5

I'm having issues accessing sites like Pastebin.com or The Pirate Bay from my Windows 10 system. The browser times out. I tried different browsers (Brave, Edge, Chrome, Firefox) and also created a new user profile in Windows - the same result.

Other systems in my network have no issues accessing these sites. I'm also able to access these sites from that PC when I boot Linux on the system.

This shows that there's no filtering being done on the router or at the ISP level - else, other systems should also not reach those sites.

Any ideas what I might look for?

0

1 Answer 1

5

TL;DR

You can't access the websites because your hosts file was changed, redirecting the website addresses to wrong IPs resulting them being inaccessible.


The computer file hosts is an operating system file that maps hostnames to IP addresses. It is a plain text file. Originally a file named HOSTS.TXT was manually maintained and made available via file sharing by Stanford Research Institute for the ARPANET membership, containing the hostnames and address of hosts as contributed for inclusion by member organizations. The Domain Name System, first described in 1983 and implemented in 1984,1 automated the publication process and provided instantaneous and dynamic hostname resolution in the rapidly growing network. In modern operating systems, the hosts file remains an alternative name resolution mechanism, configurable often as part of facilities such as the Name Service Switch as either the primary method or as a fallback method.

from Wikipedia

For Windows systems, the hosts file is located at C:\Windows\System32\drivers\etc\hosts, it contains a mapping of website addresses to internet protocol addresses.

Computers don't understand website addresses, they only understand ones and zeros, so we need to convert website addresses to IPv4 addresses so that computers can know where to connect to.

An IPv4 address is a 4 byte (32 bit) binary number splitted into 4 numbers with each number one byte long, they are separated by dots, thus limiting total addresses to 4294967296.

enter image description here

To convert IPv4 to 4 byte number, from left to right:

16777216*$ip.split('.')[0]+65536*$ip.split('.')[1]+256*$ip.split('.')[2]+$ip.split('.')[3]

To convert 4 byte to IPv4, though, this is harder:

$byte1=[math]::floor($number/16777216)
$number=$number % 16777216
$byte2=[math]::floor($number/65536)
$number=$number % 65536
$byte3=[math]::floor($number/256)
$number=$number % 256
"{0}.{1}.{2}.{3}" -f $byte1,$byte2,$byte3,$number

The above are examples of converting IPv4 in PowerShell, it is easy to understand, really, though I have to admit I can't quickly convert the values within a second, computers can, however I understand website addresses but computers don't.

IP addresses to computers are like names to humans; Websites are like books owned by computers. A book might be owned by many people, a person can have many books, but names are unique to each person(at least theoretically), there is a one to one correspondence between people and names. Note that IP addresses are really unique to each computer. We don't call someone by the name of a book they own, instead we call someone by their name. Computers work similarly. If you want to visit a website, you have to communicate with the computer who owns the book to read the book.

So we have DNS servers to tell computers which computer to connect to when we access a web address. DNS servers record which IP address a website is hosted on(who owns the book), and tells the computer to communicate with the computer the IP address points to.

Computers have no idea where the website is really located at and the authenticity of the answer, they just go to the IP address they are told, so if the wrong IP address is answered you can't go to the website(because the website isn't hosted in the machine that the wrong IP points to and the webpages don't exist in the machine that is associated with the wrong IP). This is called DNS spoofing, delibrately making DNS servers answer false IPs when questioned about certain websites so as to block these websites. This technique is used extensively by the GFW, to ban some websites like Wikipedia and DeviantArt(not all blocked websites are blocked by this technique).

There is a simple way to combat DNS spoofing: changing hosts. When accessing a website, computers will check if the website's address is present in hosts file, they will only query DNS servers if the address is not present in the hosts file; If they found the address in the hosts file, they will access the address found in hosts file and will not query DNS servers. So if the right IP is inside the hosts file the DNS servers' wrong answers will not block you from accessing certain websites. The right IPs are found by online DNS lookup.

However, the hosts file can be exploited, too.

You can use the hosts file to block a website in this way:

127.0.0.1 www.contoso.com

Some programs (especially malwares and antimalwares) can also do this.

Again, the computer has no way to tell if the IP is right or if you want to block a site, they just comply.

Because of this, almost all anti-virus and anti-malware softwares(at least that I know of) will prevent the hosts file from being changed, while they will change the hosts file themselves to block some websites to "protect" the user for "security" reasons, so if you want to dabble in hosts file, uninstall the so called anti-virus softwares first.

0

Not the answer you're looking for? Browse other questions tagged .