Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotaged hosts-file lookup

Nobody has mentioned this, so maybe I should.

It is not difficult to bypass the hosts file on *any* operting system 
whatsoever, by just writing your own resolver. This is easier than you 
think---the standard resolver library has all the machinery you need modulo 
creating the UDP socket. Bind has an even easier library... and an example of 
how to use it (aka dig).

AFAIK winodws update et al are based on http, so a firewall that requiries one 
to use the provided HTTP proxy can block its requests (and lots of instant 
messgaing software). You could even use a transparent proxy so nobody notices 
anything until the proxy denies their request.

You can do all the above with a solution like sonic wall (and presuambly their 
competitors' alternatives), linux+iptables, and presumably similar faciltiies 
on other platforms.

I think the advice is to buy or build a seperate firewall, configure it to 
deny anything not desired, and you should be safe. Rerquiring the use of a 
local proxy or name servers just requires blocking outbound requests to the 
appropriate ports from all other hosts. I suspect bugtraq would *not* 
recommend any seperate firewall based on M$ windows, but would recommend using 
the provided firewalling feattures.

-- 
Duncan (-:
"software industry, the: unique industry where selling substandard goods is
legal and you can charge extra for fixing the problems."