Block Adware and Malware with /etc/hosts

Re:Block Adware and Malware with /etc/hosts by wnevets on Monday June 12, 2023 @03:57PM (#36300024)

https://thehackernews.com/2023/05/dont-click-that-zip-file-p...

edit: HN is actually erroring out if I post an example .zip domain of the problem

[ Parent | on HN ]

Re:Block Adware and Malware with /etc/hosts by eli on Monday June 12, 2023 @04:38PM (#36300692)

I'm not doubting you can trick people into engaging with a phishing site that looks like WinRAR. I just don't think the domain makes any difference.

[ Parent | on HN ]

Re:Block Adware and Malware with /etc/hosts by wnevets on Monday June 12, 2023 @04:56PM (#36300987)

You don't think a url like those in this article [1] makes any difference? You have more faith stopping phishing than I.

[1] https://medium.com/@bobbyrsec/the-dangers-of-googles-zip-tld...

[ Parent | on HN ]

Re:Block Adware and Malware with /etc/hosts by eli on Monday June 12, 2023 @05:29PM (#36301437)

If I hover over the link like my phishing training says to do, Chrome correctly shows it as "https://v1271.zip"

If I don't bother hovering over the link then the domain never mattered at all. Could have hosted the file anywhere since the link text in HTML (including HTML email) need not have any relation to the destination. You can simply write a legitimate github.com link but the href goes somewhere else.

Any situation where you're relying on users to visually inspect every link and decide if the domain looks plausible is already a security failure.

If I'm downloading and executing files that are randomly in a Medium article or in my inbox from an untrusted source then we're in trouble whether they are hosted on github or not.

[ Parent | on HN ]

Re:Block Adware and Malware with /etc/hosts by wnevets on Monday June 12, 2023 @05:44PM (#36301617)

> If I hover over the link like my phishing training says to do

How do you hover on mobile? Instead of training my family members to hover on their phone's I will continue to just block these TLDs.

[ Parent | on HN ]

Re:Block Adware and Malware with /etc/hosts by eli on Monday June 12, 2023 @05:55PM (#36301774)

I’m confused what you’re advocating. If your family isn’t checking the domain before downloading and executing files then the .zip tld doesn’t matter. They’re just as vulnerable to phishing without it.

[ Parent | on HN ]

Re:Block Adware and Malware with /etc/hosts by wnevets on Monday June 12, 2023 @06:27PM (#36302176)

> I’m confused what you’re advocating.

I'm advocating using a pi-hole to block problematic domains on your network using list like the one from StevenBlack and entire TLDs that could be confusing. If you don't think .zip & .mov could be confusing then feel free to not block them.

[ Parent | on HN ]

Re:Block Adware and Malware with /etc/hosts by Beldin on Tuesday June 13, 2023 @02:14AM (#36306201)

The explanation I've seen is that certain programs (mail, chat, forums, etc) automatically recognise urls that are not hyperlinked and convert them into a hyperlink.

E.g. "example.com" becomes "<a href="http://example.com/">example.com</a>".

Such features would now (potentially) also work on mentions of zip files, i.e. on messages that state "download install.zip from github".

Edit: ghi, HN actually does this. Not yet with zip TLDs though.

[ Parent | on HN ]

Re:Block Adware and Malware with /etc/hosts by yonatan8070 on Tuesday June 13, 2023 @12:35AM (#36305370)

As I understand, the attack is preformed by when someone mentions attaching a file to an email (i.e. "I've attached invoice.zip"), then that filename becomes a clickable link, and the user clicks it expecting to download the file, but is actually taken to the attacker's website which looks like WinRAR, and download malware from there.

To me this attack sounds too convoluted to actually get people, since you'll need to buy a lot of domains to match someone's email's contents

[ Parent | on HN ]

Re:Block Adware and Malware with /etc/hosts by hulitu on Tuesday June 13, 2023 @02:55AM (#36306528)

attachment.zip ?

[ Parent | on HN ]

Re:Block Adware and Malware with /etc/hosts by eli on Tuesday June 13, 2023 @09:31AM (#36309968)

<a href="https://malware.example.com/">attachment.zip</a>

[ Parent | on HN ]

Re:Block Adware and Malware with /etc/hosts by eli on Tuesday June 13, 2023 @09:31AM (#36309960)

Which email client automatically creates links? Virtually everyone uses HTML email, which can link any text to any destination. If your users are clicking links to download files that they got via email from untrusted sources...then the domain doesn't really matter.

[ Parent | on HN ]

Re:Block Adware and Malware with /etc/hosts by yonatan8070 on Tuesday June 13, 2023 @09:48AM (#36310192)

I just tried emailing myself a few links and they all got automatically hyperlinked by Outlook on Android. Here are the links I tried

testlink.com link.gov abc.zip test.xyz

I agree about being able to hyperlink pretty much anything having the same effect, that's why I don't think the .zip TLD is a big issue

[ Parent | on HN ]