5 ms·
How is defender not flagging this? Changing hosts file should raise alarms
by lousken 6mo ago
How is defender not flagging this? Changing hosts file should raise alarms
- xattt 6mo agoCan this not be blocked with file permissions? Or a symlink to a file in a ro folder?
- SoftTalker 6mo agoMost software installers demand to be run as root/Administrator. The fact that this is largely seen as acceptable or even sensible is rather silly in this day and age.
- deepsun 6mo agoYes, and when apps do request many permissios, I just estimate how reputable the company is. A name like Adobe must be ok, right?
- gruez 6mo ago>Yes, and when apps do request many permissios Most windows apps aren't sandboxed so the concept of "permissions" doesn't make any sense. The most there is is "asks to run as admin", but most installers do.
- cmovq 6mo agoSoftware wants to be installed in C:\Program Files so that other software can’t modify their installation without admin permissions. Of course to do that your installer needs to be run as administrator which makes the whole thing rather silly.
- tredre3 6mo agoSoftware installed through the Windows Store seem immutable enough even though they live in the user's AppData. At least the system prevented me from seeing or modifying the files the last time I tried. I did not try very hard, admittedly, but by contrast modifying something in C:\Program Files is just one UAC confirmation away.
- akdev1l 6mo agoThe fundamental issue is that installers shouldn’t exist There’s no need to have an executable program just to essentially unzip some files to disk
- gruez 6mo ago>There’s no need to have an executable program just to essentially unzip some files to disk What if you need to install some registry keys? What about installing shared dependencies (redistributables)? What if you want granny to install your app and left to her own devices, it'll end up in some random folder in the downloads folder?
- maxloh 6mo agoSoftware installers need Administrator privileges to edit C:\Program Files\. But once they get the permission, you can't really tell if they are "genuine", or if they also edit C:\Windows\ or messing around the registry. It is just a really bad design without built-in sandboxing.
- gjsman-1000 6mo agoThe hosts file is not sacred on Windows. Anyone who is administrator can just edit it. I've done it to add domain names to localhost. For anyone hand-wringing over this, this used to be normal. The hosts file was invented a decade before DNS. The end user, or app, would edit their hosts file purposefully after downloading a master copy from the Stanford Research Institute which was occasionally updated.
- jacobgkau 6mo ago> For anyone hand-wringing over this, this used to be normal. People editing hosts files for other reasons was normal (a long time ago-- and it stopped being normal for valid reasons, as tech evolved and the shortcomings of that system were solved). A program automatically editing the hosts file and its website using that to detect information about the website visitor is not the same thing; that usage is novel and was never "normal."
- wtallis 6mo agoIn particular, manually editing the hosts file was a mostly-obsolete practice by the time the first version of Windows shipped, and certainly by the time Windows actually had a built-in networking stack. And it was always a red flag for a local app to mess with the hosts file.
- jeffbee 6mo ago> manually editing the hosts file was a mostly-obsolete practice by the time the first version of Windows shipped This claim strikes me as obviously wrong.
- raverbashing 6mo agoI wonder how this works on Windows, if any service overrides/resets it
- Asmod4n 6mo agoDefender warns you this happened.
- anxman 6mo agoI didn't get this warning on MacOS
- DamnableNook 6mo agoDid you expect to get a Windows Defender warning on macOS?
- hypeatei 6mo agoMost users won't care, especially if the Adobe installer warns them that a security warning might popup after installation. Besides, in practice, any malware editing the hosts file isn't going to get much because of HTTPS; one cannot simply redirect "google.com" traffic to their own IP without issue.