Live data from Hacker News

eBay is port scanning visitors to their website

blog.nem.ec

21–30 of 148 posts

Re: eBay is port scanning visitors to their website

#21
post #14

It's crystal clear why they do this. Many companies or persons share their desktops for remote usage. Later they sell this service to eBay users. And they're using it for different fraudulent activities - from making real sales (just for stars) to bidding to own items (for rising price). For years eBay fight this.

I don't understand this could you explain?

[deleted]

Re: eBay is port scanning visitors to their website

#22
post #14

It's crystal clear why they do this. Many companies or persons share their desktops for remote usage. Later they sell this service to eBay users. And they're using it for different fraudulent activities - from making real sales (just for stars) to bidding to own items (for rising price). For years eBay fight this.

I don't understand this could you explain?

Ratings are an important part of the eBay ecosystem.

He's saying people let others use their eBay accounts through RDC to game the system.

Also it's an auction site. People want to raise the price by bidding on their own items

Re: eBay is port scanning visitors to their website

#24
post #15

Just wait until the database of ip and open ports is leaked and hackers start exploiting vulnerabilities of softwares listening to these ports to break into random people devices.

I don't understand the issue you are describing. You can already scan the entire ipv4 space for cheap with tools like zmap[0]. How does a premade list help ?

In addition, I would expect such a DB to go stale very quickly.

[0] https://zmap.io/

Re: eBay is port scanning visitors to their website

#25
post #17
post #9

I asked this earlier and nobody had a response, so thought I'd ask it again: is there an extension to block this? Edit: @Windows users: pip install pydivert and then try to write a script to block connections from Chrome to non-Chrome processes. you might need GetTcpTable2() or something. (Looking into this now. Check out http://stackoverflow.com/a/25431340 )

As far as I know these port scans are done using WebRTC. Using a browser extension[0] it is easy to deactivate it on the go. Personally, I always have WebRTC disabled by default (as it has several nasty security implications), and only activate it if I explicitly need it for something. [0] https://addons.mozilla.org/en-US/firefox/addon/happy-bonobo-...

irrc, eBay uses websocket connections [0] to scan the ports. Firefox doesn't offer an option to disable websockets in the about:config page. However, I have read about workarounds by setting

  network.websocket.max-connections=0
This is a global setting and is applied to all websites. I also wasn't able to test this myself yet. Are there any good extensions for blocking websockets on for specific domains?

[0] https://nullsweep.com/why-is-this-website-port-scanning-me/

Re: eBay is port scanning visitors to their website

#26
post #14

It's crystal clear why they do this. Many companies or persons share their desktops for remote usage. Later they sell this service to eBay users. And they're using it for different fraudulent activities - from making real sales (just for stars) to bidding to own items (for rising price). For years eBay fight this.

That might be the case but it's next to imposible prove it. You can always use remote software/VPN that allows changing ports(VNC over ssh). I do see your point about auctions though.

Re: eBay is port scanning visitors to their website

#27
post #9

I asked this earlier and nobody had a response, so thought I'd ask it again: is there an extension to block this? Edit: @Windows users: pip install pydivert and then try to write a script to block connections from Chrome to non-Chrome processes. you might need GetTcpTable2() or something. (Looking into this now. Check out http://stackoverflow.com/a/25431340 )

Previous discussion mentioned a filter rule for uBlock Origin like

$websocket

to override this for sites which break use e.g.

@@gateway.discord.gg$websocket

Re: eBay is port scanning visitors to their website

#28

Has anyone confirmed whether they're still continuing this practice? I'm curious, but at the same time feel highly uncomfortable visiting a website that has no problems exploiting a browser loophole.

Just tried ebay.co.uk and I can see several clear.png calls with 204 and a payload as described in the article.

Re: eBay is port scanning visitors to their website

#29
post #14

It's crystal clear why they do this. Many companies or persons share their desktops for remote usage. Later they sell this service to eBay users. And they're using it for different fraudulent activities - from making real sales (just for stars) to bidding to own items (for rising price). For years eBay fight this.

It seems like eBay wants it both ways. They want to have a huge user base with low friction to get started, but they also don't want fraudulent players. Instead of doing KYC (know your customer) like many financial services, they're stuck doing dirty tricks like this to try and combat fraud.

Re: eBay is port scanning visitors to their website

#30
post #29
post #14

It's crystal clear why they do this. Many companies or persons share their desktops for remote usage. Later they sell this service to eBay users. And they're using it for different fraudulent activities - from making real sales (just for stars) to bidding to own items (for rising price). For years eBay fight this.

It seems like eBay wants it both ways. They want to have a huge user base with low friction to get started, but they also don't want fraudulent players. Instead of doing KYC (know your customer) like many financial services, they're stuck doing dirty tricks like this to try and combat fraud.

Cheating is rampant in all financial services that mediate transactions between end customers. No shortage of stories about card fraud or PayPal woes.
Post reply on HN