Why Is This Website Port Scanning Me? • Hacker News Board

Re: Why Is This Website Port Scanning Me?

#101

Post by gfxgirl » Wed, May 20, 2020, 2:41 PM UTC

This is bad and should be blocked IMO, at least by default, but can a site do anything other than find out which ports respond to a websocket request? AFAIK they can't send arbitrary network packets. The websocket will only open if the port they are trying to talk to speaks websocket back. This is mentioned in the article.

I'm not saying that's okay. I still don't want them scanning ports on my machine. There might be some services that offer a websocket connection like Plex for example, or the Kinect driver, or Leap Motion. I also don't want them cataloguing ports that are open.

Re: Why Is This Website Port Scanning Me?

#102

Post by jackewiehose » Wed, May 20, 2020, 2:41 PM UTC

habyte wrote: post #88

bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

I'm sorry, what's the alternative for (soft-)real-time applications on frontend if not WebSocket? You probably do want to use it.

The alternative is to ask the user on a site basis.

Re: Why Is This Website Port Scanning Me?

#103

Post by foobarplopp27 » Wed, May 20, 2020, 2:41 PM UTC

This guy Just has it wrong when he calls port scanning an adversarial technique. It's Just a way to discover Services. You can then use the result to do malicious things but it's not like the only or even main purpose. I humbly refer to this: https://koeln.ccc.de/ablage/portscan-policy.xml (Google translate can help with the german)

Re: Why Is This Website Port Scanning Me?

#104

Post by oplav » Wed, May 20, 2020, 2:41 PM UTC

marcosdumay wrote: post #95

souterrain wrote: post #52

The greater issue is that browsers are allowing code executing from the public Internet scope (scope meaning security domain) network access to the localhost scope or the Intranet scope (RFC1918 addresses.) If anything, this should require very explicit permission granting from the user. I’d prefer it be something more like an undocumented toggle accessible solely to developer types.

> to the localhost scope or the Intranet scope That's too little. All access from a different origin should be blocked by default, not only to local nets.

That's what CORS is for, but it appears that there is no CORS for WebSockets.

Re: Why Is This Website Port Scanning Me?

#105

Post by xg15 » Wed, May 20, 2020, 2:42 PM UTC

To my knowledge, a lot of effort has been put into the design of CORS (and related APIs) to specifically prevent misuse like that. A well-behaved Websocket implementation should not give the calling script any indication why a connection failed.

I know timing oracles are difficult to avoid in many cases - but the technique shown here seems to actually exploit different kinds of exceptions being thrown by the browser.

This seems like a straight-up bug and pretty serious security vulnerability to me.

Re: Why Is This Website Port Scanning Me?

#106

Post by crazygringo » Wed, May 20, 2020, 2:42 PM UTC

First of all, fraud detection seems like a legitimate use case here. And WebSockets has many valid uses.

HOWEVER -- how the hell is localhost port scanning allowed to happen without my permission?!

This feels no different from a website trying to check the existence of named directories on my file system or something.

Does WebSockets not require permission to function at all, or shouldn't it be limited to some kind of CORS-type policy or something to connect without a permissions dialog? Or even if it's allowed to port scan the entire public internet, at least block your local machine and network without explicit permission?

Re: Why Is This Website Port Scanning Me?

#107

Post by souterrain » Wed, May 20, 2020, 2:43 PM UTC

marcosdumay wrote: post #95

souterrain wrote: post #52

The greater issue is that browsers are allowing code executing from the public Internet scope (scope meaning security domain) network access to the localhost scope or the Intranet scope (RFC1918 addresses.) If anything, this should require very explicit permission granting from the user. I’d prefer it be something more like an undocumented toggle accessible solely to developer types.

> to the localhost scope or the Intranet scope That's too little. All access from a different origin should be blocked by default, not only to local nets.

I stand corrected. I think yours is the correct approach.

How shall origin be defined? I can envision the likes of Microsoft which have many, many second-level domains making calls between them.

We can’t allow the site itself to grant access. How would this be managed, other than “please stop and think what a domain name is supposed to be before spraying your product across twelve of them?”

Re: Why Is This Website Port Scanning Me?

#108

Post by djsumdog » Wed, May 20, 2020, 2:43 PM UTC

bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

Websockets are nice for some things. I hack on Mastodon and it uses WSS for streams and they're very helpful.

But WebBluetooth, ASM, etc are all fairly insane. WebRTC feels like a massive security issue (I've seen a demo of someone using WebRTC to find computers on an internal network at a security conference years ago. Even if that hole is fixed, it's still a hacky solution to video streaming behind NAT).

I agree; most of this stuff needs to have ways to disable it, in the base configuration screen of the browser (not hidden somewhere in about:config).

Re: Why Is This Website Port Scanning Me?

#109

Post by souterrain » Wed, May 20, 2020, 2:44 PM UTC

oplav wrote: post #104

marcosdumay wrote: post #95

Earlier quoted context omitted.

> to the localhost scope or the Intranet scope That's too little. All access from a different origin should be blocked by default, not only to local nets.

That's what CORS is for, but it appears that there is no CORS for WebSockets.

CORS is not in the hands of the user. I don’t want a CORS policy authorizing access to my intranet or localhost.

Re: Why Is This Website Port Scanning Me?

#110

Post by louis_pasteur » Wed, May 20, 2020, 2:44 PM UTC

bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

We need a simple browser implementation for the masses. Is there any such browser in existence?