4 ms·

This is the default list used by the pihole project as well; it's a very good list. FWIW, something like ublock origin is going to be better for in-browser blo

This is the default list used by the pihole project as well; it's a very good list. FWIW, something like ublock origin is going to be better for in-browser blocking (for example, DNS poisoning won't work with youtube ads, which are served from youtube.com, but addins like UBO can remove them because they can hook into the actual traffic). The ultimate adblocking solution is to use UBO in your browsers AND spin up a pihole to block ads on your entire network: https://pi-hole.net/ https://pi-hole.net/

wnevets 3y ago
pi-hole also makes it super easy to block .zip and .mov TLDs.
- ozim 3y ago
  Don't forget .com which is executable extension.
  - wnevets 3y ago
    I'm not worried about the non-techies being tricked into thinking .com is an executable, I doubt they even know its possible. They almost certainly know about .zips
    - eli 3y ago
      I still don't understand the threat model here. Is there an example of how this could be used as part of an attack?
      - wnevets 3y ago
        https://thehackernews.com/2023/05/dont-click-that-zip-file-phishers.html https://thehackernews.com/2023/05/dont-click-that-zip-file-p... edit: HN is actually erroring out if I post an example .zip domain of the problem
        eli 3y ago
        I'm not doubting you can trick people into engaging with a phishing site that looks like WinRAR. I just don't think the domain makes any difference.
        wnevets 3y ago
        You don't think a url like those in this article [1] makes any difference? You have more faith stopping phishing than I. [1] https://medium.com/@bobbyrsec/the-dangers-of-googles-zip-tld-5e1e675e59a5 https://medium.com/@bobbyrsec/the-dangers-of-googles-zip-tld...
        eli 3y ago
        If I hover over the link like my phishing training says to do, Chrome correctly shows it as "https://v1271.zip https://v1271.zip" If I don't bother hovering over the link then the domain never mattered at all. Could have hosted the file anywhere since the link text in HTML (including HTML email) need not have any relation to the destination. You can simply write a legitimate github.com link but the href goes somewhere else. Any situation where you're relying on users to visually inspect every link and decide if the domain looks plausible is already a security failure. If I'm downloading and executing files that are randomly in a Medium article or in my inbox from an untrusted source then we're in trouble whether they are hosted on github or not.
        wnevets 3y ago
        > If I hover over the link like my phishing training says to do How do you hover on mobile? Instead of training my family members to hover on their phone's I will continue to just block these TLDs.
        eli 3y ago
        I’m confused what you’re advocating. If your family isn’t checking the domain before downloading and executing files then the .zip tld doesn’t matter. They’re just as vulnerable to phishing without it.
      - yonatan8070 3y ago
        As I understand, the attack is preformed by when someone mentions attaching a file to an email (i.e. "I've attached invoice.zip"), then that filename becomes a clickable link, and the user clicks it expecting to download the file, but is actually taken to the attacker's website which looks like WinRAR, and download malware from there. To me this attack sounds too convoluted to actually get people, since you'll need to buy a lot of domains to match someone's email's contents
        hulitu 3y ago
        attachment.zip ?
        eli 3y ago
        <a href="https://malware.example.com/">attachment.zip</a> https://malware.example.com/">attachment.zip</a>
        eli 3y ago
        Which email client automatically creates links? Virtually everyone uses HTML email, which can link any text to any destination. If your users are clicking links to download files that they got via email from untrusted sources...then the domain doesn't really matter.
        yonatan8070 3y ago
        I just tried emailing myself a few links and they all got automatically hyperlinked by Outlook on Android. Here are the links I tried testlink.com link.gov abc.zip test.xyz I agree about being able to hyperlink pretty much anything having the same effect, that's why I don't think the .zip TLD is a big issue
  - Kazrath 3y ago
    To be fair all extensions are potentially executable. Extensions are just a mapping to an application maintained by the OS. .com is just mapped to a program that executes by default. File type is a whole different ball of yarn to untangle.
afruitpie 3y ago
Pi-Hole and PiVPN [0] is a great setup for DNS filtering on-the-go. The setup for PiVPN makes it foolproof as well. When my Pi stopped working and I couldn’t find a new one, I gave up and moved to NextDNS [1] and have been very happy. [0] https://www.pivpn.io/ https://www.pivpn.io/ [1] https://nextdns.io/ https://nextdns.io/
fullspectrumdev 3y ago
Extra fun: measure bandwidth use before and after implementing, the savings are fucking nuts. All that adtech webshit loading in hundreds of mb of obfuscated JS and assets to sell you widgets…

wnevets 3y ago

pi-hole also makes it super easy to block .zip and .mov TLDs.

ozim 3y ago
Don't forget .com which is executable extension.
- wnevets 3y ago
  I'm not worried about the non-techies being tricked into thinking .com is an executable, I doubt they even know its possible. They almost certainly know about .zips
  - eli 3y ago
    I still don't understand the threat model here. Is there an example of how this could be used as part of an attack?
    - wnevets 3y ago
      https://thehackernews.com/2023/05/dont-click-that-zip-file-phishers.html https://thehackernews.com/2023/05/dont-click-that-zip-file-p... edit: HN is actually erroring out if I post an example .zip domain of the problem
      - eli 3y ago
        I'm not doubting you can trick people into engaging with a phishing site that looks like WinRAR. I just don't think the domain makes any difference.
        wnevets 3y ago
        You don't think a url like those in this article [1] makes any difference? You have more faith stopping phishing than I. [1] https://medium.com/@bobbyrsec/the-dangers-of-googles-zip-tld-5e1e675e59a5 https://medium.com/@bobbyrsec/the-dangers-of-googles-zip-tld...
        eli 3y ago
        If I hover over the link like my phishing training says to do, Chrome correctly shows it as "https://v1271.zip https://v1271.zip" If I don't bother hovering over the link then the domain never mattered at all. Could have hosted the file anywhere since the link text in HTML (including HTML email) need not have any relation to the destination. You can simply write a legitimate github.com link but the href goes somewhere else. Any situation where you're relying on users to visually inspect every link and decide if the domain looks plausible is already a security failure. If I'm downloading and executing files that are randomly in a Medium article or in my inbox from an untrusted source then we're in trouble whether they are hosted on github or not.
        wnevets 3y ago
        > If I hover over the link like my phishing training says to do How do you hover on mobile? Instead of training my family members to hover on their phone's I will continue to just block these TLDs.
        eli 3y ago
        I’m confused what you’re advocating. If your family isn’t checking the domain before downloading and executing files then the .zip tld doesn’t matter. They’re just as vulnerable to phishing without it.
    - yonatan8070 3y ago
      As I understand, the attack is preformed by when someone mentions attaching a file to an email (i.e. "I've attached invoice.zip"), then that filename becomes a clickable link, and the user clicks it expecting to download the file, but is actually taken to the attacker's website which looks like WinRAR, and download malware from there. To me this attack sounds too convoluted to actually get people, since you'll need to buy a lot of domains to match someone's email's contents
      - hulitu 3y ago
        attachment.zip ?
        eli 3y ago
        <a href="https://malware.example.com/">attachment.zip</a> https://malware.example.com/">attachment.zip</a>
      - eli 3y ago
        Which email client automatically creates links? Virtually everyone uses HTML email, which can link any text to any destination. If your users are clicking links to download files that they got via email from untrusted sources...then the domain doesn't really matter.
        yonatan8070 3y ago
        I just tried emailing myself a few links and they all got automatically hyperlinked by Outlook on Android. Here are the links I tried testlink.com link.gov abc.zip test.xyz I agree about being able to hyperlink pretty much anything having the same effect, that's why I don't think the .zip TLD is a big issue
- Kazrath 3y ago
  To be fair all extensions are potentially executable. Extensions are just a mapping to an application maintained by the OS. .com is just mapped to a program that executes by default. File type is a whole different ball of yarn to untangle.

afruitpie 3y ago

Pi-Hole and PiVPN [0] is a great setup for DNS filtering on-the-go. The setup for PiVPN makes it foolproof as well. When my Pi stopped working and I couldn’t find a new one, I gave up and moved to NextDNS [1] and have been very happy. [0] https://www.pivpn.io/ https://www.pivpn.io/ [1] https://nextdns.io/ https://nextdns.io/

fullspectrumdev 3y ago

Extra fun: measure bandwidth use before and after implementing, the savings are fucking nuts. All that adtech webshit loading in hundreds of mb of obfuscated JS and assets to sell you widgets…