1

I pinged one site (not from my network), then I added IP of this site to my hosts file in the same lines with my localhost, local IP address and my router address (like below)

ip of that site  my localhost adress      

ip of that site  my router adress

ip of that site  my local ip adress

Then entered this IP of that website in browser. Some time later, I typed netstat-a and I saw this:

TCP    [::1]:445              MYCOMPUTER:50016  ESTABLISHED

TCP    [::1]:50016            MYCOMPUTER:microsoft-ds  ESTABLISHED

My OS is Windows 10. I never had file and printer sharing enabled, and my computer never was in any group. It is possible that someone from that IP accessed my computer?

5
  • 1
    Please explain why you would add those entries. I'm having trouble understanding your partial sentences, so without seeing the entries you are trying to describe, it is difficult to tell what you have done, but it seems like a flawed idea. you would never ever alias a remote host as localhost, Oct 13 '16 at 17:22
  • No, that seems like your own software making the connection, not a remote one. Oct 13 '16 at 17:32
  • 1
    ::1 is IPv6 localhost...
    – Ramhound
    Oct 13 '16 at 17:34
  • I know that adding these entries was not the smartest thing. I cannot explain why i did this. But after i saw these "microsoft-ds" entries in netstat i was realy worried. Oct 13 '16 at 17:44
  • @superguest_151 - It isn't clear what you added exactly. So I can't comment, on if you should have modified the file, or kept the file the way it was. I do know that the connecitons being made are harmless because localhost is the macine itself.
    – Ramhound
    Oct 13 '16 at 21:33
1

Editing hosts file, just makes a name respond with that IP. for example doing this

127.0.0.1 facebook.com

will mean when you type facebook.com it will go to the ip address 127.0.0.1 (which is your local computer).

However for example, if facebook.com is actually IP 56.43.32.123 and you type that IP in the browser it will actually take you to the facebook site.

All hosts file does is give a mapping of an IP address to a domain name, just like you give the phone number a contact name. The number is the real information the name just a label. I hope that explains it.

0
0

No probably not, unless the site listed distributes malware, and you have visited it.

Generally speaking, if an attacker modifies a host file, its for the purpose of tricking a user into going somewhere unexpected, often without knowning it (for instance a phishing site).

No other computer will read your host file, so having bad or malicious entries in it can only hurt your computer by using them. That said however, by aliasing the remote site as your localhost, your monitoring and logging software may no longer accurately record what IP was actually responsible for a connection.

Your log is saying that localhost (::1) initiated the connection, so it could be that netstat is confused by the alias you provided in your hosts file, but it would most likely print the real IP or the alias name you entered. ::1 is shorthand for 127.x.y.z, so its an IP not a name.

Also, note that unlike older versions of windows, it is not required that you explicitly install MS File and Print Sharing services. They are built in now, and you must explicitly remove them if you want to disable their functionality.

1
  • No that wasn't any suspicious website. I was really worried because i never saw these entries in netstat before editing hosts file. After restart computer these entries gone. Oct 13 '16 at 18:02
0

Is it possible that i gave someone access to my my computer by messing with hosts file?

No. The hosts file is only to resolve outgoing DNS requests and overrides the public DNS servers.

How does this affect my security?

It doesn't at all, because this is only outgoing traffic, not incoming. Whenever you request the ip address of a domain name, the ip address in the hosts file is returned instead of what it really is unless of course they are the same, then it doesn't matter.

In terms of your question and opening ports, this means, that it doesn't matter what entry you specify in the hosts file, it does not affect incoming traffic in any way, because its scope is only your computer, and only outwards.

Netstat

Netstat shows ::1 which means it is responding to localhost through the IPv6 protocol. If it had a connection to a different site, it would've shown the remote ip (IPv4 or IPv6) address instead.

1
  • good point, ::1 doesn't just mean that the name is 'localhost' but that the signal came from the loopback adapter. its an IP, not a name at all, so how could the hosts file affect it. Oct 13 '16 at 17:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.