16

Unchecking Enable phishing and malware protection in Chrome's browser settings page does not prevent Chrome from communicating with safebrowsing.clients.google.com and safebrowsing-cache.google.com (according to packets captured using Wireshark).

How can I disable this feature?

3 Answers 3

10

You could edit your hosts file, which will block the traffic. Maybe there is a less brute force way, but I'm sure this will work.

Add the following to your hosts file in Linux and Windows:

127.0.0.1 safebrowsing.clients.google.com
127.0.0.1 safebrowsing-cache.google.com

Add the following to your hosts file in OSX:

0.0.0.0 safebrowsing.clients.google.com
0.0.0.0 safebrowsing-cache.google.com

Your hosts file is found at the following location:

  • Windows XP and later: c:\windows\system32\drivers\etc\hosts
  • Linux: /etc/hosts
  • OSX: /private/etc/hosts

More information: http://en.wikipedia.org/wiki/Hosts_%28file%29

Mac OSX information added from JTM's answer to ensure everyone seeing this gets the correct information.

3
  • 1
    Fun fact: Google still uses other firm's ad-servers to pass on info about you if you block them or attempt to disable these services.
    – user64406
    Commented Jan 24, 2011 at 15:06
  • 2
    That is a fun fact, do you have any proof to back up the claim, out of interest? I'd like to see how they accomplish this and work on blocking them too...:)
    – Paul
    Commented Jan 25, 2011 at 0:11
  • Well, all since "goog" forensic analysis posts tend to "get disappeared" - all I can tell you is that proxy logs are your friend.
    – user64406
    Commented Jan 27, 2011 at 19:40
8

Adding 127.0.0.1 for safebrowsing-clients.google.com or safebrowsing-cache.google.com does not help. I did just that and according my suricata logs it is still pointing to the Google's real addresses, so browser does not use hosts file for that. I also tcpdumped the whole C-class where it previously pointed and still there is traffic to these addresses while I request totally different web sites.

However string match in iptables does the trick:

iptables -I FORWARD -m string --to 41 --algo bm --string 'safebrowsing-clients' -j GOOGLE
iptables -I FORWARD -m string --to 41 --algo bm --string 'safebrowsing-cache' -j GOOGLE
iptables -I GOOGLE -m string --to 80 --algo bm --string 'google' -j DROP

So a bit awkward and works only in Linux, but it works.

5

In response to Paul's post, the OS X file is /private/etc/hosts. Don't use 127.0.0.1 on OS X. Use 0.0.0.0. You want it to return no route, not a route to the localhost.

0.0.0.0 safebrowsing.clients.google.com
0.0.0.0 safebrowsing-cache.google.com

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .