Buying the Pharm

[phernandez]

What happens when Javascript and the Windows hosts file collide...

Simple Pharming - 0x000000 The Hacker Webzine

There is so much you can do with Javascript that the best way to describe the toxic mix of browser exploits with Javascript will be an example to launch a pharming attack. The sheer beauty of pharming is that the surfer will almost never know that he has been compromised, because it is very silent. One way of quickly pharm surfers is to modify the hosts file on Windows.

Read the rest for the sample code. Firefox + NoScript for me, thanks.

[JPnyc]

Something I don't understand there. They're instantiating an ActiveX object . Wouldn't that be blocked by most people's security settings these days? I know it would be by mine.

[nihil]

Spybot Search & Destroy. Go to the "tools" section, you can inspect what is in your hosts file.

If you select "IE Tweaks" there is also an option to lock the hosts file as read only.

Like phernandez I generally use FF with "noscripts". My IE is set to ask permission before running ActiveX I cannot remember what the default is though?............... probably to run them?

[JPnyc]

Not anymore, it used to be the default but it hasn't been for a few years now. I actually have ActiveX disabled entirely so it would never be a problem for me, but I believe the newer security settings of several years ago prohibited JavaScript from accessing the file system object entirely, unless you expressly alter the settings to allow it.

[nihil]

Doesn't that cause a problem with MSUpdate?

[JPnyc]

In my browser, I can enable/disable most anything with 2 clicks on the toolbar, globally or on a per tab basis, so I don't have to worry bout that.

[morganlefay]

I am pretty sure you need admin privledges to edit a host file.

MLF

[Tachyon]

I am pretty sure you need admin privledges to edit a host file.

MLF

I can't test this now (at work, with admin priveleges) but I believe anyone can open host in notepad, make changes then save.

*Edit*
Found a page that said admin required for Vista. Don't believe XP required this.

Learn something new everyday =)

[phernandez]

In XP I can edit it as I please, haven't tried Vista though...

[nihil]

Yes, that's how I understand it.............. only Vista needs admin, that is why it could be an issue because malware and rogue websites can hijack it in other versions of Windows.

ZoneAlarm Pro, Spybot S&D and WinPatrol all have the capability of locking the file