Re: [Full-disclosure] Microsoft DNS resolver: deliberately sabotagedhosts-file lookup
> I agree that there should have been better documentation of this, but I
> think the noted objections are a bit hyperbolic.
While I don't disagree with what you said, I think there are some things you
didn't consider.
First, why is anything besides what is required for windows update being
bypassed? Why MSN.COM? Why NOT Symantec.com? I mean this looks more like a
way to keep passport functional than as a way to foil trojans.
Second, why is it that it's darn near impossible to screw with media player
or Messenger (both are protected by Windows file protection) yet hosts file
changes don't even popup a dialog box to ask the user if the change is ok? I
mean this is a really sneaky way of "fixing" things. Also before you say WFP
or a popup could be disabled by a trojan, so could this fix.
Third, this appears to me to be just more half witted fixes imo. The problem
is a trojan modifying hosts then fix the problem instead of ignoring hosts.
Provide a locking mechanism for hosts, remove the trojan, there are a
hundred ways to fix this that are far more proper ways to do things than
this.
Geo.