Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why does the US Visa application website do a port-scan of my network?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 269 posts

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#11

Post by M95D »

I'm using uMatrix and it blocks by default all connections outside the requested site and parent domains. For example, if I request https://mail.yahoo.com, connections to yimg.com are blocked. I need to manually allow each CDN for each website, so this attack/profiling won't work.

Using uMatrix was very annoying at first, most websites are broken without their CDNs, but after a few months or so, the whitelist grew and it contains 90% of websites I visit.

On my system https://ceac.state.gov/genniv/ tries to connect to captcha.com, google-analytics, googletagmanager, 127.0.0.1 and "burp" (a local hostname that doesn't exist in my network). Interestigly, the browser console doesn't list connection attempts to localhost or burp. If I allow 127.0.0.1 and "tcpdump -i lo", I see connections to port 8888, which isn't open.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#13

Post by meitham »

galaxy_gas wrote: post #3

Many sites do it .Included in many standard device fingerprinting / anti anonymity SAAS. Ebay facebook etc all do this ! But it looks this is first party to prevent the adblocking of them 1MB of obfuscated fingerprinting + portscan + Webgl . But oddity this one is trying to find burp suite specific route's.

Madness! How do I harden my network against that?

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#15

Post by jaimehrubiks »

edarchis wrote: post #10

Visa application is riddled with scams. From the simple website that charges you twice the price to websites that will tell you that you were rejected and then fake your documents to get in with your name. So they're probably trying to see that you're not one of those web servers, a proxy for them or detect some known C2 channels.

This is a very clever answer.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#16

Post by samsonradu »

M95D wrote: post #11

I'm using uMatrix and it blocks by default all connections outside the requested site and parent domains. For example, if I request https://mail.yahoo.com , connections to yimg.com are blocked. I need to manually allow each CDN for each website, so this attack/profiling won't work. Using uMatrix was very annoying at first, most websites are broken without their CDNs, but after a few months or so, the whitelist grew a…

How does it manage to hide the requests to 127.0.0.1 from the network tab?

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#17

Post by ale42 »

vaylian wrote: post #7

> Blocks malicious websites from port-scanning your computer/network How does that work? A browser extension can't influence how your router and other machines in your network react to incoming requests.

As far as I understand it, it is supposed to be a scan done by the browser on the user's computer, not an external scan, which a browser extension wouldn't be able to detect.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#18

Post by [deleted] »

edarchis wrote: post #10

Visa application is riddled with scams. From the simple website that charges you twice the price to websites that will tell you that you were rejected and then fake your documents to get in with your name. So they're probably trying to see that you're not one of those web servers, a proxy for them or detect some known C2 channels.

[deleted]

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#19

Post by trod1234 »

Capturing forensic artifacts of the local network allows a building a bridge strategy for identifying fraudulent networks without requiring knowledge of the path taken from destination to recipient. Other local devices do this and send the network map during a phone home, allowing comparison to a source of truth that is tied almost directly to the person, or group of people.

There is also a lot of fingerprintable material within such a port scan from clock skew, TCP ISN, and a few other areas.

You can sieve this quite easily with this available, thanks to Roku's, Phone's, and other things doing this while just sitting locally in a shared collision domain (a digital soldier quartered in every home).

The metadata node graph of devices locally acts as a unique fingerprint once in RFC1918 space, technically not unique but close enough.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#20

Post by ale42 »

meitham wrote: post #13
galaxy_gas wrote: post #3

Many sites do it .Included in many standard device fingerprinting / anti anonymity SAAS. Ebay facebook etc all do this ! But it looks this is first party to prevent the adblocking of them 1MB of obfuscated fingerprinting + portscan + Webgl . But oddity this one is trying to find burp suite specific route's.

Madness! How do I harden my network against that?

You should actually harden your browser or PC... to block any unwanted requests. Apparently some browser extensions can do that.
Post reply on HN