Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why does the US Visa application website do a port-scan of my network?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 269 posts

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#21

Post by M95D »

samsonradu wrote: post #16
M95D wrote: post #11

I'm using uMatrix and it blocks by default all connections outside the requested site and parent domains. For example, if I request https://mail.yahoo.com , connections to yimg.com are blocked. I need to manually allow each CDN for each website, so this attack/profiling won't work. Using uMatrix was very annoying at first, most websites are broken without their CDNs, but after a few months or so, the whitelist grew a…

How does it manage to hide the requests to 127.0.0.1 from the network tab?

I have no ideea. Possibly that's a limitation of Chrome+Firefox developer tools (I get the feeling it's the same code)?

But I found what "burp" is: https://portswigger.net/burp/communitydownload

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#22

Post by noja »

M95D wrote: post #11

I'm using uMatrix and it blocks by default all connections outside the requested site and parent domains. For example, if I request https://mail.yahoo.com , connections to yimg.com are blocked. I need to manually allow each CDN for each website, so this attack/profiling won't work. Using uMatrix was very annoying at first, most websites are broken without their CDNs, but after a few months or so, the whitelist grew a…

How does uMatrix handle the Facebook tracking pixel, or the replacement which is the Conversions API Gateway?

This is a container that FB gives you to host that lives under your domain (it can be your main domain) that slurps up user data and sends it to Facebook from the server side. You embed some JS in your website, and they hoover up the data.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#23

Post by thrown-0825 »

kolla wrote: post #4

My biggest grief with that site is that it's like something from the 90s.

Yeah it should have a fixed header and footer along with a pop-up consent drawer so you can only see 10% of the actual site content.

So much better.

Modern web design is a joke.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#24

Post by bawolff »

ale42 wrote: post #17
vaylian wrote: post #7

> Blocks malicious websites from port-scanning your computer/network How does that work? A browser extension can't influence how your router and other machines in your network react to incoming requests.

As far as I understand it, it is supposed to be a scan done by the browser on the user's computer, not an external scan, which a browser extension wouldn't be able to detect.

Hopefully should soon be a thing of the past with https://developer.chrome.com/blog/local-network-access

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#25

Post by slyall »

Be careful your security tool isn't producing false positives.

I remember years back when people would run these firewalls and we'd get complaints from home users about normal traffic.

Thinks like complaints our mail servers was scanning them on port 25 when they sent email.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#26

Post by bawolff »

meitham wrote: post #13
galaxy_gas wrote: post #3

Many sites do it .Included in many standard device fingerprinting / anti anonymity SAAS. Ebay facebook etc all do this ! But it looks this is first party to prevent the adblocking of them 1MB of obfuscated fingerprinting + portscan + Webgl . But oddity this one is trying to find burp suite specific route's.

Madness! How do I harden my network against that?

Chrome is already in the process of killing it https://developer.chrome.com/blog/local-network-access

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#27

Post by quietfox »

M95D wrote: post #11

I'm using uMatrix and it blocks by default all connections outside the requested site and parent domains. For example, if I request https://mail.yahoo.com , connections to yimg.com are blocked. I need to manually allow each CDN for each website, so this attack/profiling won't work. Using uMatrix was very annoying at first, most websites are broken without their CDNs, but after a few months or so, the whitelist grew a…

It seems to try to check if you are using the Burp Suite on their web application.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#29

Post by thaumasiotes »

M95D wrote: post #11

I'm using uMatrix and it blocks by default all connections outside the requested site and parent domains. For example, if I request https://mail.yahoo.com , connections to yimg.com are blocked. I need to manually allow each CDN for each website, so this attack/profiling won't work. Using uMatrix was very annoying at first, most websites are broken without their CDNs, but after a few months or so, the whitelist grew a…

> On my system https://ceac.state.gov/genniv/ tries to connect to captcha.com, google-analytics, googletagmanager, 127.0.0.1 and "burp" (a local hostname that doesn't exist in my network).

That will be this burp: https://portswigger.net/burp/documentation/desktop/tools/pro...

Sounds like they don't want you to analyze their site.

Re: Ask HN: Why does the US Visa application website do a port-scan of my network?

#30

Post by testdelacc1 »

edarchis wrote: post #10

Visa application is riddled with scams. From the simple website that charges you twice the price to websites that will tell you that you were rejected and then fake your documents to get in with your name. So they're probably trying to see that you're not one of those web servers, a proxy for them or detect some known C2 channels.

Another data point - 5he Indian visa system is similar. The official website ending in .gov.in, which is hard to find, offers a visa for $10 and minimal hassle. The scam websites, with better SEO sell the same shit for $80. They’re just proxying your application to the real website and pocketing the difference.

It would be good if the Indian government could block the scammers but I guess it’s a lower priority for the moment.

Post reply on HN