Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why does the US Visa application website do a port-scan of my network?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 269 posts

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#31

Post by worthless-trash »

samsonradu wrote: post #16
M95D wrote: post #11

I'm using uMatrix and it blocks by default all connections outside the requested site and parent domains. For example, if I request https://mail.yahoo.com , connections to yimg.com are blocked. I need to manually allow each CDN for each website, so this attack/profiling won't work. Using uMatrix was very annoying at first, most websites are broken without their CDNs, but after a few months or so, the whitelist grew a…

How does it manage to hide the requests to 127.0.0.1 from the network tab?

The requests are not made, because some operating systems prevent this.

If you're on OSX, the permission to "discover on the local network" prevents it from happening ( System Settings -> Privacy & Security -> Local Network -> yourbrowser )

Could also be 'network' permissions on firefox ( Go to Settings > Privacy & Security > Permissions ) which is on a per site level, but iirc that could be set site-wide at some point.

The other browsers likely have similar configs, but this is what I have found.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#32

Post by culturestate »

M95D wrote: post #21
samsonradu wrote: post #16

Earlier quoted context omitted.

How does it manage to hide the requests to 127.0.0.1 from the network tab?

I have no ideea. Possibly that's a limitation of Chrome+Firefox developer tools (I get the feeling it's the same code)? But I found what "burp" is: https://portswigger.net/burp/communitydownload

It seems like they only make the localhost requests on your first visit. If you open devtools in incognito mode (or just clear the cookies) before accessing https://ceac.state.gov/genniv/ you should see those 127.0.0.1 attempts as ERR_CONNECTION_REFUSED in the network tab.

Somewhat more worryingly, Little Snitch doesn't report them at all, though that might just be because they were already blocked at the browser.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#33

Post by actionfromafar »

edarchis wrote: post #10

Visa application is riddled with scams. From the simple website that charges you twice the price to websites that will tell you that you were rejected and then fake your documents to get in with your name. So they're probably trying to see that you're not one of those web servers, a proxy for them or detect some known C2 channels.

If the proxy scams are just a little clever, they'll run the proxy on an another IP.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#35

Post by vaylian »

ale42 wrote: post #17
vaylian wrote: post #7

> Blocks malicious websites from port-scanning your computer/network How does that work? A browser extension can't influence how your router and other machines in your network react to incoming requests.

As far as I understand it, it is supposed to be a scan done by the browser on the user's computer, not an external scan, which a browser extension wouldn't be able to detect.

I see. So the website would try to access private IP adresses (RFC 1918) by having elements like http://10.0.0.1"> in the web site and then the web site would check if the iframe was loaded successfully?

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#36

Post by user070223 »

M95D wrote: post #11

I'm using uMatrix and it blocks by default all connections outside the requested site and parent domains. For example, if I request https://mail.yahoo.com , connections to yimg.com are blocked. I need to manually allow each CDN for each website, so this attack/profiling won't work. Using uMatrix was very annoying at first, most websites are broken without their CDNs, but after a few months or so, the whitelist grew a…

uMatrix is archived and I think uBlockOrigin is now advised to use(which incorporate uMatrix by enabling advanced settings)

For those who want to try blocking more stuff you can enable hard mode and bind relax blocking mode keyboard shortcut

I'd recommend also enabling filter lists(I advice yokoffing/filterlists and your region/language)

https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-m...

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#37

Post by M95D »

noja wrote: post #22
M95D wrote: post #11

I'm using uMatrix and it blocks by default all connections outside the requested site and parent domains. For example, if I request https://mail.yahoo.com , connections to yimg.com are blocked. I need to manually allow each CDN for each website, so this attack/profiling won't work. Using uMatrix was very annoying at first, most websites are broken without their CDNs, but after a few months or so, the whitelist grew a…

How does uMatrix handle the Facebook tracking pixel, or the replacement which is the Conversions API Gateway? This is a container that FB gives you to host that lives under your domain (it can be your main domain) that slurps up user data and sends it to Facebook from the server side. You embed some JS in your website, and they hoover up the data.

It doesn't handle it. Anyway, there's no way to know what a website does on the server site. Even a completely static website could be sending the server logs somewhere.

There are options to not load JS, images, XMLHttpRequests, frames, cookies, for each site, but it doesn't list individual files.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#38

Post by gethly »

Just a little side note - in this context, it makes sense if the website tries to connect to a local port because you might be running a card reader(ie. terminal). This is how it works with some(all?) EU countries that have a chip in their ID cards, or even vehicle registration cards, which you can use to access sensitive information or perform certain administrative tasks on government websites.

Although, from personal experience, it used to require java and it worked only on internet explorer and since it has been retired and replaced with chromium, i am not sure what is the way to make it work nowadays, as i have not been able to figure out to use it when i needed the last time.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#39

Post by dns_snek »

edarchis wrote: post #10

Visa application is riddled with scams. From the simple website that charges you twice the price to websites that will tell you that you were rejected and then fake your documents to get in with your name. So they're probably trying to see that you're not one of those web servers, a proxy for them or detect some known C2 channels.

Huh, how do you imagine that would work? This "scan" is happening inside client-side javascript, delivering the file through a proxy wouldn't "detect" anything about the proxy.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#40

Post by dns_snek »

The "port scan" just seems to be a local connection to 127.0.0.1:8888. I don't know what purpose it serves on this page, but our government websites often use this technique to communicate with native software for digitally signing documents.

Are you seeing connection attempts to other IPs?

Post reply on HN