 @09:19PM (#16634465)
Windows 8-10 users that use Windows Defender will notice that some hosts file entries will be ignored (like popular domains like facebook.com). You will also need to add an exception to the hosts file in Windows Defender.
[ Parent | on HN ]
Re:Blocklist Facebook domains by retox on Tuesday March 20, 2018 @10:01PM (#16634681)
I wonder what their rational for this is. I know in the past malware have modified the hosts file to block malware removal tool domains but why ignore entries for Facebook?

I heard that blackholing requests to Microsoft telemetry URLs also has no effect. Any way of finding the unlockable list I wonder.

[ Parent | on HN ]
Re:Blocklist Facebook domains by ReverseCold on Tuesday March 20, 2018 @10:13PM (#16634736)
> why ignore entries for Facebook?

Malware would redirect facebook.com to some scam site probably.

Given how popular FB is, Microsoft decided to "fix" this.

(This is all a hypothetical, I don't actually know this for sure.)

[ Parent | on HN ]
Re:Blocklist Facebook domains by Skunkleton on Tuesday March 20, 2018 @10:18PM (#16634760)
I mean, considering the use of 99.9% of Windows PCs out there it probably make sense.
[ Parent | on HN ]
Re:Blocklist Facebook domains by RachelF on Wednesday March 21, 2018 @12:51AM (#16635565)
Windows 8-10 users will also notice that host file entries for any Microsoft or Bing entries will be ignored.

I guess they hardware the IPs into Windows.

[ Parent | on HN ]
Re:Blocklist Facebook domains by dspillett on Wednesday March 21, 2018 @07:59AM (#16637231)
> I guess they hardware the IPs into Windows.

More likely they just bypass looking at the local hosts file for such names, so the request always goes out to your DNS servers.

Therefore blocking these names by redirecting to 127.0.0.1 will work if done at your DNS server (for instance if you run an instance of https://pi-hole.net/ for that).

Unless of course they make the lookup use specific name servers that they run, instead of the local resolvers that your machine is configured to look at, for those names but that is less likely.

[ Parent | on HN ]
Re:Blocklist Facebook domains by stordoff on Monday March 26, 2018 @04:35PM (#16682325)
In that last case, you can often redirect those queries if they are standard DNS requests on your router. That's how my local network is configured -- all DNS requests are sent to my Pi-hole instance, except those coming from the Pi-hole itself. Even something like:

    nslookup google-analytics.com 8.8.8.8
will return a local IP:

    Server:  google-public-dns-a.google.com
    Address:  8.8.8.8

    Name:    google-analytics.com
    Addresses:  192.168.1.2
[ Parent | on HN ]