Paul Payton wrote:
If your wanting to block specific urls on a local machine, there are
quite a few ways, each has it’s advantages and drawbacks.
1.) Create an LSP filter - effective but flaky and a poorly documented
interface. Most adware/spyware apps
will most likely attack it.
2.) To use a bad word, ‘hook’ GetHostByName. There is a simple example
of doing this on codeproject
that uses the MS detours library, but you’ll have licensing issues there.
3.) IPHLPAPI.DLL exports several functions that can be used to block
domains (after resolving the IP),
PfAddFiltersToInterface for example. I tried this method, but after a
few thousand IP’s, no error, but
failure occurred and it no longer worked.
4.) Usermode service resolves names to IP’s, then passes the IP via
IOCTL to a filter hook driver to
drop the connection (not recommended - don’t think this type of driver
is even supported in Vista?).
5.) As Anton recommended, NDIS intermediate driver - would work but
would be a pain in the ass
it implement (in my view - haven’t played around a lot in this area).
6.) HTTP loop-back proxy - easy but limited. Browser config required.
7.) DNS loop-back proxy - was a pain in the ass for reasons I can’t
remember other than fighting Indy 10’s
dns server component. Never could figure out it’s interface fully
regarding zone files etc… I did get it looping back
for name resolution, just got lost in what I was trying and my A.D.D.
lead me to something else of greater
interest.
8.) BHO - very effective but only works with IE… I figure FF supports
something like this, never really looked
into it.
9.) service to install and update the HOSTS file daily. Works, but on
some systems after you get a few hundred
entries the system begins lagging if you don’t disable “dns client
services”.
As you can see, all of these possibilities suck for the most part. If
you have a local database of URLS to block,
and you want it to be browser/app agnostic and look for keywords within
the url, I think the hooking
approach is really your best method. Yes hooking is evil, but in
usermode it isn’t as bad as in the kernel.
Just some ideas for you to think about. I’m sure others on this list
might have some comments on these 9
approaches - or possible other ways which I’d love to hear about.
Good luck and Get Rich,
Matt
This is probably the wrong place to ask this, I don’t know.
I run an internet filtering company.
I am interested in client side DNS Hijacking.
The reason is… we could implement an internet filter through DNS that
would be lighting fast.
Is it possible to force a DNS to be used for all connections on computer
using a client piece?
The client could also then have specific additions for the computer, maybe
use a different dns for certain domain names that should not be blocked.
The client could also do some keyword filtering in urls maybe.
Who should I talk to about developing this?
Paul Payton
Clean Internet
cleaninternet.com
NTDEV is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
