eBay is port scanning visitors to their website • Hacker News Board

Re: eBay is port scanning visitors to their website

#111

Post by dpenguin » Sat, Jun 06, 2020, 6:34 PM UTC

matheusmoreira wrote: post #93

dpenguin wrote: post #40

eBay has a big fraud headache. They have a bunch of algorithms (from the pre-ML-hype days) that take a variety of inputs to determine whether a given transaction is fraudulent or not. Presence of remote login service on the user’s computer may tip the scale heavily in this calculation. Fraud detection is a necessary evil for all financial transaction companies in order to keep costs low for everyone else. If you’re w…

> Fraud detection is a necessary evil for all financial transaction companies in order to keep costs low for everyone else. That doesn't mean they should be allowed to behave like cybercriminals. The risk of fraud doesn't give them a free pass to abuse our trust and invade our privacy. They aren't entitled to know what software people run on their own computers. Especially if they learn this information through under…

Is “behaving like cyber criminals” bad though? Just because it’s doing something out of the ordinary in terms of tech doesn’t mean it’s bad. Fighting cybercrime is always a cat and mouse game akin to counter terrorism, counter espionage or even plain cops and robbers. You need to think like your enemy, have informers, etc etc, while not harming the good citizens. That’s what is going on here.

Are there cops who misuse their power? Absolutely. Are there spies who use information for personal gains? Sure. There need to be checks and balances that make it bad for such people to go rogue.

Privacy acts aim to do some of that. They bring accountability but also an ability to opt out (the latter is hard though - akin to ostracizing oneself from a community).

Re: eBay is port scanning visitors to their website

#112

Post by hazelnut » Sat, Jun 06, 2020, 6:35 PM UTC

kevsim wrote: post #29

mobilio wrote: post #14

It's crystal clear why they do this. Many companies or persons share their desktops for remote usage. Later they sell this service to eBay users. And they're using it for different fraudulent activities - from making real sales (just for stars) to bidding to own items (for rising price). For years eBay fight this.

It seems like eBay wants it both ways. They want to have a huge user base with low friction to get started, but they also don't want fraudulent players. Instead of doing KYC (know your customer) like many financial services, they're stuck doing dirty tricks like this to try and combat fraud.

They actually do KYC (but criminals can also fake it)

Re: eBay is port scanning visitors to their website

#113

Post by Nightshaxx » Sat, Jun 06, 2020, 6:37 PM UTC

thefreeman wrote: post #64

Nightshaxx wrote: post #54

I saw him talk about how Threat Matrix is usually blocked.....but Threat Matrix has their clients get unique endpoint URLs to disguise it. I don't really know how AdBlock works, but aside from the extra time it would take, why doesn't adblockers look up the record of any URLs on the page and see if they are a CNAME for an A url that is on the block list?

uBlock origin does exactly that on browsers which support it. Which I believe is only Firefox at this time. https://github.com/uBlockOrigin/uBlock-issues/issues/780

Well, I was already using Ff+UblockO, so this is just another reason to keep using it. I would really prefer I not get port scanned.

Re: eBay is port scanning visitors to their website

#114

Post by matz1 » Sat, Jun 06, 2020, 6:39 PM UTC

hedora wrote: post #70

matz1 wrote: post #53

Earlier quoted context omitted.

I don't think they shouldn't, most people don't think this is an issue. I certainly don't.

They’re bypassing your local network firewall, and local machine firewall, then attempting to connect to blocked ports. People have been jailed for less.

I definitely don't agree with jail. Unless there is real damage, then I wouldn't consider it an issue.

Re: eBay is port scanning visitors to their website

#115

Post by apple4ever » Sat, Jun 06, 2020, 6:40 PM UTC

floatingatoll wrote: post #87

macOS users, I believe based on my testing that you can block your installed web browsers from localhost port scanning using LittleSnitch. This way you can continue to allow WebRTC and WebSockets to the rest of the Internet (where it's useful), while denying web browsers access to localhost except for specific ports you allow. However, I encourage you to be careful and only block web browsers to localhost using this…

Ah thanks for this. I was looking for a way to accomplish this. I own LS so I'm going to give this a shot.

Re: eBay is port scanning visitors to their website

#116

Post by eganist » Sat, Jun 06, 2020, 6:51 PM UTC

hedora wrote: post #65

dndvr wrote: post #51

Earlier quoted context omitted.

So does using websockets allow you to scan local IP ranges and find other devices on the LAN?

By the rule of all web technology sucks and is untrustworthy, they block 10.0.0.0 and 192.168.0.0, but inexplicably allow 172.16.0.0-172.31.255.255. (Or at least, that was what someone else claimed last time this came up on HN)

Who's "they" in this context? It's unclear to me if this refers to eBay or browser vendors.

Re: eBay is port scanning visitors to their website

#117

Post by kroltan » Sat, Jun 06, 2020, 7:00 PM UTC

VLM wrote: post #106

ZacharyPitts wrote: post #100

Earlier quoted context omitted.

"IE". Difficult to search for what that means.

Internet Explorer. A much maligned legacy browser for legacy windows desktop platforms. Aside from being intensely maligned and full of security holes, it doesn't (or didn't?) support WebRTC. So being called IE is sarcastic like ha ha if you're so concerned about security downgrade to IE which doesn't support WebRTC.

I don't think that's what the poster meant by "They got called IE". IE is notable for - along with the things you mentioned - being about a decade behind in web specification support and taking non-standard approaches to whatever features it did have.

The implication being in this case that people were calling Safari too "conservative", so to speak.

Re: eBay is port scanning visitors to their website

#118

Post by ilikenwf » Sat, Jun 06, 2020, 7:10 PM UTC

moooo99 wrote: post #25

sva_ wrote: post #17

Earlier quoted context omitted.

As far as I know these port scans are done using WebRTC. Using a browser extension[0] it is easy to deactivate it on the go. Personally, I always have WebRTC disabled by default (as it has several nasty security implications), and only activate it if I explicitly need it for something. [0] https://addons.mozilla.org/en-US/firefox/addon/happy-bonobo-...

irrc, eBay uses websocket connections [0] to scan the ports. Firefox doesn't offer an option to disable websockets in the about:config page. However, I have read about workarounds by setting network.websocket.max-connections=0 This is a global setting and is applied to all websites. I also wasn't able to test this myself yet. Are there any good extensions for blocking websockets on for specific domains? [0] https://n…

This won't actually disable websockets if I recall.

There's a blocklist that may make it into uBO in the future that blocks 3rd party access to localhost and other IANA reserved IP addresses, though.

https://github.com/uBlockOrigin/uBlock-issues/issues?q=is%3A...

Re: eBay is port scanning visitors to their website

#119

Post by ilikenwf » Sat, Jun 06, 2020, 7:11 PM UTC

mehrdadn wrote: post #9

I asked this earlier and nobody had a response, so thought I'd ask it again: is there an extension to block this? Edit: @Windows users: pip install pydivert and then try to write a script to block connections from Chrome to non-Chrome processes. you might need GetTcpTable2() or something. (Looking into this now. Check out http://stackoverflow.com/a/25431340 )

uMatrix will usually stop things like this because you haven't explicitly turned them on, but I prefer to just use uBlock origin...we have a discussion and a blocklist for internal IP's here:

https://github.com/uBlockOrigin/uBlock-issues/issues?q=is%3A...

Re: eBay is port scanning visitors to their website

#120

Post by ilikenwf » Sat, Jun 06, 2020, 7:13 PM UTC

labster wrote: post #10

mehrdadn wrote: post #9

I asked this earlier and nobody had a response, so thought I'd ask it again: is there an extension to block this? Edit: @Windows users: pip install pydivert and then try to write a script to block connections from Chrome to non-Chrome processes. you might need GetTcpTable2() or something. (Looking into this now. Check out http://stackoverflow.com/a/25431340 )

uBlock Origin on Firefox, at least according to a previous article[0] I read on HN. Doesn't work on Chrome/Edge because they never provided the API. [0]: https://news.ycombinator.com/item?id=23361823

https://github.com/uBlockOrigin/uBlock-issues/issues?q=is%3A...