Buying the Pharm

What happens when Javascript and the Windows hosts file collide...

Simple Pharming - 0x000000 The Hacker Webzine

Quote:

---

There is so much you can do with Javascript that the best way to describe the toxic mix of browser exploits with Javascript will be an example to launch a pharming attack. The sheer beauty of pharming is that the surfer will almost never know that he has been compromised, because it is very silent. One way of quickly pharm surfers is to modify the hosts file on Windows.

---

Read the rest for the sample code. Firefox + NoScript for me, thanks.

Something I don't understand there. They're instantiating an ActiveX object . Wouldn't that be blocked by most people's security settings these days? I know it would be by mine.

Spybot Search & Destroy. Go to the "tools" section, you can inspect what is in your hosts file.

If you select "IE Tweaks" there is also an option to lock the hosts file as read only.

Like phernandez I generally use FF with "noscripts". My IE is set to ask permission before running ActiveX I cannot remember what the default is though?............... probably to run them?

Not anymore, it used to be the default but it hasn't been for a few years now. I actually have ActiveX disabled entirely so it would never be a problem for me, but I believe the newer security settings of several years ago prohibited JavaScript from accessing the file system object entirely, unless you expressly alter the settings to allow it.

Doesn't that cause a problem with MSUpdate?

In my browser, I can enable/disable most anything with 2 clicks on the toolbar, globally or on a per tab basis, so I don't have to worry bout that.

I am pretty sure you need admin privledges to edit a host file.

MLF

Quote:

---

Originally Posted by morganlefay

I am pretty sure you need admin privledges to edit a host file.

MLF

---

I can't test this now (at work, with admin priveleges) but I believe anyone can open host in notepad, make changes then save.

*Edit*
Found a page that said admin required for Vista. Don't believe XP required this.

Learn something new everyday =)

In XP I can edit it as I please, haven't tried Vista though...

Yes, that's how I understand it.............. only Vista needs admin, that is why it could be an issue because malware and rogue websites can hijack it in other versions of Windows.

ZoneAlarm Pro, Spybot S&D and WinPatrol all have the capability of locking the file ;)

Quote:

---

Originally Posted by JPnyc

Something I don't understand there. They're instantiating an ActiveX object . Wouldn't that be blocked by most people's security settings these days? I know it would be by mine.

---

Yea, but its like the rest of the security warnings in Vista; I think that most people would just click to allow without thinking twice.

But even with IE6 in XP, assuming both are patched, you wouldn't be able to create an activeX object and access the files on drive with JS, except for cookies of course.

Quote:

---

Originally Posted by phernandez

In XP I can edit it as I please, haven't tried Vista though...

---

Well you must be admin of the machine then :rolleyes:

I am sitting here on an XP Pro Laptop ...limited account...and I cant edit the host file. I can save it in my documents but not in the driver>etc directory as I "do not have the permissions to save in this directory".

Havent tried on 2000 yet...but I am pretty sure I will recieve the same results.

Maybe you guyz arent patched ;)


MLF

That's interesting MLF.

I have just checked XP Pro SP3 and 2000 SP4 and you need to be Admin or System. Now I am not sure what the default authorities are, so I might have downgraded the limited account or it could be something I ran, like the MS Baseline Security Analyser that prompted me to do it.

On the other hand, perhaps phernandez's account has some inherited elevated privileges from when it was set up............ kind of "Superuser"?

Strange thing is I cannot find anything on Google about it, although Vista is mentioned. Also, the three tools I mentioned earlier all have a facility to lock the hosts file?

I will dig out an old Win2000 box and see if that is the same.

On 2000 WS, member of a 2003 Server AD\domain , limited local user..cannot edit host file and save in the etc dirctory "access denied"

Also cannot created a folder or file in this directory.

My conclusion is unless the path of the host file is changed a limited user account would mitigate the said vulnerability.

MLF

This script would run in IE only anyway. Firefox doesn't know what an ActiveX object is. You can run this locally if you alter the security permissions in IE (allow active content to run in files on my computer) , but you'll still get a warning. I just tested it.

This is true JP but imagine what could happen to a lot of people if say msnbc.com got hacked or some huge site. People would accept because they "know the site" and A LOT of people could get hijacked real quick.

Many people could, yes. Can't believe after all this time that the word isn't out, I mean widespread, of the advantages of surfing with a minimal permissions account. I mean you can render SO many windows holes inert just by doing that one thing. So you have to log on/off to install something, so? How often does one install new software? 10 times a yr?