Phishing Pattern-Squatters

Recently, I received some of the email messages purportedly telling me I had a refund from the IRS. If you click on the link you will get infected by the ZeusBot Trojan of which there seems to be a new variant about every four to six hours to avoid detection by the various Anti-Virus and Anti-Spy engines. How bad is the detection on them? Usually less than 10/41 AV engines at VirusTotal will detect it as bad. In the best of all worlds, everybody would be using Thunderbird, Claws Mail, or similar MUA (Mail User Agent) programs. We would also get the email messages like I did - no jangling telephone, screaming kids or other organized mayhem or disorganized chaos. I could not even see the links. I had to save the email messages and read them in Vim to suck down the then current ZBot for analysis.
But we don't all live in an ideal world. The messages arrived right before American Thanksgiving which even put a lot of pressure on me to do something about it. Most people are using WebMail (Sarah Palin, et al), Outlook Express, Outlook or some other helpful (not) MUA that obligingly displays the links in the HTML for people to click on them and get infected. There is no doubt that having it arrive in the midst of major winter holidays is making for a very successful campaign. At least tens of thousands and perhaps even hundreds of thousands or even millions of machines running Microsoft Windows now have been infected. Linux, Macintosh, and other Unix or Unix-like owners should not chortle. What makes most of these campaigns so successful is the PEBKAC (Problem Exists Between Keyboard And Chair) factor. I must say that the smugness of Macintosh owners is not a good thing. As Dai Zovi has said, "There is no magic fairy dust protecting Macs."
So I had to do something. One was to just tell people to be tardy in reading their email. The hosts in the email messages usually have a life-span of 24 hours or less. Guess what? That will work! If you are late getting around to reading that particular message, the host will no longer have an IP address and so you will be protected. But do not let that lull you into a false sense of security. Even though what I normally work with does have host names that come and go like mad, making them totally immune to even the most ambitious black-list type approach, two possible threats exist. First, people mistakenly assume that once the initial salvo of hosts has died, the problem has gone away. Au contraire. My samples came well over two weeks after the University of Alabama Birmingham resesarchers led by Dr. Gary Warner identified the host name patterns that were in the message I received. You can see the latest of what the UAB anti-malware team discover here:

http://GarWarner.BlogSpot.com

Just because it may have died down for now, doesn't mean it cannot be resurrected later. The hackers can always count on the PEBKAC factor to help them get the job done. Second, even though the hosts are currently not staying around for more than 24 hours doesn't mean the hackers cannot change their modus operandi. All the hackers have to do is identify the email addresses the UAB.edu research team are using and have their malware avoid sending their messages there and other email addresses as identified by a reverse email black-list. The other part would be to allow the hosts to live longer. The hackers will very likely do precisely both of those things in the future. So what is needed is something that will spring into action defending against unknown threats. I am adding rules that do precisely that with the PAC filter we provide which I have always touted over the blocking hosts file provided at HostsFile.org and SecureMecca.com. The PAC filters are here:

http://www.HostsFile.org/pac.html
http://www.SecureMecca.com/pac.html

I am using the magic of how the rules are looked at (the fourth dimension in the words of Dr Emmett L Brown) in the PAC filter to restrict what is successful. For example, for the IRS and FDIC I have the following sets of rules:

GoodDomains[i++] = "fdic.gov";
GoodDomains[i++] = "irs.gov";

// BadHostParts[i++] = "fdic\.gov";
BadHostWordStarts[i++] = "fdic\.gov";
// BadHostParts[i++] = "irs\.gov";
BadHostParts[i++] = "refund-services\.irs";
BadHostParts[i++] = "refunds\.irs";
BadHostWordStarts[i++] = "irs\.gov";
BadHostWordStarts[i++] = "refund-services\.irs";
BadHostWordStarts[i++] = "refunds\.irs";

First, you will notice I am feeling my way along here. Any filtration system can have false positives. The commented out rules are active for me, but deactivated (commented out) for others. For the current campaign, the other rules will do nicely at protecting you. You can click on the links and the PAC filter will spring into action to protect you. Once I am convinced the commented out rules produce very few or no false positives most of the other rules will disappear and just the commented out rule and GoodDomains rule will be retained. There is one glaring security hole here. You could go to a host named NewAndImprovedIRS.gov. Since the likelihood of the hackers being able to stick something like that into the DNS caches is low I will live with it until it can be shown it is a high security risk. The reason why is the way it is now you can type irs.gov, but with the more restrictive way you must type www.irs.gov or have something / anything followed by an ".irs.gov". You make it more restrictly by putting a dot at the start of the GoodDomains pattern (what is inside the quotes).

Second, I just added slightly over two dozen phish threats that were in Dr. Warner's blogs where they attempt to steal your FTP / CPanel credentials for slightly over two dozen of the top web page providers that use CPanel for their customers. Here is one of them for the top ranked web page provider as identified by Alexa:

GoodDomains[i++] = ".yahoo.com";
GoodDomains[i++] = ".yahooapis.com";
BadHostParts[i++] = "yahoo\.com";
BadHostParts[i++] = "yahooapis\.com";
BadHostWordStarts[i++] = "cpanel";

Like the other rules they are of course all in their relevant sections. What this does is prevent me from clicking on a phish saying I must click on the link to correct my a problem with my account. We will ignore for the moment that I do not use cpanel and would never click on such a link (normally because I cannot even see it). But if I ever did and I was a Yahoo customer, these PAC rules would spring into action to protect me. These rules will even prevent me from going to something like NewYahoo.com. On the down side, they also prevent me from going to Yahoo.com but allow me to go to www.Yahoo.com. If you want things less secure just delete the leading dot in the pattern (what is insided the quotes) in a GoodDomains rule. There are a few where there is no leading dot. That is because the way they work prevented this more secure stance from being adopted. Here is one of them:

GoodDomains[i++] = "all-inkl.com";
BadHostParts[i++] = "all-inkl\.com";

There is nothing I can do about it. If you paste www.all-inkl.com into the URL bar of the browser it will immediately redirect you to all-inkl.com. I am glad they want a pattern-squatter to imitate them in the COM domain.

You may state: "My web hosting provider is not in the file. What can I do?". Well say your web hosting provider is softlayer.com. All you need to do is add the following two rules into the relevant sections:

GoodDomains[i++] = ".softlayer.com";
BadHostParts[i++] = "softlayer\.com";

If you want to live a little more dangerously you can delete the leading dot in the GoodDomains rule pattern. IOW, it would be just "softlayer.com". Please realize I practice what I preach:

GoodDomains[i++] = ".hostsfile.org";
GoodDomains[i++] = ".securemecca.com";
BadHostParts[i++} = "hostsfile\.org";
BadHostParts[i++} = "securemecca\.com";

I am now protected from NewHostsFile.org and BetterSecureMecca.com and you can see this in my update scripts. I can understand any name service provider not trying to prevent those names from being granted. Both are only rated around 6,000,000+ and if it starts going up I immediately being to search for the new trackers that are mostly likely the cause for the rating going up. But for the first few thousand top rated web sites as identified by Alexa or similar, a red flag needs to be raised that NewMicrosoft.com or BoobYouTube.com should be looked at very suspiciously at every host name service provider. They certainly shouldn't be granted immediately. At any host name provider a human needs to be notified before the name is granted. If you ask me there are certain patterns like "irs.gov", "fdic.gov", "chase.com" (pick your favorite bank) that should just be denied outright. Think of it as an extended trademark protection in host names. Perhaps we need a siren to go off and red light to start flashing for the higher priority host name patterns at the name service provider.

If you have rules you feel need to be added to the PAC filter my email address is in the the PAC filter file. That doesn't mean I will add them. There is a priority based on my estimation of how many people will use them. The top ones are my responsibilty. The lesser used ones are each individual user's responsibility.

For the person in the Washington Post who said that everybody should use sftp instead of ftp you are correct. But you should provide a list of host name / web service providers along with the relevant pages of how they provide the sftp access and how you should set it up. And I do not want some wham doozle Windows executable to do it. I would use sftp from a Unix system with an expect script to do the job of uploading. IOW, I need their web pages and they better have support for both Windows and Unix systems. Those host name / web service providers that will starting doing the pattern rejections like I propose they should be doing and providing sftp access deserve our support. By sftp access, I mean that there should be a detailed page in how to set it up on both Windows and Unix systems. Host name providers and web service providers that do these two things deserve our support.

HHH

Reduce Spam

How To Reduce Spam

1. The most sure way to reduce spam is to not have an email account. I didn't think you would go for that. Then here are the steps to take in order to reduce spam. They start with things you do to the machine only once because they have to be done first but all of the steps are important and work synergetically with each other. In other words, don't omit any of them because they are all important. But do the preparation work before you get the email account, not after you get it. That comprises steps 2 through 8.

2. First, install the Firefox browser. I don't even care if you use mainly IE, Opera, Safari, or some other browser. There is one portion of this that really depends on it being there and you starting Firefox every few days to get rid of Locally Shared Objects (LSOs) which are basically Adobe Flash Player cookies. Here is the main web site for Firefox:

http://www.mozilla.com/en-US/
http://www.mozilla.com/en-US/firefox/all.html

3. Now download and install the AdBlockPlus (ABP) plug-in. Here is the URL for it:

https://addons.mozilla.org/en-US/firefox/addon/1865

4. Pick the EasyPrivacy+EasyList subscriptions. For French add Liste FR. Make sure you get EasyPrivacy somehow! Here is the web page for where they are at:

http://adblockplus.org/en/subscriptions
http://adblockplus.org/fr/subscriptions

5. Install the Better Privacy plug-in and start Firefox every day and let it remove everything at browser close / open (your choice) until you know what you must keep. By everything I mean be sure to check "On cookie deletion also delete empty cookie folders" in the Options. Here is the URL for it:

https://addons.mozilla.org/en-US/firefox/addon/6623

6. If you are sincerely interested in stopping problems, then install NoScript. You may wonder why using this measure that is primarily meant to stop malware is effective in stopping spam. It is because in addition to stopping the scripting that is behind malware injections it also strips scripting that is used to track you that frequently ends up being used to garner information including the names of your email accounts. You can do the same thing that NoScript does for Firefox with what is built into Internet Explorer. Just make the Internet Zone look like the Restricted Zone - no scripting allowed - and put only the hosts you trust into the Trusted Zone (just make sure they can use both https: and http:). Here is where you can get NoScript:

https://addons.mozilla.org/en-US/firefox/addon/722

7. Install my or somebody else's hosts file that has as part of its reason for existence a dedication to stop tracking (spying). Some in addition to the one at SecureMecca.com / HostsFile.org that does this are MVPHosts, hpHosts. SomeoneWhoCares, and Airelle's hosts.trc file. Okay, here they are:

http://www.securemecca.com/hosts.html
http://www.hostsfile.org/hosts.html (duplicate of previous)
http://hosts-file.net/ (hpHosts)
http://www.mvps.org/winhelp2002/hosts.htm (MVPHosts)
http://rlwpx.free.fr/WPFF/hosts.htm (Airelle's lists)
http://sysctl.org/cameleon/hosts (Cameleon's French file - like MVPHosts)
http://someonewhocares.org/hosts/ (Dan Pollock's file)
http://cri.univ-tlse1.fr/blacklists/ (Fabrice Prigent - Toulouse University)

8. Put on my PAC filter. It hones years of experience in detecting patterns much the same as what is done with EasyList and EasyPrivacy. But unlike either of those mine started with an effort of curbing porn first, not ads unless they had extremely bad behavior. The PAC filter always had a secondary emphasis of curbing tracking / spying. It is just that now the primary emphasis is stopping malware. Don't let that fool you. Only some of the anti-porn rules were dropped. All porn rules that are left are there not because they stop porn - they stop malware. Their count at Airelle's hosts.rsk and MalwareDomainLists hosts file were too high so they were retained. But it is a rare month that goes by that I don't add anti-tracking rules that will have an impact on lessening the spam that ends up in your email box. Okay, now we have prepared your machine. The rest of the steps are what you do all of the time to lessen spam as opposed to the one-time settings to the machine itself. Just remember to update it frequently - I am always adding new anti-tracker rules. Today (2009-Oct-09) I am adding piwik\.js (which NoScript strips). Here is where my PAC filter is at:

http://www.SecureMecca.com/pac.html
http://www.HostsFile.org/pac.html

9. If you use web-mail, use GMail. They have the best spam filtering in the business. I had to use my GMail account from library computers that didn't have all that nice stuff I just detailed in steps 2 through 8. It gets 200+ spam messages per week. All or almost all of it goes into that spam folder. I am using it to garner URLs out of the email messages that end up with the hosts inside the spam email going into my hosts file. How good is their filtration? It is better than even the Bayesian filtering in the Thunderbird POP / IMAP Mail User Agent (MUA) mail program. Thunderbird or Claws mail are the MUAs I recommend for filtering out the spam in POP / IMAP email accounts. Everybody else except perhaps Apple's Mail.App are running a distant second or third. But your privacy drops considerably with web-mail.

10. Do not put your email address into almost anything on the Internet. Avoid answering questions in forums, using Social network services, etc. I know, it is hard to do, but not getting your email address stuck into spammer's lists in the first place helps.

11. Never respond to any spam email. The surest way to slow the flow of spam would be for everybody to not respond to it. The only reason for a spammer to have an incentive to send the stuff in the first place is because people respond to it. If we could take away all of the responses to spam it would cease. The problem is Phineas T Barnum was correct - a sucker is born every minute. They open the spam and then stupidly respond. Don't do it! Don't respond to the unsubscribe either - all that does is let them know that the email address is being used so that they can sell your email name to other spammers.

12. Don't join any news groups. By that I mean don't join any at all. Curb the impulse until after you have decided they are okay. I belong to quite a few, but all of them are in the computer / network security area. I don't have FaceBook, YouTube, or other accounts (and have no need of them). But in the beginnings I used to belong to the Firewalls and Firewall Wizards news groups before we knew what the spammers were up to. Yes, you can change your email accounts and I have. But that is so far in the past it is my current activity that may end up getting me into these lists. In case you are wondering, I practice what I preach and it does help. I sometimes go almost a week with no spam in my POP email accounts. See step 11 - it works.

13. Do not forward email from these news groups. It may seem great but most people's Windows machines are infected with malware that harvests email addresses. Also, there are reply back mechanisms within email itself that can inform the original sender with the email addresses of the people you forward something on to. I know for a fact that some of the spam in my POP email accounts came from somebody else forwarding something to me. It is bad form to forward anything anyway. Just don't do it.

14. If you have to, once all of the other things have been done here and you still have a problem, abandon your old email address and start over. But do all of these other steps first or you will end up just as bad as where you are at now.

That's it. Just do these things to slow the flow of spam. If you made a mistake and didn't do all of them at once, frequently it is best to abandon the email account and start all over. Just make sure you do the other steps here. I am sure I am missing something. If I can think of what it is I will add it later on.

Redirecting Hosts Files

Proposed: I suggest we change the term blocking hosts files be replaced with the term redirecting hosts files since that is exactly what they do for most people.
After NoScript author Giorgio stated that the 127.0.0.1 in hosts files should be changed to 255.255.255.0 I felt I had to make some comments here. First, he intimated that we were blocking ads. The order of my redirecting hosts file and PAC filter were to redirect in the following hierarchy by priority:
[1] Malware disseminating hosts, hosts that do cross domain cookie setting or something else bad.
[2] Hosts that are actively engaged in tracking
[3] Hosts that were engaged in Pornography since many are also in category 1.
Since almost nobody used what I provided or gave feedback I changed the order of priority to be:
[1] Malware disseminating hosts, hosts that do cross domain cookie setting or something else bad.
[2] Hosts that are actively engaged in tracking
[3] Hosts that were pushing ads. I still advise ABP & EasyPrivacy+EasyList for this for Firefox users.
It isn't as drastic of a change as you think. All of the porn patterns that were identified as high risk by a look at the actual count at MalwareDomainList and my friend Airelle of France, http://rlwpx.free.fr/WPFF/hosts.htm in his hosts.rsk file were retained in the PAC filter. Some needed to be downgraded from URL to host rules. Some of the remaining "porn" rules that are working at the URL level may also need to be downgraded in the future but I do subscribe to the NoScript philosophy of expressly disallow by default, white-list by choice, especially when it comes to hosts that do some particularly nasty stuff.
Now in addressing the change of the 127.0.0.1 to 255.255.255.0, I have only the following to say - do not do it if you are using any but one of the following to handle the redirected requests:
http://sysctl.org/cameleon/
http://preview.tinyurl.com/8ujj9j
http://preview.tinyurl.com/mavx9m
http://www.abelhadigital.com/ (has a program called hostssrv.exe)
http://www.securemecca.com/phttpd.html (only for 'nix machines and I recommend Cameleon)
Almost everybody who uses some sort of redirection mechanism (hosts file, pseudo DNS server, PAC filter, etc.) uses one of these servers to handle the redirection except for AdBlock Plus which rather than blocking them (er, redirecting you to something else) strips them out of the file and then passes that on to the browser. But the only one that is designed to handle them on something other than 127.0.0.1 by default is Cameleon's phttpd. Mine can be used to do that and you could even shift it to a port other than 80 but I would not advise that you do either. The port change would work only for the PAC filter and only if the PAC filter's port is also changed. IOW, you are stuck with port 80. Nobody handles port 443 or 8080 requests. Also, what I have is written in PERL (but it is a true daemon with the double forks and setsid) and IMHO is not up to the level of handling a lot of requests safely. One ponders whether it is safe at all being written in PERL but I don't have time to write one in C and one already exists. I just didn't know about it at the time I wrote mine.
I propose the following change in terminology. knowing full well that the proposal will fail: From henceforth blocking hosts files shall be known as redirecting hosts files. That is because with these phttpds that is precisely what they are doing.
Now, some may think I am angry with NoScript author Giorgio. I am not angry. I still recommend Firefox + NoScript, especially on Windows machines to mitigate some of the problems people have. I still think it is overkill on 'nix machines but the security hole opened up by using Privoxy + PAC filter to allow unrestricted ftp access (and worms and other nasty stuff are now actively utilizing ftp) leaves me no choice - I must recommend NoScript to Windows users. But there are times you have hosts that you don't want to just restrict what they can do. You want no part of them! For these hosts a redirecting hosts file or redirecting PAC filter are your only options until somebody has the time and resources to shrink wrap all of this stuff into the broadband router which is where it should be, especially in a home situation.

Name changes of files

Since I have created these filters we have begun to add the Français language into the mix. It has caused me no ends of grief not to have a consistent naming method. For example, both the Français and Anglais names for the central file is proxy.txt. What is wrong with that? I have to keep track and use different folders for the uploads. Also, I called the debug version of the filter proxy.debug on Unix but dbgproxy.txt on MS Windows. All that is different between proxy.txt and dbgproxy.txt is that one line that turns the debug on. The only difference between dbgproxy.txt and proxy.debug is substituting LFs for CRLFs. Therefore, I am proposing to make the following changes:

1. That file named proxy.debug would become dbgproxy on Unix. We aren't done yet because I haven't addressed the language question yet. In other words, this is the name sans the language version.

2. The only difference between the Unix and Windows files other than the LF versus CRLF will be that Windows files will have the ".txt" extension. Somebody said I should have either ".pac" or ".js" for all of them. Okay, how do you propose we differentiate between MS Windows and Unix versions of the file? These other extensions may be okay but it works with the "*.txt" extension and I have a dandy way of differentiating the Unix and MS Windows files by just dropping the ".txt" extension on Unix. The file name extensions have no meaning on Unix anyway. Unix systems find out all they need to know about what kind of file they have by looking at the permission flags of the file and just "sniffing" the first few bytes of the file and comparing that with the magic database. With the ".txt" extension on MS Windows, people can just double click on the file name and edit it. It is very difficult to tell a novice how to edit the file with these other extensions. I don't worry about the Unix people. I do worry about the Windows people. I told somebody who has been using Windows for the past five years to close the window I had them open several instructions previously only to have them ask me "how do I do that?" Well, you click on the X in the upper right hand corner of the window. It seems like that would be common knowledge after five years. We are not done yet. We still have the language to consider.

3. I have been caught putting Français versions of the files where the Anglais files should be. That may or may not be a Freudian slip. But the mixup occurred because they both have the same name. I am proposing that the downloads and the proxy files themselves have the language version embedded as part of the name. That means for example that the English version of the main install download will become InstallProxyPkg_EN.msw.7z and InstallProxyPkg_EN.unx.7z for Windows and Linux respectively. That makes it match what it is for the Français version which is InstallProxyPkg_FR.msw.7z / InstallProxyPkg_FR.unx.7z. Ditto for the auto updaters AutoPac_FR.msw.7z / AutoPac_FR.unx.7z and AutoPac_EN.msw.7z and AutoPac_EN.unx.7z. If I do that I will put ALL of the download files no matter what language they are in, in a downloads folder.

3. Since I am also proposing that the names of the proxy files themselves contain the language code in their name, the new names then of the proxy files themselves will be:

Anglais:
   MS Windows
      proxy_en.txt
      dbgproxy_en.txt
      pornproxy_en.txt
   Unix
      proxy_en
      dbgproxy_en
      pornproxy_en

Français
   MS Windows
      proxy_fr.txt
      dbgproxy_fr.txt
      pornproxy_fr.txt
   Unix
      proxy_fr
      dbgproxy_fr
      pornproxy_fr

What this will do is make it possible to make Espanol versions available in the future. I will let somebody else handle the other languages. If you have any objections then contact me at hhhobbit frat securemecca.com to tell me what they are. Otherwise this will be the direction I will go. It just became too much without some sort of standardization to do this and keep up with it. In other words, I was doing this already anyway. I was using the Français version of the file one day and didn't notice that I forgot to put on a terminating ";" in the Anglais (Américain) version on one of the new rules I just added. I didn't have a problem, but the English speaking people did have a problem which would have included me when I switched back to English two days later but somebody else caught the SNAFU before then. Unless I hear an objection (now is the time to speak up) I will be working all Christmas and the few days after that on the name changes. I should have everything straightened out and working by 2009. I do NOT have my fingers crossed - that is when I expect it all to be working.

SecureMecca.com & HostsFile.org no longer feature the block of pornography.

Some may lament us no longer blocking Pornography. In fact this is not true. We still have that filter and it is named pornproxy.txt. It is just that no more work is being done on it. This was done for several reasons and they are:

1. It became too much work for only one person to handle. Henry Hertz Hobbit was the only one making the changes with Rodney making suggestions. It is just that the suggestions were to add blocks for ads and assuming a rule may cause problems when in fact most don't. Many new patterns could have been added but doing that required more people to take on the work and nobody stepped up to the plate. One person can only handle a dozen or more experimental rules at a time. I (HHH) was maxed.

2. With over 700,000 porn hosts and climbing to over a million with NOBODY in HHH's personal contacts wishing to help by putting on the filter and reporting back false positives it finally became apparent nobody wanted these blocks. But almost everybody is blocking ads.

WHAT DO WE BLOCK?

1. Hosts that abuse the built-ins and add-ons. This includes but is not limited to: JavaScript, Java, Flash Player, RealPlayer, and ShockWave Player. With the exception of the ShockWave Player not being on Linux, these exploits work equally well (maybe we should say badly?) on all operating systems. Just shifting to Linux doesn't alter the abuse that occurs. You can literally trap somebody in the browser using nothing but JavaScript not allowing them to do anything (except to go to another work-space on Linux and kill the browser in a terminal window). Is that classified as an exploit? Yes!

2. Hosts that track what you do and where you go. At one time some people used the word spies in relationship to these hosts. I (HHH) prefer the term tracker (Fr - traqueur) since that most closely represents what they are doing. Primarily they keep track of what you are doing to tailor the ads that are delivered to you but there are other reasons for what they track. We are dedicated to minimize this tracking of people's use of the Internet. That is why I (Henry Hertz Hobbit) will never access the built-in features to track you at SecureMecca.com and warn you what is being used to track you there that is not under my control.

3. Hosts that infect people's machines. This is almost wholly limited to the Windows OS. Although many people say the problem would be just as bad on Linux or the Macintosh, it wouldn't as long as people didn't do stupid things. It is just as easy to write a trojan for Macs as it is for Windows and you can have it installed if you are salivating over getting the dirt on shocking videos of this or that political personality doing this or that. Hiding the fact that what the Mac owner is using is called sudo doesn't help prevent a user from stupidly installing a program running with admin level access. There is no substitute for knowledge. We are primarily but not exclusively using both Airelle's hosts.rsk file and Malware Domain List's files for looking at these host for patterns for the PAC filter. Some surprising things have already come out from this. WE BLOCK CHINA! THE WHOLE TLD! 10% of the hosts that infect Windows hosts at the MalWare Domain List are in this domain. We also block some porn patterns (we have left one in as a red herring) but again, we are blocking them like we block China because they pass a threshold of going over so many hosts (usually we need at least ten plus hosts at Malware Domain List but a very nasty trojan MAY make a count unnecessary) to invoke that pattern being included.

4. Typo servers or somebody else that is doing something wrong. This is a little bit overly-vague but I don't want to be frozen with something that can't handle newer threats as they fruition and develop. You are just going to have to trust my instinct that somethimg is bad when I see it. Active-X exploits that inject a trojan after the browser has been gagged by do-nothing JavaScript that maxes the CPU is just one of the many other things that come to mind that are seemingly endless.

5. WE NOW BLOCK ADS. Before now, the ad-server had to do something else like spying, etcetera, to be included. That does NOT mean use of our hosts file is to be encouraged. Use somebody else's hosts file for that purpose. What you want from us is the PAC filter. Will our PAC filter match the power of AdBlock Plus filters? Probably not. They have had years to hone their filters and we are just starting. Also, there are some patterns that are more difficult to enter into the PAC filter. What is the advantage? Like a blocking hosts file, the PAC filter is stealthy. Nobody can detect that it is there. You will never get a request from a web site to turn it off.

There you have it. The policy may be refined over time, but this is what it is now for what it is worth. Hey, it works for me & Rodney. If other people find it useful that would be nice to hear but it is primarily something created for ourselves.

Henry Hertz Hobbit