adblock subscriptions

[GµårÐïåñ]

read the paper here http://maliciousnetworks.org/fire.pdf and you will be able to correct your own work.

As I said, I am more familiar with it than you, I am sure of it. Secondly, if you can't point out what it is you find incorrect, then that shows that you were arguing without merit. So I am done with you.

Fortunately, current security products already provide that service. For me, Firefox blocks known attack sites. I believe the the list is maintained by stopbadware.org and hosted by Google. Secondly, the Avast realtime Internet Shield blocks access to all sites that Avast knows about.

Alan, thank you for the voice of reason and affirming what I already stated earlier. It seems this person is following their own claim of "... some are strongly attached to opposing opinions ..." and is either a shill for FIRE or just looking to argue for the sake of arguing. A friend once told me that when you wrestle with a pig, you get dirty and the pig loves it, so I am hereby discontinuing this wrestling match. I have better things to do.

[Guest]

Alan Baxter, it is my understanding that the attack blocking by Firefox/Google which you mention is site based. I maintain that the FIRE, Finding RoguE Networks, project provides information that could be useful in supplementing such approach, especially if such information can be automated, for example by a subscription for NoScript users.

There are a some reasonable possibilities under which my contention could be wrong, such as if a server hosting 'Firefox/Google blocked' exploit sites were no more likely than random to host other sites delivering exploits that are not yet blocked by Firefox/Google. Another possibility that my contention could be wrong would be if the FIRE reported current IP address of the known malicious site were stale.

I can find no reliable evidence that my contention is wrong, however. GµårÐïåñ argues, in essence, that I am incorrect, but his statements are based on a variety of self-evident logical fallacies; e.g., Argumentum ad Populum, Petitio Principiiso, Ignorantio Elenchi, etc, so his comments have not been useful in determining truth, unfortunately.

In any event, I believe I have gotten my point across, that the FIRE data is worth serious consideration for an ABE subscription.

[Alan Baxter]

Alan Baxter, it is my understanding that the attack blocking by Firefox/Google which you mention is site based. I maintain that the FIRE, Finding RoguE Networks, project provides information that could be useful in supplementing such approach, especially if such information can be automated, for example by a subscription for NoScript users.

If it isn't already, I would prefer to have it automated by something more centralized like stopbadware.org or Avast.

[Guest]

I can find no reliable evidence that my contention is wrong, however. GµårÐïåñ argues, in essence, that I am incorrect, but his statements are based on a variety of self-evident logical fallacies; e.g., Argumentum ad Populum, Petitio Principiiso, Ignorantio Elenchi, etc, so his comments have not been useful in determining truth, unfortunately.

Praising this one solution from the paper as a panpharmacon sancti and being unable to understand what Guardian wrote… Are you by any chance a troll in disguisea?

[computerhurt]

I wanted content from a website and needed to allow a script to run to get it. I cannot manually check every site against multiple malware lists every time I want a script to run, no one can. The chance that a random url/uri hosts malware is roughly 1 in 10,000, so I took a chance. Firefox didn’t warn me of the impending doom, none of the other security precautions here flagged the URI/URL either, and as far as I can tell, only one malware address list ( http://www.malwaredomainlist.com/ )had reported the exploit server before my computer got raped.

A solution would have been:

1) NoScript could have included the 2,000 IP addresses at the following link, and warned me that the server at the relevant IP address might therefore be suspicious and thus worth the kind of investigation no one could perform manually on every visit to every URL/URI. http://www.malwaredomainlist.com/hostslist/ip.txt

2) NoScript could have then made it easy for me for me to get data on a site on the suspicious IP address, from multiple checkers, such as--BrowserDefender, Google Diagnostic, hpHosts, Malware Patrol, MalwareDomainList, McAfee SiteAdvisor, McAfee Trusted Source, MyWOT, Norton SafeWeb, ParetoLogic URL Clearing House, PhishTank, Project Honey Pot, Spamhaus, TrendMicro Web Reputation, Web Security Guard, ZeuS Tracker, etc.

Instead, none of those things happened.

Eventually, my computer’s Antivirus program detected one of the gang rapists, so things could have been worse, but my computer was raped nonetheless, may no longer be secure and may never be the same.

No, I’m not going to give details on the particular attack or on the security here, because providing such info might be unsafe, but I will say that the security here is tight.

NoScript is good and I am happy to have it, I just wish it were a bit more informative so that making wise choices were somewhat easier and less time consuming.

[Alan Baxter]

Sorry to hear you had/have a problem. I sympathize with your feeling that your computer may still have an infection lurking in it that is undetectable. That's possible for most of the rest of us too.

1) NoScript could have included the 2,000 IP addresses at the following link, and warned me that the server at the relevant IP address might therefore be suspicious and thus worth the kind of investigation no one could perform manually on every visit to every URL/URI. http://www.malwaredomainlist.com/hostslist/ip.txt

Consider adding the Malware Domains block list to Adblock Plus. http://adblockplus.org/en/subscriptions

2) NoScript could have then made it easy for me for me to get data on a site on the suspicious IP address, from multiple checkers, such as--BrowserDefender, Google Diagnostic, hpHosts, Malware Patrol, MalwareDomainList, McAfee SiteAdvisor, McAfee Trusted Source, MyWOT, Norton SafeWeb, ParetoLogic URL Clearing House, PhishTank, Project Honey Pot, Spamhaus, TrendMicro Web Reputation, Web Security Guard, ZeuS Tracker, etc.

Middle-click on the site in the NoScript menu to get a list of links to additional data. The site name can be easily copied from there if you want to paste it into additional search bars. I just paste it into my Firefox search bar and go through a few additional checkers I've installed in the search bar.

I'm sure Giorgio appreciates your story and suggestions. I'll leave any other responses to him.

[Giorgio Maone]

Known malware-serving domains are not for NoScript to block, because it would duplicate a built-in Firefox feature: http://www.mozilla.com/en-US/firefox/ph ... rotection/
It uses Google's Safe Browsing database. If you feel it's inadequate, you can lobby for it to be merged with other, more up-to-date databases.
However, the middle-click "Site info" page which Alan Baxter hinted at is a work in progress meant to be augmented with any publicly available information source which can help users in making educated choices, so the resources mentioned in this thread will be evaluated for this purpose.

[computerhurt]

Known malware-serving domains are not for NoScript to block, because it would duplicate a built-in Firefox feature

The middle-click "Site info" feature is going to be great when finished, I’m sure. A question is what sort of guidance NoScript will be able to provide as to when to use it.

Fully ‘known’ malware-serving domains are blocked by Firefox, so the NoScript “site info” feature won’t help lots there. Fully unknown malware-serving domains won’t be marked as dangerous by the NoScript “site info” feature, so it won’t help in such instances either.

But what about the 300 or so sites newly suspected of actually serving exploits within the past 72 hours? That is where the NoScript “site info” feature could help lots, during what can be a 3-day lag between the time an exploit server is discovered and when its URL would be reported to the user by Firefox as an attack page. (E.g., exploit server is discovered and listed in some good database, Google investigates within 24 hours, Firefox is notified within 48 hours, and the Firefox blocking feature is updated in less than 72 hours.)

Perhaps NoScript could find a way to alert users that a site, or its IP address, is one of those 300 or so newly suspected of actually serving exploits within the past 72 hours and therefore should be checked by the middle-click "Site info" feature. In the alternative I could give away my full browsing history to even more site reputation toolbars, but the performance and privacy losses involved make me suspect that NoScript could provide a much superior solution, with almost no privacy loss or performance loss, given the 300 or fewer URLs, or IP addresses, at issue at any give time.

[computerhurt]

However, the middle-click "Site info" page which Alan Baxter hinted at is a work in progress meant to be augmented with any publicly available information source which can help users in making educated choices, so the resources mentioned in this thread will be evaluated for this purpose.

NoScript could suggest to users when it may be especially worthwhile to be extra cautious and be certain to use middle-click "Site info" page to check a site before allowing a script to run. To make such suggestions NoScript could make use the most recent 3 days or so of the update feed at the following link http://www.malwaredomainlist.com/hostslist/mdl.xml Of course, users could be told that sites/IPs on the feed were merely under current investigation, likely not yet confirmed definitively by Firefox/Google to be serving exploits, but nonetheless extra caution would be temporarily warranted.

[Tom T.]

The word "HOSTS" seems to be strangely missing from this discussion.

Several services offer a free download of a Hosts file, updated on some periodic basis. Mine presently lists about 15,000 known badsites, by URL or domain name rather than by IP. So for the bad guy to change IPs does no good. Of course, they can host their malware at a new domain also, but that is a problem with *every* anti-virus, site warning, or other protection. Some number of people get hit before the word gets out. See further defense to that below.

For those not familiar, the Hosts file (a relic of the days when there were only a dozen computers on the planet, and each had a list of the others and how to contact them) maps URLs to IPs, and *every* browser, including IE, Opera, etc. as well as Fx, checks for domain name resolution there before inquiring of your ISP or Domain Name Server. These Hosts services map all of their known bad sites to a non-existent IP address. So upon finding that badsite.com maps to 0.0.0.0, the browser immediately gives a "can't connect" message, *before it even puts the request on the network*. So you save time and bandwidth, too. Also, it's n00b-proof: Even if Grandma types in badsite.com, or clicks on a disguised link to there, the browser will not be able to establish connection.

Most of these services use 127.0.0.1, the "localhost" or "loopback" address of your own computer, but after discussion among one such service and NS dev Giorgio Maone, I changed mine to 0.0.0.0. Works great. Easy: In Win XP, go to C (or whichever is the OS drive) > Windows > system32 > drivers > etc. Open the Hosts with Wordpad or Notepad -- IIRC, Wordpad does the changes faster. Do a Find/Replace, replacing 127.0.0.1 with 0.0.0.0.

You must then change the first entry back to:
127.0.0.1 localhost
which must *always* be the first entry in the Hosts file. "Save" the file, close everything up, and you are done, until the next update. All changes, including new entries or deletions when you install an update, take effect upon the next start of the browser. It is not necessary to re-boot the machine.

This prevents NoScript or any other program from having to deal with those sites at all. You can't connect to them, and they can't connect to you, even if they're in an ad or IFrame on a trusted site.

2) A new malsite is always dangerous until AV and other defense sites get the word. For additional protection, you can use one of the virtual-machine solutions, or a much more lightweight approach that virtualizes only the browser, such as Sandboxie or VMWare Workstation. (I have no connection to either company, and make no endorsements, warranties, etc. over things I can't control.) Some are free for personal home use. I use Sandboxie, *always*, and configure it to empty the sandbox every time the browser is closed, which is frequently -- *especially* before and after visiting sensitive sites, like online banking. Any malware will be trapped in the sandbox and dumped, and your hard drive remains untouched.

I did a good bit of support work here before other obligations took over, and people were always saying, "Site X works fine without NS, but NS breaks it." I'd have to disable NS to reproduce the issue, which I would never do without a containment feature such as these. Search this forum for "innoshot" for a case in which I reproduced an infection received by a poster, but lost it on the next browser restart, while the user had it for three weeks while we hunted down the source and location on the hard drive. Fortunately, NS prevented either of us from allowing the malicious code to run. No harm, no foul.

This is why "defense in depth" is the best practice, and no single solution, no matter how good, can ever be enough. Debating whether A or B is better, or the merits of either, is useless. Choose what you think is best in each category -- AV, site-warning or evaluation sites, firewall, the Google service if you like (I don't like their privacy violations, but that's just MHO), NoScript of course, and virtualization.

And don't allow any third-party content, other than Akamai, unless you *must*, AND you trust that site. For that matter, don't allow any FIRST-party content that isn't necessary for the function that you need.

Perhaps this combination is why I've remained safe, despite using a browser that's been unsupported for a year and a half, as the useragent below shows.

Cheers and safe browsing to all.

[GµårÐïåñ]

Excellent points Tom, thank you for posting. Just to add a quick note, that's how Spybot S&D's immunization works, by adding those entries to the HOST file (as well as other places like image exceptions, cookie exceptions, etc, etc). So when you open HOST files on machines that have SSD you will see a section where they put theirs. Now ANYONE can use the bad domains lists available at any myriad of websites and simply cut and paste them into the file or use a HOST file manager that can eliminate duplicate entries so that it doesn't bloat your file. Anyway, thanks Tom, great points and very effective too.

[Tom T.]

Meant to include in the above post that the user can edit the Hosts file any way they like, so if you want to use the rogue-site list one of the posters mentioned, and merge it into your Hosts file, it's as easy as copy/paste, as Guardian says. Or any individual sites you find out about. Just add lines, anywhere in the body of the file:

0.0.0.0 foe.com
0.0.0.0 evil.ru
0.0.0.0 pwn.cn

Save, close, start browser.

Sorry for not including the flexibility in the first post. Thanks for reminding me, Guardian.

btw, SpywareBlaster does the same thing -- uses your Hosts file for prevention -- along with a few other features, such as saving an encrypted backup copy of the Hosts.

[Tom T.]

<snip>
Here is a link to the full FIRE: FInding RoguE Networks blocklist, should anyone care to do some experimenting http://www.maliciousnetworks.org/fire-blocklist.txt <snip>

@ tiredtoday: I looked at that list. All of the entries have this form:

110.50.228.153 AS18018

An IP, followed by the letters "AS" and four or five digits. This tells me *nothing* about the URL or domain, or who or what they are, or claim to be. Why would anyone trust such a list blindly? .... No, I don't read all 15,000 entries provided by my Hosts service, but I sometimes scan randomly for interesting stuff. Easy, because they're human-readable, and often include the reason that the site is blacklisted. Actual examples, chosen randomly:

0.0.0.0 track.acclaimnetwork.com
0.0.0.0 htzp://www.aconti.net #[Dialer.Aconti] (i. e., if you have a dial-up modem, it will charge you huge long-distance fees -- T.T.)
0.0.0.0 httz://www.ad-groups.com #[Ban Man Pro Banner Code]
0.0.0.0 adxrnet.net #[Trojan.Virtumod.240]
0.0.0.0 htxp://wvvw.dateclix.com #[DateClix.com Banner Exchange Code]


... and so on. This gives me something real and useful about the sites, which the FIRE blocklist doesn't. (links were deliberately broken for safety here.)

And FWIW, maybe I'm an old fogey, but the logo at the top of the FIRE list gives it an unprofessional look right from the start, more to appeal to kids -- and enough to make me suspect that they *might* be a rogue site themselves. It looks like this:

# ( ( (
# )\ ) )\ ))\ )
# (()/((()/(()/((
# /(_))/(_))(_))\
# (_))_(_))(_))((_)
# ___ __ ___
# |__ | |__) |__
# | | | \ |___

(Renders better in Notepad than on the Forum) Now, how professional-looking is that?
Here's how mine starts:

# This MVPS HOSTS file is a free download from: #
# http://www.mvps.org/winhelp2002/ #
# #
# Notes: the browser does not read this "#" symbol #
# You can create your own notes, after the # symbol #
# This *must* be the first line: 127.0.0.1 localhost #
# *********************************************************#
# ----------------- Updated: May-04-2010 ------------------#
# *********************************************************#
# #
# Entries with comments are all searchable via Google. #
# #
# Disclaimer: this file is free to use for personal use #
# only. Furthermore it is NOT permitted to copy any of the #
# contents or host on any other site without permission or #
# meeting the full criteria of the below license terms. #
# #
# This work is licensed under the Creative Commons #
# Attribution-NonCommercial-ShareAlike License. #
# http://creativecommons.org/licenses/by-nc-sa/3.0/ #

127.0.0.1 localhost

Which one looks more like a professional, well-researched, easily-verifiable job to you?

EDIT: It just gets worse and worse....

I chose *one* IP randomly from the FIRE list, 64.12.164.247.

That traces to http://icq-mv02.coreweb.aol.com/ -- an ICQ site. Not something I personally would use, but the very fact that my browser would connect there means that the service I use doesn't think it's malware. The only scripts and objects attempting to load were all from ICQ, AOL, and Facebook. Plus the usual ad networks, which are blocked in NS and Adblock anyway. IMHO, this kind of site is a subject for Parental Control, if desired, not a drastic blacklist.

So maybe this FIRE is trying to block legit sites? Extort money from them to get off the blocklist? ... I don't think I'll bother to trace any more of their list. Anyone else is welcome. It's lost all credibility to me.

[GµårÐïåñ]

Thank you for doing the research Tom and posting your findings. It goes to show and de facto prove what I stated earlier that any solution that blindly goes after IP addresses instead of domain names is already a poor if not ineffective solution because as I stated, IPs change, so if you block by domain name, global DNS propagation will always find them, but banning IP is at best a short-term solution and often useless since when they change, you are now blocking legit content of someone who is on that IP. Clearly no "scientific" process, if any legitimate process at all. Sites like this remind me of those antimalware scanning tools littering the web that do a "free" scan only to show you bogus entries that are not there to scare the person into buying a license for it. Often hijacking and illegally using Spybot S&D (SSD) databases anyway with some cheesy interface. To me, this is no different.

[Guest]

I chose *one* IP randomly from the FIRE list, 64.12.164.247.

That traces to http://icq-mv02.coreweb.aol.com/ -- an ICQ site.

Perhaps ICQ on IP 64.12.164.247 on AS1668 is also being used by someone as a botnet command and control server, on June 3, 2010.

http://www.maliciousnetworks.org/ipinfo ... 2010-06-03
http://www.maliciousnetworks.org/chart.php?as=AS1668

ICQ Botnet Communications
http://4.bp.blogspot.com/_wICHhTiQmrA/R ... botnet.jpg
http://ddanchev.blogspot.com/2007/03/bo ... forms.html


This post is not supposed to mean more than what it says.