eBay is port scanning visitors to their website • Hacker News Board

Re: eBay is port scanning visitors to their website

#61

Post by gruez » Sat, Jun 06, 2020, 2:16 PM UTC

mobilio wrote: post #14

It's crystal clear why they do this. Many companies or persons share their desktops for remote usage. Later they sell this service to eBay users. And they're using it for different fraudulent activities - from making real sales (just for stars) to bidding to own items (for rising price). For years eBay fight this.

>Many companies or persons share their desktops for remote usage. Later they sell this service to eBay users.

Is this really a thing? I thought everybody just used residential proxy/VPN services like luminati. It makes sense too, because a proxy service is way easier to adapt to your application than a remote desktop service.

Re: eBay is port scanning visitors to their website

#62

Post by anewdirection » Sat, Jun 06, 2020, 2:19 PM UTC

hazz99 wrote: post #31

moooo99 wrote: post #25

Earlier quoted context omitted.

irrc, eBay uses websocket connections [0] to scan the ports. Firefox doesn't offer an option to disable websockets in the about:config page. However, I have read about workarounds by setting network.websocket.max-connections=0 This is a global setting and is applied to all websites. I also wasn't able to test this myself yet. Are there any good extensions for blocking websockets on for specific domains? [0] https://n…

To people reading this, many websites rely on websockets for real-time information. They would likely fallback to per-refresh HTTP requests, but it also may break a bunch of sites.

You could say that about JS and I am not running that shit either.

Re: eBay is port scanning visitors to their website

#63

Post by anewdirection » Sat, Jun 06, 2020, 2:23 PM UTC

phs318u wrote: post #13

igravious wrote: post #11

Humanity constructed something wonderful and new. (The internet.) And the corporate web has all but destroyed it.

Slightly OT but I’d suggest that the thing that has “ruined” the internet (for me) more than any other single thing are trolls, and they predate the corporate web by a long way.

I would take 2x trolls over the abusive advertising and tracking network we have now.

Re: eBay is port scanning visitors to their website

#64

Post by thefreeman » Sat, Jun 06, 2020, 2:26 PM UTC

Nightshaxx wrote: post #54

I saw him talk about how Threat Matrix is usually blocked.....but Threat Matrix has their clients get unique endpoint URLs to disguise it. I don't really know how AdBlock works, but aside from the extra time it would take, why doesn't adblockers look up the record of any URLs on the page and see if they are a CNAME for an A url that is on the block list?

uBlock origin does exactly that on browsers which support it. Which I believe is only Firefox at this time. https://github.com/uBlockOrigin/uBlock-issues/issues/780

Re: eBay is port scanning visitors to their website

#65

Post by hedora » Sat, Jun 06, 2020, 2:26 PM UTC

dndvr wrote: post #51

wongarsu wrote: post #48

Earlier quoted context omitted.

Websockets bring them past the router and any other hardware firewall or NAT. Also various software only listens to localhost, on the assumption that local traffic is trustworthy. They could still portscan from afar and it would still be sketchy, but using Websockets makes it worse

So does using websockets allow you to scan local IP ranges and find other devices on the LAN?

By the rule of all web technology sucks and is untrustworthy, they block 10.0.0.0 and 192.168.0.0, but inexplicably allow 172.16.0.0-172.31.255.255.

(Or at least, that was what someone else claimed last time this came up on HN)

Re: eBay is port scanning visitors to their website

#66

Post by thefreeman » Sat, Jun 06, 2020, 2:27 PM UTC

olliej wrote: post #4

wasn't this on the front page just a few days ago?

This article actually reverse engineers the javascript and has a lot more information about what they are tracking and how they are doing it.

Re: eBay is port scanning visitors to their website

#67

Post by disposekinetics » Sat, Jun 06, 2020, 2:28 PM UTC

dndvr wrote: post #51

wongarsu wrote: post #48

Earlier quoted context omitted.

Websockets bring them past the router and any other hardware firewall or NAT. Also various software only listens to localhost, on the assumption that local traffic is trustworthy. They could still portscan from afar and it would still be sketchy, but using Websockets makes it worse

So does using websockets allow you to scan local IP ranges and find other devices on the LAN?

My understanding is it allows them to check for things listening on loopback, given they appear to be checking for SSH tunnels.

Re: eBay is port scanning visitors to their website

#68

Post by hoorayimhelping » Sat, Jun 06, 2020, 2:30 PM UTC

grooling wrote: post #18

mobilio wrote: post #14

It's crystal clear why they do this. Many companies or persons share their desktops for remote usage. Later they sell this service to eBay users. And they're using it for different fraudulent activities - from making real sales (just for stars) to bidding to own items (for rising price). For years eBay fight this.

I don't understand this could you explain?

Seller A is selling an item he bought for $5 dollars. He's trying to sell it for $10, for a 100% profit. The current bid is $7 dollars. He logs in to a remote desktop and bids on his own item to bump the price with a different MAC and IP. It sells for $12 and he's happy.

Seller B is having a hard time making sales. She thinks he needs better ratings. So she logs into the site using a remote client and 'buys' 10 of her items on different accounts and leaves 10 glowing reviews.

Ebay is scanning ports to detect the tools used to do this.

Re: eBay is port scanning visitors to their website

#69

Post by clarry » Sat, Jun 06, 2020, 2:33 PM UTC

hoorayimhelping wrote: post #68

grooling wrote: post #18

Earlier quoted context omitted.

I don't understand this could you explain?

Seller A is selling an item he bought for $5 dollars. He's trying to sell it for $10, for a 100% profit. The current bid is $7 dollars. He logs in to a remote desktop and bids on his own item to bump the price with a different MAC and IP. It sells for $12 and he's happy. Seller B is having a hard time making sales. She thinks he needs better ratings. So she logs into the site using a remote client and 'buys' 10 of he…

> Seller A is selling an item he bought for $5 dollars. He's trying to sell it for $10, for a 100% profit. The current bid is $7 dollars. He logs in to a remote desktop and bids on his own item to bump the price with a different MAC and IP. It sells for $12 and he's happy.

So why don't you set the starting price at $10? Does ebay not let you set the base price?

Re: eBay is port scanning visitors to their website

#70

Post by hedora » Sat, Jun 06, 2020, 2:34 PM UTC

matz1 wrote: post #53

kburman wrote: post #16

Earlier quoted context omitted.

They should find a better way instead of compromising privacy of all the users. And even if they decided don't they have any responsibility to tell the users.

I don't think they shouldn't, most people don't think this is an issue. I certainly don't.

They’re bypassing your local network firewall, and local machine firewall, then attempting to connect to blocked ports. People have been jailed for less.