Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

eBay is port scanning visitors to their website

blog.nem.ec

Post reply on HN
Print view View original

141–148 of 148 posts

Re: eBay is port scanning visitors to their website

#141

Post by solnyshok »

rtkwe wrote: post #96
uniformlyrandom wrote: post #95

Google's internal sso (which I accidentally stumbled upon) collects other endpoint-specific parameters to compose the digital signature (like browser window size and monitor size). This feels more effective and less intrusive. Not sure why ebay went this rather weird and creepy way instead.

Looking for fraud signs is my guess, people don't usually use eBay through TeamViewer so if it's on and the port is open then an otherwise normal transaction gets really suspicious for example. They're probably feeding the open port info into their model to determine fraud risk for user logins and transactions. They may not even be using it actively yet because they'd need to gather a lot of example data to detect ou…

how can they differentiate between idling tv server running on (all) my machines vs. active tv session?

Re: eBay is port scanning visitors to their website

#142

Post by dontbenebby »

matz1 wrote: post #114
hedora wrote: post #70

Earlier quoted context omitted.

They’re bypassing your local network firewall, and local machine firewall, then attempting to connect to blocked ports. People have been jailed for less.

I definitely don't agree with jail. Unless there is real damage, then I wouldn't consider it an issue.

Sucks for that corporation. They have teams and teams of lawyers - they should have consulted one of them.

It is not just for a corporation to suddenly decide the law is unfair when they are subjected to it when real people have been harmed by the same law.

Re: eBay is port scanning visitors to their website

#143

Post by mkup »

mycall wrote: post #138
vetrom wrote: post #128

Earlier quoted context omitted.

Sometimes that isn't even enough. Windows for example ships with a feature called the "Windows Platform Binary Table" that will load and run DLLs embedded in a machine's ACPI tables.

Is there software that will enumerate ACPI for DLLs?

You can look for ACPI table(s) called "WPBT" using RWEverything (if you are a Windows user): http://rweverything.com/downloads/RwPortableX64V1.7.zip

or look into the following filesystem path in Linux: /sys/firmware/acpi/tables

Re: eBay is port scanning visitors to their website

#144

Post by ezoe »

sq_ wrote: post #127
ezoe wrote: post #103

Earlier quoted context omitted.

A preinstalled local server, presumably running in kernel space for it cause BSOD, crash when connected from localhost and attempted TLS handshake? The preinstalled crapware never changes.

I feel like the only good option at this point when purchasing a prebuilt desktop or a laptop is to nuke the drive and do a clean install of Windows. Seems like the only way to ensure that you've killed the crapware and any partitions meant to preserve/reinstall it.

Only good option is nuke the Windows and use the better OS, like GNU/Linux, FreeBSD or OpenBSD etc.

Re: eBay is port scanning visitors to their website

#145

Post by narrowtux »

dicknuckle wrote: post #50
narrowtux wrote: post #43

Earlier quoted context omitted.

As a developer on a product that uses websocket extensively, I'm afraid that this will lead to the already huge distrust in the technology. If IT admins get wind of this they'll just block it (or never unblock it since it's been blocked by some from day 1) and our product gets degraded experience.

like dropping ICMP replies on firewalls. idiotic because it gives a very false sense of security. it's been a useless "security" practice since the 90s.

Yes, false sense of security hits the nail on the head.

Fits right there with unnecessary password rules too.

Re: eBay is port scanning visitors to their website

#146

Post by rtkwe »

solnyshok wrote: post #141
rtkwe wrote: post #96

Earlier quoted context omitted.

Looking for fraud signs is my guess, people don't usually use eBay through TeamViewer so if it's on and the port is open then an otherwise normal transaction gets really suspicious for example. They're probably feeding the open port info into their model to determine fraud risk for user logins and transactions. They may not even be using it actively yet because they'd need to gather a lot of example data to detect ou…

how can they differentiate between idling tv server running on (all) my machines vs. active tv session?

I don't know if there's a detectable difference just looking at the ports; just having TeamViewer installed slightly increases the risk of any transaction being fraudulent though. I'm just trying to provide an example of how port data could be used for a meaningful purpose. Even just as an additional fingerprinting component it could be useful.

Re: eBay is port scanning visitors to their website

#147

Post by rasz »

dicknuckle wrote: post #50
narrowtux wrote: post #43

Earlier quoted context omitted.

As a developer on a product that uses websocket extensively, I'm afraid that this will lead to the already huge distrust in the technology. If IT admins get wind of this they'll just block it (or never unblock it since it's been blocked by some from day 1) and our product gets degraded experience.

like dropping ICMP replies on firewalls. idiotic because it gives a very false sense of security. it's been a useless "security" practice since the 90s.

Zonealarm's "!1ALERT!! x.x.x.x is h4x0r1ng you with ICMP packets!" sold $millions worth of placebo in early 2000.

http://download.zonelabs.com/bin/media/pdf/ZA_Manual.pdf

Post reply on HN