5 ms·
Windows has a hardcoded list of Microsoft domain names that entirely bypass the hosts file. I see nothing about this, so I would assume there is no countermeasu
by LoganDark 3mo ago
Windows has a hardcoded list of Microsoft domain names that entirely bypass the hosts file. I see nothing about this, so I would assume there is no countermeasure here. Curiously, this approach appears to have been tested as working anyway.
- jasonjayr 3mo agoIs there anyone maintaining a canonical list of such domains and hosts? This would be useful to add as firewall rules on a router upstream of any windows hosts, or to a pihole.
- LoganDark 3mo agoHere's one from a couple years back: https://petri.com/windows-10-ignoring-hosts-file-specific-name-resolution/ https://petri.com/windows-10-ignoring-hosts-file-specific-na... AFAICT it has not changed.
- vetrom 3mo agoRun say a linux firewall vm with PCI nic passthrough and give the host windows machine a virtio-pci/TAP interface as its network access is one countermeasure off the top of my head I can think of.
- exceptione 3mo agoAgreed, running it inside a vm is how you would treat any other malware. Why pci passtrough instead of a regular virtio network driver though?
- vetrom 3mo agoI'm imagining a situation where you need to run windows on the host, but you do not want windows itself arbitrating network access -- so you pass through the real NIC to the vm, and route through the vm with a virtio (I think TAP is actually the only option host-side though but still) NIC.
- exceptione 3mo agoAh, I see. Given that you can even pass disks, gpu's, usb devices etc via pci, I would always choose the opposite route: run windows in a vm.
- jerhewet 3mo agoAdguard Home running on a Raspberry Pi. Point your router at it for DNS, works like a charm. Two years now, and it consistently blocks 48% to 54% of all the trash, including _all_ Microsoft domains.
- Melatonic 3mo agoUnless they just hardcode an IP to their DNS server of choice or even hardcode an IP to a specific Microsoft tracking host