It’s been said that as computers simply process data they are incapable of lying, but ever since HAL 9000 started murdering its crew in 2001: A Space Odyssey I’ve never trusted them. Simply put – while they may follow clear rules and be incapable of deviating from a set of instructions, if those instruction are telling them to lie, then lie they will.
Take for example one we see quite often : “Your Computer
has 2,120 Viruses on it. Do you want Windows Antivirus 2013 to remove them?”.
Or the infamous “Metropolitan Police: Attention! Illegal
activity was revealed! Your operational system is locked as a result of Great
Britain law violation!”. I mean – seriously – would the police really use that
many exclamation marks?
But malware excepted, our operating systems regularly
deceive us in order to improve the ‘user experience’ by concealing information
from us. One feature of all PC operating systems since windows XP has been the
default behaviour of hiding file extensions from us. The extensions usually take
the form of a dot with three letters, so a program would typically be called
‘program.exe’, but all Windows shows us is ‘program’.
This feature has regularly been exploited by malware authors
– typically by attaching files that we see as something like ‘report.doc’ when
in fact the file is really called ‘report.doc.vbs’, where vbs indicates a
script that will run and probably compromise your PC if you try to open it.
Before Mac users get all smug, I’d like to point out that
there’s another piece of subterfuge that has been built into operating systems
since the days of ARPANET and actually predates the mechanisms of networking
and the internet itself. It’s on your Mac. It’s on your PC. It’s probably on
your iPad too if only you could access the file system to find it. Welcome to
the hosts file.
When you clicked on the link to load this web page a bunch
of clever things happened. The link, blogger.com, was converted to a network
address that is a 32-bit binary number which for ease of reading we convert
into human-readable notation. For blogger.com this is 173.194.78.191. Your computer knows that
Blogger.com resides at this network address thanks to the magic of The DomainName System (DNS) which you can think of as a huge distributed telephone
directory of every computer or network device on the internet. This is a
complex but interesting subject that I’m not going to explain in detail, but
click though the links if you want to know more.
In the beginning, though when the earliest computers wanted
to communicate by TCP/IP, there was no automated directory. Instead, just as
the earliest telephone exchanges were operated manually, so a single file was
used to maintain the directory of computers and network addresses. When you
imagine that we are talking about tens or dozens of computers then you will
see that it made perfect sense to manually create and maintain this system.
And the name of that file was ‘hosts’. No file extension.
If you want to look for your hosts file and you use a PC you should find
it at C:\Windows\system32\drivers\etc\hosts ; on a MAC look in private/etc/hosts. I regularly look here if I’m working on an infected computer because it’s
a simple and effective way for malware authors to hijack network traffic, so
last week it was one of the first places I looked. I double clicked on the
hosts file – as it has no file extension I usually have to select notepad to
open it, but this time it obligingly opened in notepad without me having to do
this. This struck me as very slightly odd, but the penny didn’t drop just then.
The hosts file was clean, and I removed the malware without a hitch, expecting
this to resolve the browser pop-ups that were irritating the hell out of my
client.
I really thought I‘d cracked it and was preparing to leave
when suddenly, against all expectations,
a pop-up appeared bottom left of the web page I was testing. I delved a
little deeper in to page code, and it seemed as if the problem was being caused
by, of all things, the Google Analytics hooks that were embedded in the code of
the web page. Could Google themselves have been compromised? Then, thankfully,
the penny dropped.
I returned to the hosts file in Windows Explorer, switched
on file extensions, and also asked it to show hidden and system files. All was
revealed. The hosts file I had looked at had a .txt file extension that had been hidden from me. This is why
it had opened in notepad without prompting. Alongside it was the real hosts
file; this one was flagged as hidden and marked as a system file, meaning that
windows would normally hide it from me. The file was also flagged as read-only
and locked down to be as difficult to access as possible, but once I knew what
I was dealing with it was a simple case of firing up the command prompt, changing permissions and
attributes to return the file to normal, and in a minute or so it I was able to open it to
reveal…. nothing.
Seriously, after all that trouble the hosts file looked to
be devoid of any spurious entries. For a full minute I failed to spot the
scroll bar on the right. Then the second penny dropped, and I actually laughed.
About a thousand lines of blank space below the standard hosts file entries I
found half a dozen entries that were telling the PC that the network addresses for
Google Analytics, as well some other embedded features were actually a server
in China. Honestly. With a few deft
keystrokes these lies were gone, and the problem was solved.
So the moral of the story is that our computers do lie to
us. They do so all the time, and it’s usually to make things easier for us as
computers are insanely complicated, and the networks they connect to are
unimaginably huge. It’s important to remember
this – particularly if you work in our field, because once in a while
you need to unravel some of these lies to get to the root of the problems.
If you’re an end user you probably think the hosts file is
of absolutely no interest to you. But consider the dilemma of a parent who
wants to keep their child away from Facebook, for example. By navigating to
C:\Windows\system32\drivers\etc\, opening the hosts file in notepad, and adding
the line ‘127.0.0.1 www.facebook.com’, then restarting the PC they can block this page. This works for Macs too, see above for the location of the hosts file. And iIn the unlikely event that their child manages to
discover this little trick the parents should immediately contact Computer Angels so that I can offer their child an internship.