Why Is This Website Port Scanning Me? • Hacker News Board

Re: Why Is This Website Port Scanning Me?

#111

Post by owaislone » Wed, May 20, 2020, 2:44 PM UTC

dvdkhlng wrote: post #100

owaislone wrote: post #89

This is scary. I've always left locally running services unprotected for convenience given they can't be accessed from outside. I can imagine a lot of people running local apps, servers or databases without any auth that could contain sensitive information. Would a webpage be able scrape data from such services? Any way to disable this completely in Firefox and Chrome?

No, webpage javascript is limited to using websocket protocol [1] for connections. That means your database or IP camera, or VoIP phone or router are safe for now. Though the websocket connection establishment seems to allow the javascript to differntiate between a closed and an open TCP socket and a TCP socket that speaks websocket. [1] https://en.wikipedia.org/wiki/WebSocket

So if a local service allows WS connections, can data be scrapped off such a service?

Re: Why Is This Website Port Scanning Me?

#112

Post by xg15 » Wed, May 20, 2020, 2:45 PM UTC

oplav wrote: post #104

marcosdumay wrote: post #95

Earlier quoted context omitted.

> to the localhost scope or the Intranet scope That's too little. All access from a different origin should be blocked by default, not only to local nets.

That's what CORS is for, but it appears that there is no CORS for WebSockets.

WS does have its own way of cross-domain opt-in. I think it users slightly different headers than CORS for historical reasons but effective does the same.

That a script is able to gather information about an origin that did not it in seems like a serious bug to me.

Re: Why Is This Website Port Scanning Me?

#113

Post by djsumdog » Wed, May 20, 2020, 2:45 PM UTC

the8472 wrote: post #85

bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

> So what, does Firefox need a freaking iptables implementation now? umatrix is the layer7 firewall you're looking for, it can block websocket connections, cross-domain ones in particular are quite easy.

I've had performance issues with umatrix. I tried blocking all JS by default and explicitly enabling scripts. In theory that should make the browser preform better. I suspect there are a bunch of sites that can't run a function or reach a JS resource and then just go into spin loops eating through resources .. either that or the blocking itself is resource intensive.

Re: Why Is This Website Port Scanning Me?

#114

Post by jerf » Wed, May 20, 2020, 2:46 PM UTC

pbhjpbhj wrote: post #42

jerf wrote: post #31

Earlier quoted context omitted.

Don't try to understand this with metaphors. It's a trap. Port scanning isn't enough like anything in the real world for the analogies to apply. I'd strengthen pfundstein's claim; port scanning intrinsically works by trying to open connections. That isn't enough "like" any particular physical thing to make it a correct analogy; it isn't knocking, or walking in, or opening, or anything else. But one thing we can say,…

I think your final objection fails by bad analogy too: one has to _actively_ direct ones gaze, in general, if one is to notice a type of lock or other security arrangements.

I'm not analogizing to "actively looking"; I am saying, it is an active action. You can tell it's active because if they don't make deliberate decisions to write code that performs this scan, no scan will happen. They have had meetings about this functionality, and implemented it, and tested it, and management has signed off on it, and in a place like eBay quite likely their legal department has signed off on it. It is an action they have taken, with deliberation and intention; it is not a thing that just suddenly started happening to them one day, like, Firefox shipping a new browser that has a new default font or something.

I'm referring to the literal, probably-hundreds-of-person-hours actions taken to create this functionality. This is relevant to both ethical and legal analyses. No analogy.

Re: Why Is This Website Port Scanning Me?

#115

Post by tlb » Wed, May 20, 2020, 2:46 PM UTC

zrobotics wrote: post #97

marcojrfurtado wrote: post #80

Earlier quoted context omitted.

There are legitimate reasons for port scanning, but I'm not sure most websites out there are using it for noble purposes. I guess browsers could allow it based on explicit permission from the user, just like it's already done for microphone and camera.

I'm curious, what would be a good reason to do this? I'm not creative enough to think of anything this enables a site to do that isn't malicious. If I'm running a service on localhost, and that service needs to communicate with the site I'm browsing, surely I could just direct that service to communicate with the site itself. For instance, if I'm running a local chat application and need it to communicate with the we…

Ubiquiti routers have a fairly magical browser SPA that can run on their domain and talk to local routers. It involves webrtc connections to local addresses.

But I think if same-origin were enforced more strictly, they could have found another way.

Re: Why Is This Website Port Scanning Me?

#116

Post by mcherm » Wed, May 20, 2020, 2:47 PM UTC

louis_pasteur wrote: post #110

bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

We need a simple browser implementation for the masses. Is there any such browser in existence?

There are no simple browsers, thus certainly no simple browser for the masses.

Re: Why Is This Website Port Scanning Me?

#117

Post by lqet » Wed, May 20, 2020, 2:49 PM UTC

bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

> Opening a WebSocket to netcat dumps out a HTTP request, so it seems unlikely that you'd be able to talk with anything that doesn't talk HTTP and WebSockets.

AFAIK this is only partly true, if the web server does not support the websocket protocol, you cannot connect to it [0].

So if I am understanding this correctly, WebSockets only support a small subset of HTTP and it should therefore not be possible to use them to connect to "classic" HTTP servers or to send GET or POST requests to it.

[0] https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_...

Re: Why Is This Website Port Scanning Me?

#118

Post by datenwolf » Wed, May 20, 2020, 2:49 PM UTC

bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

You forgot WebUSB – I wish I was joking, but I'm not:

https://developer.mozilla.org/en-US/docs/Web/API/USB

Re: Why Is This Website Port Scanning Me?

#119

Post by bjt2n3904 » Wed, May 20, 2020, 2:49 PM UTC

jackewiehose wrote: post #102

habyte wrote: post #88

Earlier quoted context omitted.

I'm sorry, what's the alternative for (soft-)real-time applications on frontend if not WebSocket? You probably do want to use it.

The alternative is to ask the user on a site basis.

That would be amazing, but it would never happen. Mom and Pop would always click "no" out of fear of the unknown, and my awesome feature wouldn't get used! It has to be enabled by default, they don't know what they're missing!

Re: Why Is This Website Port Scanning Me?

#120

Post by jimmaswell » Wed, May 20, 2020, 2:50 PM UTC

asudosandwich wrote: post #87

marcojrfurtado wrote: post #80

Earlier quoted context omitted.

There are legitimate reasons for port scanning, but I'm not sure most websites out there are using it for noble purposes. I guess browsers could allow it based on explicit permission from the user, just like it's already done for microphone and camera.

>> There are legitimate reasons for port scanning Such as?

IRC servers detect open proxies that way.