Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why does the US Visa application website do a port-scan of my network?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 269 posts

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#61

Post by jadamson »

asimovDev wrote: post #6
asimovDev wrote: post #5

Embarrassed to say that I wasn't aware of this practice. Are there malicious uses for this beyond fingerprinting?

https://files.catbox.moe/g1bejn.png When I visit the site from Safari on macOS I see this in the console. Are there any particular services that use port 8888 for the website to do this?

https://my.f5.com/manage/s/article/K000138794

It seems to be part of some "bot defense" product by these F5 people, to "test the different browser capabilities". I doubt it's intended to hit a real endpoint on any system.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#62

Post by inferiorhuman »

asimovDev wrote: post #5

Embarrassed to say that I wasn't aware of this practice. Are there malicious uses for this beyond fingerprinting?

Mostly it's great for tracking although I'm sure it could also be used to exfiltrate data (e.g. if the user is running something sensitive on localhost).

https://www.digitalsamba.com/blog/metas-localhost-spyware-ho...

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#64

Post by bmacho »

meitham wrote: post #13
galaxy_gas wrote: post #3

Many sites do it .Included in many standard device fingerprinting / anti anonymity SAAS. Ebay facebook etc all do this ! But it looks this is first party to prevent the adblocking of them 1MB of obfuscated fingerprinting + portscan + Webgl . But oddity this one is trying to find burp suite specific route's.

Madness! How do I harden my network against that?

It would be the job of the operating system to give or take away the ability of your browser to access your local network. But you can run your browser in a container/vm and disable localhost. (And use a separate browser for localhost only if you need it.)

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#65

Post by paganel »

mrtksn wrote: post #46
edarchis wrote: post #10

Visa application is riddled with scams. From the simple website that charges you twice the price to websites that will tell you that you were rejected and then fake your documents to get in with your name. So they're probably trying to see that you're not one of those web servers, a proxy for them or detect some known C2 channels.

That would be quite clever for an incredibly horrible website. The other day my SO, who is a Turkish citizen, was filling up her visa application and after half an hour of meticulous form filling the system just kick her out. I think the session times out or something. If you haven't created an account or you haven't write down the current application ID everything is lost. In the process she was also directed to a n…

The hard truth of it all is that both the US and (partially) the EU don’t want to make this easier because seeing as wanting “outside” people is now a political liability. You may want to adjust your expectations around that.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#66

Post by alistairSH »

dns_snek wrote: post #39
edarchis wrote: post #10

Visa application is riddled with scams. From the simple website that charges you twice the price to websites that will tell you that you were rejected and then fake your documents to get in with your name. So they're probably trying to see that you're not one of those web servers, a proxy for them or detect some known C2 channels.

Huh, how do you imagine that would work? This "scan" is happening inside client-side javascript, delivering the file through a proxy wouldn't "detect" anything about the proxy.

Proxy is being used in the traditional sense here. It’s common for a business (scam or legit) to handle visa applications on behalf of customers.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#67

Post by noja »

M95D wrote: post #37
noja wrote: post #22

Earlier quoted context omitted.

How does uMatrix handle the Facebook tracking pixel, or the replacement which is the Conversions API Gateway? This is a container that FB gives you to host that lives under your domain (it can be your main domain) that slurps up user data and sends it to Facebook from the server side. You embed some JS in your website, and they hoover up the data.

It doesn't handle it. Anyway, there's no way to know what a website does on the server site. Even a completely static website could be sending the server logs somewhere. There are options to not load JS, images, XMLHttpRequests, frames, cookies, for each site, but it doesn't list individual files.

Then why use it? They're number one.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#68

Post by rwmj »

mrtksn wrote: post #46
edarchis wrote: post #10

Visa application is riddled with scams. From the simple website that charges you twice the price to websites that will tell you that you were rejected and then fake your documents to get in with your name. So they're probably trying to see that you're not one of those web servers, a proxy for them or detect some known C2 channels.

That would be quite clever for an incredibly horrible website. The other day my SO, who is a Turkish citizen, was filling up her visa application and after half an hour of meticulous form filling the system just kick her out. I think the session times out or something. If you haven't created an account or you haven't write down the current application ID everything is lost. In the process she was also directed to a n…

You might be making the assumption that the US wants to make the process easier.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#69

Post by tmdetect »

tmdetect wrote: post #49

Very interesting. Having looked at NoScript it seems like you can disable LAN as a default value under the allow tab.

Looking further

* uBlock Origin and Lite have it as an option under Filter List > Privacy > Block Outsider Intrusion into LAN

* Brave prevents it, tested with Aggressively block Trackers and Ads.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#70

Post by karel-3d »

karel-3d wrote: post #63

It's coming from a F5 script, which is a company that sells anti-bot protection amid other things. (It's coming from obfuscated script at /TSPD, which is a F5 thing.) https://www.f5.com/

TS seems to be short for TrafficShield (a product of some company F5 acquired in early 2000s) and PD seems to be Proactive Defense (?)
Post reply on HN