Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why does the US Visa application website do a port-scan of my network?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 269 posts

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#41

Post by mdp2021 »

testdelacc1 wrote: post #30
edarchis wrote: post #10

Visa application is riddled with scams. From the simple website that charges you twice the price to websites that will tell you that you were rejected and then fake your documents to get in with your name. So they're probably trying to see that you're not one of those web servers, a proxy for them or detect some known C2 channels.

Another data point - 5he Indian visa system is similar. The official website ending in .gov.in, which is hard to find, offers a visa for $10 and minimal hassle. The scam websites, with better SEO sell the same shit for $80. They’re just proxying your application to the real website and pocketing the difference. It would be good if the Indian government could block the scammers but I guess it’s a lower priority for th…

[dead]

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#42

Post by dns_snek »

meitham wrote: post #13
galaxy_gas wrote: post #3

Many sites do it .Included in many standard device fingerprinting / anti anonymity SAAS. Ebay facebook etc all do this ! But it looks this is first party to prevent the adblocking of them 1MB of obfuscated fingerprinting + portscan + Webgl . But oddity this one is trying to find burp suite specific route's.

Madness! How do I harden my network against that?

Enable "Block Outsider Intrusion into LAN" filter list in uBlock Origin.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#43

Post by Semaphor »

user070223 wrote: post #36
M95D wrote: post #11

I'm using uMatrix and it blocks by default all connections outside the requested site and parent domains. For example, if I request https://mail.yahoo.com , connections to yimg.com are blocked. I need to manually allow each CDN for each website, so this attack/profiling won't work. Using uMatrix was very annoying at first, most websites are broken without their CDNs, but after a few months or so, the whitelist grew a…

uMatrix is archived and I think uBlockOrigin is now advised to use(which incorporate uMatrix by enabling advanced settings) For those who want to try blocking more stuff you can enable hard mode and bind relax blocking mode keyboard shortcut I'd recommend also enabling filter lists(I advice yokoffing/filterlists and your region/language) https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-m...

I reluctantly switched to only uBo because of uM bugs. But the UI/UX is just a huge step backwards to enable mobile usability.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#44

Post by Delk »

vaylian wrote: post #35
ale42 wrote: post #17

Earlier quoted context omitted.

As far as I understand it, it is supposed to be a scan done by the browser on the user's computer, not an external scan, which a browser extension wouldn't be able to detect.

I see. So the website would try to access private IP adresses (RFC 1918) by having elements like http://10.0.0.1 "> in the web site and then the web site would check if the iframe was loaded successfully?

It could also just try making the request with javascript. Or try a websocket connection.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#45

Post by JosephRedfern »

dns_snek wrote: post #39
edarchis wrote: post #10

Visa application is riddled with scams. From the simple website that charges you twice the price to websites that will tell you that you were rejected and then fake your documents to get in with your name. So they're probably trying to see that you're not one of those web servers, a proxy for them or detect some known C2 channels.

Huh, how do you imagine that would work? This "scan" is happening inside client-side javascript, delivering the file through a proxy wouldn't "detect" anything about the proxy.

I imagine it may not be a proxy in the true sense, but a headless browser that's "proxying" the application process rather than the network traffic itself.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#46

Post by mrtksn »

edarchis wrote: post #10

Visa application is riddled with scams. From the simple website that charges you twice the price to websites that will tell you that you were rejected and then fake your documents to get in with your name. So they're probably trying to see that you're not one of those web servers, a proxy for them or detect some known C2 channels.

That would be quite clever for an incredibly horrible website. The other day my SO, who is a Turkish citizen, was filling up her visa application and after half an hour of meticulous form filling the system just kick her out. I think the session times out or something. If you haven't created an account or you haven't write down the current application ID everything is lost. In the process she was also directed to a non-.gov website for something during the process, I thought she was getting scammed but no.

It actually makes sense to have a paid service that makes this abomination less painful. Though they work with VFS Global for collecting the applications and relevant documents, the VFS Global itself is an abomination and doesn't help with the handling of the form filling anyway.

Recently EU streamlined the Schengen visa application process for Turkish citizens as those "visa agencies" that are the official agencies and the only way to apply for a visa for many countries don't actually help with anything and are scamming people by selling the "good hours" for the visa appointment on the black market. An agency was dropped for this and the scams by agencies were listed among the reasons to streamline the application process.

Both with US and EU people are losing scholarships etc. due to outrageous wait times that are sometimes are years ahead or there's an issue with the systems handling the applications.

I guess there must be an opportunity there to fix all this together with smaller stuff like handling transliteration and character encodings, I wonder if some of those scam site are not scams and actually help with it. An AI agent can be useful here.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#48

Post by sumedh »

testdelacc1 wrote: post #30
edarchis wrote: post #10

Visa application is riddled with scams. From the simple website that charges you twice the price to websites that will tell you that you were rejected and then fake your documents to get in with your name. So they're probably trying to see that you're not one of those web servers, a proxy for them or detect some known C2 channels.

Another data point - 5he Indian visa system is similar. The official website ending in .gov.in, which is hard to find, offers a visa for $10 and minimal hassle. The scam websites, with better SEO sell the same shit for $80. They’re just proxying your application to the real website and pocketing the difference. It would be good if the Indian government could block the scammers but I guess it’s a lower priority for th…

The scam websites are probably owned by someone who works in the Indian govt.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#50

Post by OJFord »

user070223 wrote: post #36
M95D wrote: post #11

I'm using uMatrix and it blocks by default all connections outside the requested site and parent domains. For example, if I request https://mail.yahoo.com , connections to yimg.com are blocked. I need to manually allow each CDN for each website, so this attack/profiling won't work. Using uMatrix was very annoying at first, most websites are broken without their CDNs, but after a few months or so, the whitelist grew a…

uMatrix is archived and I think uBlockOrigin is now advised to use(which incorporate uMatrix by enabling advanced settings) For those who want to try blocking more stuff you can enable hard mode and bind relax blocking mode keyboard shortcut I'd recommend also enabling filter lists(I advice yokoffing/filterlists and your region/language) https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-m...

uBO advanced settings still isn't as flexible as uMatrix was though, fwiw. (I did give in and switch in the end though.)
Post reply on HN