I’m exhausted. I just spent the last two hours chasing
a goose that I have been after on-and-off for the past year. Here is the goal, put as succinctly as possible.
Step 1: HOSTS File:
127.0.0.5 NastyAdServer.com
127.0.0.5 xssServer.com
127.0.0.5 SQLInjector.com
127.0.0.5 PornAds.com
127.0.0.5 OtherBadSites.com
…
Step 2: Apache httpd.conf
<VirtualHost 127.0.0.5:80>
ServerName adkiller
DocumentRoot adkiller
RewriteEngine On
RewriteRule (\.(gif|jpg|png|jpeg)$) /p.png [L]
RewriteRule (.*) /ad.htm [L]
</VirtualHost>
So basically what happens is that the HOSTS file redirects designated domains
to the localhost, but
to a specific loopback
IP address. Apache listens for any requests on this address and serves either
a transparent pixel graphic, or else an empty HTML file. Thus, any page or graphic on any of the bad sites is replaced with nothing (in other words an ad/malware/porn/etc. blocker).
This works great as is (and has been for me for years now). The problem is that these bad things are no longer limited
to just HTTP traffic. For example:
<script src="http://NastyAdServer.com:99">
or
<iframe src="https://PornAds.com/ad.html">
or
a Trojan using
ftp://spammaster.com/
[email protected];
[email protected];
[email protected]
or an app “phoning home” with private info in
a crafted ICMP packet by pinging
CardStealer.ru:99
Handling HTTPS is
a relatively minor bump. I can create
a separate VirtualHost just like the one above, replacing port 80 with 443, and adding in SSL directives. This leaves the other ports
to be dealt with.
I tried using * for the port, but then I get overlap errors. I tried redirecting
all request
to the HTTPS server and visa-versa but neither worked; either the SSL requests wouldn’t redirect correctly or else the HTTP requests gave the You’re speaking plain HTTP
to an SSL-enabled server port… error. Further, I cannot figure out
a way
to test if other ports are being successfully redirected (I could try using
a browser, but what about FTP, ICMP, etc.?)
I realize that I could just use
a port-blocker (eg ProtoWall, PeerBlock, etc.), but there’s two issues with that. First, I am blocking domains with this method, not
IP addresses, so
to use
a port-blocker, I would have
to get each and every domain’s
IP, and update theme frequently. Second, using this method, I can have Apache keep logs of
all the ad/malware/spam/etc. requests for future analysis (my current AdKiller logs are already 466MB right now).
I appreciate any help in successfully setting up an Apache VirtualHost blackhole. Thanks.
