Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why does the US Visa application website do a port-scan of my network?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 269 posts

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#51

Post by junon »

dns_snek wrote: post #40

The "port scan" just seems to be a local connection to 127.0.0.1:8888. I don't know what purpose it serves on this page, but our government websites often use this technique to communicate with native software for digitally signing documents. Are you seeing connection attempts to other IPs?

Might also be card readers, debug servers, etc.

Could also be incompetence :D until I fixed it, deploying from my local machine rather than CD resulted in one of the baked in URLs being localhost rather than the public host on the project I'm working on now. Their local development server might just be at port 8888. Wouldn't surprise me.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#52

Post by M95D »

user070223 wrote: post #36
M95D wrote: post #11

I'm using uMatrix and it blocks by default all connections outside the requested site and parent domains. For example, if I request https://mail.yahoo.com , connections to yimg.com are blocked. I need to manually allow each CDN for each website, so this attack/profiling won't work. Using uMatrix was very annoying at first, most websites are broken without their CDNs, but after a few months or so, the whitelist grew a…

uMatrix is archived and I think uBlockOrigin is now advised to use(which incorporate uMatrix by enabling advanced settings) For those who want to try blocking more stuff you can enable hard mode and bind relax blocking mode keyboard shortcut I'd recommend also enabling filter lists(I advice yokoffing/filterlists and your region/language) https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-m...

But uBlockOrigin UI is so much worse...

Besides, uMatrix works fine. It's that kind of program that doesn't need any updates.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#53

Post by ahdanggit »

galaxy_gas wrote: post #3

Many sites do it .Included in many standard device fingerprinting / anti anonymity SAAS. Ebay facebook etc all do this ! But it looks this is first party to prevent the adblocking of them 1MB of obfuscated fingerprinting + portscan + Webgl . But oddity this one is trying to find burp suite specific route's.

my bank did this on the site they sent me to in order to activate my new card.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#54

Post by account42 »

user070223 wrote: post #36
M95D wrote: post #11

I'm using uMatrix and it blocks by default all connections outside the requested site and parent domains. For example, if I request https://mail.yahoo.com , connections to yimg.com are blocked. I need to manually allow each CDN for each website, so this attack/profiling won't work. Using uMatrix was very annoying at first, most websites are broken without their CDNs, but after a few months or so, the whitelist grew a…

uMatrix is archived and I think uBlockOrigin is now advised to use(which incorporate uMatrix by enabling advanced settings) For those who want to try blocking more stuff you can enable hard mode and bind relax blocking mode keyboard shortcut I'd recommend also enabling filter lists(I advice yokoffing/filterlists and your region/language) https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-m...

Until uBO has an even remotely usable interface for this use case people (including myself) will continue to use uMaxtrix or forks of it instead.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#55

Post by ahdanggit »

bawolff wrote: post #26
meitham wrote: post #13

Earlier quoted context omitted.

Madness! How do I harden my network against that?

Chrome is already in the process of killing it https://developer.chrome.com/blog/local-network-access

The company I work for has a legitimate service that runs on the loopback (it provides our web apps APIs for some device integration) hopefully its just as simple as the user accepting the prompt else we'll be drowning in support. We had to go the path of the local service because they killed NPAPI. I've been thinking about using web serial as an alternative but Firefox doesn't support it.

That being said, I think this is an overall win, hopefully Firefox implements it in a consistent manner as well.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#56

Post by tifkap »

dns_snek wrote: post #40

The "port scan" just seems to be a local connection to 127.0.0.1:8888. I don't know what purpose it serves on this page, but our government websites often use this technique to communicate with native software for digitally signing documents. Are you seeing connection attempts to other IPs?

This is most likely an attempt to connect to a webserver on your own device to collect data and/or do tracking.

Remember back in June when Facebook/meta got caught tracking users trough a webserver on Android phone thought Messenger and Instagram? Same thing.

See: https://news.ycombinator.com/item?id=44169115 and https://news.ycombinator.com/item?id=44175940

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#57

Post by sylware »

M95D wrote: post #11

I'm using uMatrix and it blocks by default all connections outside the requested site and parent domains. For example, if I request https://mail.yahoo.com , connections to yimg.com are blocked. I need to manually allow each CDN for each website, so this attack/profiling won't work. Using uMatrix was very annoying at first, most websites are broken without their CDNs, but after a few months or so, the whitelist grew a…

Whitelisting seems to be the way to go. With IPv6 and OS generated IPs (up to what the ISP domestic router allows) could be very efficient.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#58

Post by inferiorhuman »

M95D wrote: post #21
samsonradu wrote: post #16

Earlier quoted context omitted.

How does it manage to hide the requests to 127.0.0.1 from the network tab?

I have no ideea. Possibly that's a limitation of Chrome+Firefox developer tools (I get the feeling it's the same code)? But I found what "burp" is: https://portswigger.net/burp/communitydownload

This is what I see.

https://i.imgur.com/lvjg2YQ.png

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#60

Post by aembleton »

user070223 wrote: post #36
M95D wrote: post #11

I'm using uMatrix and it blocks by default all connections outside the requested site and parent domains. For example, if I request https://mail.yahoo.com , connections to yimg.com are blocked. I need to manually allow each CDN for each website, so this attack/profiling won't work. Using uMatrix was very annoying at first, most websites are broken without their CDNs, but after a few months or so, the whitelist grew a…

uMatrix is archived and I think uBlockOrigin is now advised to use(which incorporate uMatrix by enabling advanced settings) For those who want to try blocking more stuff you can enable hard mode and bind relax blocking mode keyboard shortcut I'd recommend also enabling filter lists(I advice yokoffing/filterlists and your region/language) https://github.com/gorhill/uBlock/wiki/Blocking-mode:-hard-m...

With uBO I can't block cookies by domain.
Post reply on HN