MBAM contraversal IP blocking

MBAM new IP blocking has major flaws. The idea is good but the way it is
executed needs work. The database of IP addresses it uses is the major
problem. MBAM is trusting the source of that list as being accurate without
testing each and every address listed, as it should do, for validity. They
use the list from http://hosts-file.net, that list although updated
regularly is outdated and needs a complete over haul. Currently I estimate
that MBAM blocks more than 10,000 legitimate websites including business
websites and emails. The 10,000 is a very conservative low number. For
example this IP 64.202.189.170 belongs to GoDaddy.com all it is is a
forwarding IP that GoDaddy uses for it's DNS server. Of the millions of
GoDaddy customers who use their forwarding DNS if they install MBAM it will
block access to all of those websites. MBAM does not check content of what
it blocks it just relies on the truthfulness of the files supplied by
hosts-file.net. I am not sure how many other web hosting companies are
listed it this list but I am sure there are more then one. GoDaddy is aware
of this blocking and I am sure they will be contacting MBAM about this so we
will probably be seeing some changes made to MBAM's IP blocking. The concept
is good but it does not work correctly.

Also posted to my blog at http://pcbutts1-therealtruth.blogspot.com/


--
The Real Truth http://pcbutts1-therealtruth.blogspot.com/
*WARNING* Do NOT follow any advice given by the people listed below.
They do NOT have the expertise or knowledge to fix your issue. Do not waste
your time.
David H Lipman, Malke, PA Bear, Beauregard T. Shagnasty, Leythos.

"The Real Truth MVP" <trt@void.com> wrote in
news:lLOdnWUTAMqeuRrXnZ2dnUVZ_uadnZ2d@giganews.com:

> MBAM new IP blocking has major flaws. The idea is good but the way it
> is executed needs work. The database of IP addresses it uses is the
> major problem. MBAM is trusting the source of that list as being
> accurate without testing each and every address listed, as it should
> do, for validity.

Actually, A large majority of the urls submitted are indeed malicious.
And alot of them, are indeed checked.

> They use the list from http://hosts-file.net, that
> list although updated regularly is outdated and needs a complete over
> haul. Currently I estimate that MBAM blocks more than 10,000

Actually, we do not use any such list. The "list" of blocked sites is
compiled daily in house. Where did you get the idea we used anyones host
files?

> legitimate websites including business websites and emails. The 10,000
> is a very conservative low number. For example this IP 64.202.189.170
> belongs to GoDaddy.com all it is is a forwarding IP that GoDaddy uses
> for it's DNS server. Of the millions of GoDaddy customers who use
> their forwarding DNS if they install MBAM it will block access to all
> of those websites. MBAM does not check content of what it blocks it

Ahh, the root of your issue with our software. Are we blocking your site
now? Users always have the option of disabling the IP blocker temporarily
if they still wish to visit a known unsafe site offering stolen/modified
goods.

> just relies on the truthfulness of the files supplied by
> hosts-file.net. I am not sure how many other web hosting companies are
> listed it this list but I am sure there are more then one. GoDaddy is
> aware of this blocking and I am sure they will be contacting MBAM
> about this so we will probably be seeing some changes made to MBAM's
> IP blocking. The concept is good but it does not work correctly.

Again, we don't rely on the truthfulness of any files. We don't have a
central supply of a single source for malicious IP additions. We have
dedicated staff for that purpose. While you may contact Godaddt as often
as you like, They have no control over who/what sites we choose to block.
I'm unsure why you would think otherwise.

Many changes with the IP blocking technology are forthcoming; but none of
those have anything to do with you. :) It's version v1.0 of the ip
blocker.


--
Regards,
Dustin Cook
Malware Researcher
MalwareBytes - http://www.malwarebytes.org

It is not very hard to figure out Dustbin. This IP 64.202.189.170 according
to
http://hosts-file.net/?s=64.202.189.170&view=matches has about 304 known
websites attached to it. That simply is not possible. Right there it points
to a DNS forwarder and a look up shows it belongs to GoDaddy, it DOES NOT
belong to the thousands of websites who use GoDaddy, so when you block it it
also blocks everybody. That's what you call the lazy mans way of doing
things. There have been several queries in the MBAM forums about this IP and
other sites that use it and then low and behold Steve Burns who owns
http://hosts-file.net replies to one of them. Also I never called it a hosts
file, you did. I called it a list because I did not know if it was the hosts
file that you used but you just confirmed it. You guys never checked that IP
address. GoDaddy has a lot more money then MBAM yes they will do something
about it.
BTW I have a modified version of Remove-it that will disable MBAM and
prevent it from blocking one of my websites. I have not incorporated it into
the production version yet. I only send it to people who complain to me
about it blocking one of my sites, that is how I found out about it. If MBAM
does not fix it soon I will use it in my production version.



--
The Real Truth http://pcbutts1-therealtruth.blogspot.com/
*WARNING* Do NOT follow any advice given by the people listed below.
They do NOT have the expertise or knowledge to fix your issue. Do not waste
your time.
David H Lipman, Malke, PA Bear, Beauregard T. Shagnasty, Leythos.




"Dustin Cook" <bughunter.dustin@gmail.com> wrote in message
news:Xns9C68BA5E48793HHI2948AJD832@69.16.185.247...
> "The Real Truth MVP" <trt@void.com> wrote in
> news:lLOdnWUTAMqeuRrXnZ2dnUVZ_uadnZ2d@giganews.com:
>
>> MBAM new IP blocking has major flaws. The idea is good but the way it
>> is executed needs work. The database of IP addresses it uses is the
>> major problem. MBAM is trusting the source of that list as being
>> accurate without testing each and every address listed, as it should
>> do, for validity.
>
> Actually, A large majority of the urls submitted are indeed malicious.
> And alot of them, are indeed checked.
>
>> They use the list from http://hosts-file.net, that
>> list although updated regularly is outdated and needs a complete over
>> haul. Currently I estimate that MBAM blocks more than 10,000
>
> Actually, we do not use any such list. The "list" of blocked sites is
> compiled daily in house. Where did you get the idea we used anyones host
> files?
>
>> legitimate websites including business websites and emails. The 10,000
>> is a very conservative low number. For example this IP 64.202.189.170
>> belongs to GoDaddy.com all it is is a forwarding IP that GoDaddy uses
>> for it's DNS server. Of the millions of GoDaddy customers who use
>> their forwarding DNS if they install MBAM it will block access to all
>> of those websites. MBAM does not check content of what it blocks it
>
> Ahh, the root of your issue with our software. Are we blocking your site
> now? Users always have the option of disabling the IP blocker temporarily
> if they still wish to visit a known unsafe site offering stolen/modified
> goods.
>
>> just relies on the truthfulness of the files supplied by
>> hosts-file.net. I am not sure how many other web hosting companies are
>> listed it this list but I am sure there are more then one. GoDaddy is
>> aware of this blocking and I am sure they will be contacting MBAM
>> about this so we will probably be seeing some changes made to MBAM's
>> IP blocking. The concept is good but it does not work correctly.
>
> Again, we don't rely on the truthfulness of any files. We don't have a
> central supply of a single source for malicious IP additions. We have
> dedicated staff for that purpose. While you may contact Godaddt as often
> as you like, They have no control over who/what sites we choose to block.
> I'm unsure why you would think otherwise.
>
> Many changes with the IP blocking technology are forthcoming; but none of
> those have anything to do with you. :) It's version v1.0 of the ip
> blocker.
>
>
> --
> Regards,
> Dustin Cook
> Malware Researcher
> MalwareBytes - http://www.malwarebytes.org
>
>

The Real Truth MVP wrote:

> It is not very hard to figure out Dustbin. This IP 64.202.189.170 according
> to
> http://hosts-file.net/?s=64.202.189.170&view=matches has about 304 known
> websites attached to it. That simply is not possible.

HAHAHAHAHA!

I see why you are concerned about that IP address! It's yours!
http://uptime.netcraft.com/up/graph?site=ms-mvp.org

On your link above, you're number 62 on the list.

62 ms-mvp.org

BTW, why have you never heard of shared web hosting?

Busted again!

--
-bts
-Friends don't let friends drive Windows

Beauregard T. Shagnasty wrote:
> The Real Truth MVP wrote:
>
>> It is not very hard to figure out Dustbin. This IP 64.202.189.170 according
>> to
>> http://hosts-file.net/?s=64.202.189.170&view=matches has about 304 known
>> websites attached to it. That simply is not possible.
>
> HAHAHAHAHA!
>
> I see why you are concerned about that IP address! It's yours!
> http://uptime.netcraft.com/up/graph?site=ms-mvp.org
>
> On your link above, you're number 62 on the list.
>
> 62 ms-mvp.org
>
> BTW, why have you never heard of shared web hosting?
>
> Busted again!
>

Never a dull moment around here!

--
JD..

Sorry you dumbass I don't have shared web hosting and that IP is not mine.
That IP is NOT a shared webhosting IP. What the **** is wrong with you are
you that stupid that you cannot tell the difference. I guess all the rest of
these are mine too.
http://uptime.netcraft.com/up/graph?site=abvv.com
http://uptime.netcraft.com/up/graph?site=attaboy.com
http://uptime.netcraft.com/up/graph?...colatehope.com

And all the rest at http://hosts-file.net/?s=64.202.189.170&view=matches are
mine too. Every body knows
www.ms-mvp.org gets redirected to
http://www.pcbutts1.com/downloads/tools/tools.htm so tell me smart ass how
is that shared web hosting?



--
The Real Truth http://pcbutts1-therealtruth.blogspot.com/
*WARNING* Do NOT follow any advice given by the people listed below.
They do NOT have the expertise or knowledge to fix your issue. Do not waste
your time.
David H Lipman, Malke, PA Bear, Beauregard T. Shagnasty, Leythos.




"Beauregard T. Shagnasty" <a.nony.mous@example.invalid> wrote in message
news:h67g5e$125$1@news.eternal-september.org...
> The Real Truth MVP wrote:
>
>> It is not very hard to figure out Dustbin. This IP 64.202.189.170
>> according
>> to
>> http://hosts-file.net/?s=64.202.189.170&view=matches has about 304 known
>> websites attached to it. That simply is not possible.
>
> HAHAHAHAHA!
>
> I see why you are concerned about that IP address! It's yours!
> http://uptime.netcraft.com/up/graph?site=ms-mvp.org
>
> On your link above, you're number 62 on the list.
>
> 62 ms-mvp.org
>
> BTW, why have you never heard of shared web hosting?
>
> Busted again!
>
> --
> -bts
> -Friends don't let friends drive Windows

"The Real Truth MVP" <trt@void.com> wrote in
news:TeqdneDO7szzoBrXnZ2dnUVZ_u-dnZ2d@giganews.com:

> It is not very hard to figure out Dustbin. This IP 64.202.189.170
> according to

It's Dustin, Chris... thanks.

> http://hosts-file.net/?s=64.202.189.170&view=matches has about 304
> known websites attached to it. That simply is not possible. Right
> there it points to a DNS forwarder and a look up shows it belongs to
> GoDaddy, it DOES NOT belong to the thousands of websites who use
> GoDaddy, so when you block it it also blocks everybody. That's what

In all fairness to you, I didn't know we blocked that IP address. I just
confirmed that your right in the sense we do tho. I'll pass along your
concern to those directly in control of the IP blocking.

Oh wait, see below.. :)

> you call the lazy mans way of doing things. There have been several
> queries in the MBAM forums about this IP and other sites that use it
> and then low and behold Steve Burns who owns http://hosts-file.net
> replies to one of them. Also I never called it a hosts file, you did.

Steven Burns is on the MBAM payroll now, Chris. In fact, I turn over my
daily url lists to him. He's one of the individuals responsible for the
IP blocking process. This might explain why you have an issue with this
IP... eh? :) I don't think I'll be able to change anyone's mind about
Godaddys anonymous forwarding service. That's right, lets be entirely
honest about the IP you chose. It allows individuals such as yourself to
register a website, and hide his or her ownership of said site. I'm sure
there are legitimate reasons for doing this, but the majority of sites
known to use it are malware sites. As such, it's blocked. It just so
happens to be a two for one. It kills your site, and the sites it's
intended for. *grin*.

> I called it a list because I did not know if it was the hosts file
> that you used but you just confirmed it. You guys never checked that
> IP address. GoDaddy has a lot more money then MBAM yes they will do
> something about it.

I just told you, and I'll tell you again, We don't use any single list
for the IP blocking. I process several thousand urls every 24 hours, and
those amongst thousands more are potentially added to our database which
is compiled daily in house from a variety of sources. Again, in simple
english: We don't have a hosts file, we don't use a hosts file or a
central list maintained by any one person.

On to the GoDaddy point. Seriously, this has nothing to do with who has
more or less money. We are free to block whichever sites we wish to deny
access to. Godaddy nor your ISP or mine for that matter can dictate that
we may or may not block such and such site. The site blocking is at our
discretion, not yours, and not your website hosting providers.

> BTW I have a modified version of Remove-it that will disable MBAM and
> prevent it from blocking one of my websites. I have not incorporated
> it into the production version yet. I only send it to people who
> complain to me about it blocking one of my sites, that is how I found
> out about it. If MBAM does not fix it soon I will use it in my
> production version.

That's very professional of you Chris. I am also responsible for
antipiracy measures, and counter productive measures taken against our
software by malicious parties. I would love a valid reason to target
practice every piece of stolen crap your site has, Please do provide the
reason to let me loose on you.

--
Regards,
Dustin Cook
Malware Researcher
MalwareBytes - http://www.malwarebytes.org

"Beauregard T. Shagnasty" <a.nony.mous@example.invalid> wrote in
news:h67g5e$125$1@news.eternal-september.org:

> The Real Truth MVP wrote:
>
>> It is not very hard to figure out Dustbin. This IP 64.202.189.170
>> according to
>> http://hosts-file.net/?s=64.202.189.170&view=matches has about 304
>> known websites attached to it. That simply is not possible.
>
> HAHAHAHAHA!
>
> I see why you are concerned about that IP address! It's yours!
> http://uptime.netcraft.com/up/graph?site=ms-mvp.org

Evidently so. What's really funny, I didn't know we blocked him for sure
until he mentioned it.

If he makes good on his threat to disable our software with his program
however, I will certainly gain the required permission to incorporate my
anti-pcbutts definitions. *grin*. The balls in his court.



--
Regards,
Dustin Cook
Malware Researcher
MalwareBytes - http://www.malwarebytes.org

"The Real Truth MVP" <trt@void.com> wrote in
news:Te6dnUycT8W_wxrXnZ2dnUVZ_hSdnZ2d@giganews.com:

> http://www.pcbutts1.com/downloads/tools/tools.htm so tell me smart ass

Which, as of definitions file 2632 we don't block access to this site.
I am fairly certain however, if you do decide to release a program of any
sort designed intentionally to cripple or disable our program in any way;
Not only will MBAM have anti pcbutts routines, but I will restore those in
BugHunter as well. It's also possible you might irk our legal dept; and
unlike those who haven't had the funds to come after you, Malwarebytes may.
:)




--
Regards,
Dustin Cook
Malware Researcher
MalwareBytes - http://www.malwarebytes.org

Let you loose? I just might do that, it will be fun considering that
everyone thinks I stole it I should not be able to change a thing. About
GoDaddy it is not about what you block it is about why you block it. Telling
people it is blocked because it is malicious when the address it self is not
is defamation.


--
The Real Truth http://pcbutts1-therealtruth.blogspot.com/
*WARNING* Do NOT follow any advice given by the people listed below.
They do NOT have the expertise or knowledge to fix your issue. Do not waste
your time.
David H Lipman, Malke, PA Bear, Beauregard T. Shagnasty, Leythos.




"Dustin Cook" <bughunter.dustin@gmail.com> wrote in message
news:Xns9C68DBDBDDA28HHI2948AJD832@69.16.185.250...
> "The Real Truth MVP" <trt@void.com> wrote in
> news:TeqdneDO7szzoBrXnZ2dnUVZ_u-dnZ2d@giganews.com:
>
>> It is not very hard to figure out Dustbin. This IP 64.202.189.170
>> according to
>
> It's Dustin, Chris... thanks.
>
>> http://hosts-file.net/?s=64.202.189.170&view=matches has about 304
>> known websites attached to it. That simply is not possible. Right
>> there it points to a DNS forwarder and a look up shows it belongs to
>> GoDaddy, it DOES NOT belong to the thousands of websites who use
>> GoDaddy, so when you block it it also blocks everybody. That's what
>
> In all fairness to you, I didn't know we blocked that IP address. I just
> confirmed that your right in the sense we do tho. I'll pass along your
> concern to those directly in control of the IP blocking.
>
> Oh wait, see below.. :)
>
>> you call the lazy mans way of doing things. There have been several
>> queries in the MBAM forums about this IP and other sites that use it
>> and then low and behold Steve Burns who owns http://hosts-file.net
>> replies to one of them. Also I never called it a hosts file, you did.
>
> Steven Burns is on the MBAM payroll now, Chris. In fact, I turn over my
> daily url lists to him. He's one of the individuals responsible for the
> IP blocking process. This might explain why you have an issue with this
> IP... eh? :) I don't think I'll be able to change anyone's mind about
> Godaddys anonymous forwarding service. That's right, lets be entirely
> honest about the IP you chose. It allows individuals such as yourself to
> register a website, and hide his or her ownership of said site. I'm sure
> there are legitimate reasons for doing this, but the majority of sites
> known to use it are malware sites. As such, it's blocked. It just so
> happens to be a two for one. It kills your site, and the sites it's
> intended for. *grin*.
>
>> I called it a list because I did not know if it was the hosts file
>> that you used but you just confirmed it. You guys never checked that
>> IP address. GoDaddy has a lot more money then MBAM yes they will do
>> something about it.
>
> I just told you, and I'll tell you again, We don't use any single list
> for the IP blocking. I process several thousand urls every 24 hours, and
> those amongst thousands more are potentially added to our database which
> is compiled daily in house from a variety of sources. Again, in simple
> english: We don't have a hosts file, we don't use a hosts file or a
> central list maintained by any one person.
>
> On to the GoDaddy point. Seriously, this has nothing to do with who has
> more or less money. We are free to block whichever sites we wish to deny
> access to. Godaddy nor your ISP or mine for that matter can dictate that
> we may or may not block such and such site. The site blocking is at our
> discretion, not yours, and not your website hosting providers.
>
>> BTW I have a modified version of Remove-it that will disable MBAM and
>> prevent it from blocking one of my websites. I have not incorporated
>> it into the production version yet. I only send it to people who
>> complain to me about it blocking one of my sites, that is how I found
>> out about it. If MBAM does not fix it soon I will use it in my
>> production version.
>
> That's very professional of you Chris. I am also responsible for
> antipiracy measures, and counter productive measures taken against our
> software by malicious parties. I would love a valid reason to target
> practice every piece of stolen crap your site has, Please do provide the
> reason to let me loose on you.
>
> --
> Regards,
> Dustin Cook
> Malware Researcher
> MalwareBytes - http://www.malwarebytes.org
>
>

"The Real Truth MVP" <trt@void.com> wrote in
news:tuudnSHx_cfN-hrXnZ2dnUVZ_gidnZ2d@giganews.com:

> Let you loose? I just might do that, it will be fun considering that
> everyone thinks I stole it I should not be able to change a thing.

I don't think anyone has claimed you couldn't edit a script/batch/plain
text (laugh laugh) file. In fact, many of us have said you can do that;
you have, You copied/pasted your name and site over the original authors
text. So I firmly believe it's trivial for you to add another line or two
to a text file.

> About GoDaddy it is not about what you block it is about why you block
> it. Telling people it is blocked because it is malicious when the
> address it self is not is defamation.

Which site specifically is it you have a problem with us blocking? As you
said, this IP covers a variety; and as you have been told in the forums
(hint: don't copy and paste a paragraph of your post here word for word
into the forum and expect me not to notice it's you, stupid.) so, I
really don't know which site in particular you were complaining about.
Reference link:
http://www.malwarebytes.org/forums/i...69&st=0&gopid=
110583&#entry110583


Second of all, I have taken the liberty of taking the first pre-emptive
shot, as I don't have time for a pissing contest. You have made a vieled
threat against malwarebytes, so we've decided to go ahead and protect our
userbase from your site and software. You are welcome to have that
hosting provider contact us too, if you'd like. The answer as you were
already given on the forums will be the following:

As far as the IP itself, given the domains referenced, resolve to the IP
address, it would have to be taken up with GoDaddy as to why it does so,
as many of the sites hosted by them, resolve to any number of IP's within
their range. Until GoDaddy shut down the malicious domains on this IP
(and yep, I've reported them many many times), I cannot unblock it.




--
Regards,
Dustin Cook
Malware Researcher
MalwareBytes - http://www.malwarebytes.org

Like I said it was brought to my attention and I am not the only one
complaining. This guy says it a little better then I did
http://www.malwarebytes.org/forums/i...howtopic=21383



--
The Real Truth http://pcbutts1-therealtruth.blogspot.com/
*WARNING* Do NOT follow any advice given by the people listed below.
They do NOT have the expertise or knowledge to fix your issue. Do not waste
your time.
David H Lipman, Malke, PA Bear, Beauregard T. Shagnasty, Leythos.




"Dustin Cook" <bughunter.dustin@gmail.com> wrote in message
news:Xns9C68E42DE8C35HHI2948AJD832@69.16.185.247...
> "The Real Truth MVP" <trt@void.com> wrote in
> news:tuudnSHx_cfN-hrXnZ2dnUVZ_gidnZ2d@giganews.com:
>
>> Let you loose? I just might do that, it will be fun considering that
>> everyone thinks I stole it I should not be able to change a thing.
>
> I don't think anyone has claimed you couldn't edit a script/batch/plain
> text (laugh laugh) file. In fact, many of us have said you can do that;
> you have, You copied/pasted your name and site over the original authors
> text. So I firmly believe it's trivial for you to add another line or two
> to a text file.
>
>> About GoDaddy it is not about what you block it is about why you block
>> it. Telling people it is blocked because it is malicious when the
>> address it self is not is defamation.
>
> Which site specifically is it you have a problem with us blocking? As you
> said, this IP covers a variety; and as you have been told in the forums
> (hint: don't copy and paste a paragraph of your post here word for word
> into the forum and expect me not to notice it's you, stupid.) so, I
> really don't know which site in particular you were complaining about.
> Reference link:
> http://www.malwarebytes.org/forums/i...69&st=0&gopid=
> 110583&#entry110583
>
>
> Second of all, I have taken the liberty of taking the first pre-emptive
> shot, as I don't have time for a pissing contest. You have made a vieled
> threat against malwarebytes, so we've decided to go ahead and protect our
> userbase from your site and software. You are welcome to have that
> hosting provider contact us too, if you'd like. The answer as you were
> already given on the forums will be the following:
>
> As far as the IP itself, given the domains referenced, resolve to the IP
> address, it would have to be taken up with GoDaddy as to why it does so,
> as many of the sites hosted by them, resolve to any number of IP's within
> their range. Until GoDaddy shut down the malicious domains on this IP
> (and yep, I've reported them many many times), I cannot unblock it.
>
>
>
>
> --
> Regards,
> Dustin Cook
> Malware Researcher
> MalwareBytes - http://www.malwarebytes.org
>
>

The Fake Truth Not-an-MVP wrote:

> Sorry you dumbass

Aah. Back to your normal self now...

> I don't have shared web hosting and that IP is not mine.

Of course not; it's the Godaddy stealth redirection.

--
-bts
-Friends don't let friends drive Windows

The Real Truth MVP wrote:
> Like I said it was brought to my attention and I am not the only one
> complaining. This guy says it a little better then I did
> http://www.malwarebytes.org/forums/i...howtopic=21383
>
>
>

Seriously dude, there may be something wrong with you.

You may be suffering from Megalomania:

Megalomania is a historical term for behavior characterized by
delusional fantasies of wealth, power, genius, or omnipotence — often
generally termed as delusions of grandeur.

http://en.wikipedia.org/wiki/Megalomania


And you may be in denial. Denial is not a river in Africa.

Denial is a defense mechanism postulated by Sigmund Freud, in which a
person is faced with a fact that is too uncomfortable to accept and
rejects it instead, insisting that it is not true despite what may be
overwhelming evidence.

Proper treatment will get you the help you need.

--
JD..

Beauregard T. Shagnasty wrote:
> The Fake Truth Not-an-MVP wrote:
>
>> Sorry you dumbass
>
> Aah. Back to your normal self now...
>

The "nice professional" pcbutts was too good to last.