Malware hosts protection.

Index.

• Introduction.
• The script.

 18-Feb-2014: initial release.

 

Introduction.

On the website malwaredomains you can find a regular updated Malware Domain Blocklist. You can add this list to the name server that runs on your home server, so that it will block requests to hosts that contain malware. Well, it does not really block these requests but it will return a fake IP address instead of the real IP address of the requested site. This can be for example 127.0.0.1. On the home server described on this site, dnsmasq  is used as name server. This setup is made so that it will include any files dropped in the /etc/dnsmasq.d subdirectory in the main configuration.

 

The script.

I have written a shell script and installed it as /usr/local/sbin/malwaredomains. The script:

#!/bin/sh
#
# Update list of malware domains

DNSMASQPATH="/etc/dnsmasq.d/"
DNSMASQFILE="80-malware-domains"

install_malwarezones() {

  rm -f $DNSMASQFILE

  echo "#" > $DNSMASQFILE
  echo "# $DNSMASQFILE generated $(date)" >> $DNSMASQFILE
  echo "# do not edit this file, your changes will get lost" >> $DNSMASQFILE
  echo "#" >> $DNSMASQFILE 

  # Use " separator to isolate the domain names
  IFS='"'
  grep -E '^zone' /var/malwaredomains/spywaredomains.zones | while read L ; do
    set $L
    echo "address=/$2/10.126.151.231" >> $DNSMASQFILE
  done

  mkdir -p $DNSMASQPATH
  cp -p $DNSMASQFILE $DNSMASQPATH/$DNSMASQFILE.new
  mv $DNSMASQPATH/$DNSMASQFILE.new $DNSMASQPATH/$DNSMASQFILE
  [ -x /etc/rc.d/rc.dnsmasq ] && /etc/rc.d/rc.dnsmasq restart >/dev/null
}

cd /var/malwaredomains
wget -qN http://mirror2.malwaredomains.com/files/spywaredomains.zones
rc=$?

if [ $rc -eq 0 ]; then

  if [ -f spywaredomains.md5 ]; then

    OLD=$(cat spywaredomains.md5)
    NEW=$(md5sum spywaredomains.zones)

    if [ "$OLD" != "$NEW" ]; then
      md5sum spywaredomains.zones > spywaredomains.md5
      install_malwarezones
    fi

  else
    md5sum spywaredomains.zones > spywaredomains.md5
    install_malwarezones
  fi
fi

 

This script should be called by cron, you can create a symlink in /etc/cron.daily or /etc/cron.weekly so that this script runs every day or every week. The script checks for a new spywaredomans.zone file from a mirror of the malware domain website. If it detects that this file is changed by comparing the md5 checksum of this file against a known checksum, then a new file 80-malware-domains is created and installed in /etc/dnsmasq.d After that the dnsmasq sever is restarted so that it loads the new file.

The script does write a file 80-malware-domains in the format that dnsmasq understands. The IP address used is the IP address of the webserver on your homeserver. This should be a default empty server. You can also use 127.0.0.1 or 0.0.0.0 as IP address. The advantage of using an empty default server on your home server is that you can check the logfile to see if any client computer tries to reach a blacklisted malware site. This could be caused by already installed malware on the client. Clients that use Firefox or Chrome (others??) are already protected because they use Google Safe Browsing. However that can be disabled, or users use unsafe browsers.

For the first time, run this script by hand. Check your name server by making a query for a malware domain:

root@homsrv:~# host www.mixgrouptravel.cn
www.mixgrouptravel.cn has address 10.126.151.231
root@homsrv:~#

 

You should see that it returns the IP address that you have used in your script.

Note that the downloaded file is in bind format, so if you use bind instead of dnsmasq, you can use the downloaded file without any change. Just follow the instructions on the malware domains website.