Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Is This Website Port Scanning Me?

nullsweep.com

Post reply on HN
Print view View original

131–140 of 448 posts

Re: Why Is This Website Port Scanning Me?

#131

Post by phkahler »

habyte wrote: post #88
bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

I'm sorry, what's the alternative for (soft-)real-time applications on frontend if not WebSocket? You probably do want to use it.

Native applications?

Not everything needs to run in a browser.

Re: Why Is This Website Port Scanning Me?

#132

Post by dvdkhlng »

owaislone wrote: post #111
dvdkhlng wrote: post #100

Earlier quoted context omitted.

No, webpage javascript is limited to using websocket protocol [1] for connections. That means your database or IP camera, or VoIP phone or router are safe for now. Though the websocket connection establishment seems to allow the javascript to differntiate between a closed and an open TCP socket and a TCP socket that speaks websocket. [1] https://en.wikipedia.org/wiki/WebSocket

So if a local service allows WS connections, can data be scrapped off such a service?

Yes, the primary (or only) reason to even implement a WS server connection is exactly to allow data to be scrapped off using a web-browser.

E.g. Asterisk nowadays allows enabling SIP protocol access over websocket so that you can run a javascript VoIP client from inside a browser [1] (and WebRTC for the media layer).

[1] https://wiki.asterisk.org/wiki/display/AST/Asterisk+Builtin+...

Re: Why Is This Website Port Scanning Me?

#133

Post by SmallPeePeeMan »

tlb wrote: post #115
zrobotics wrote: post #97

Earlier quoted context omitted.

I'm curious, what would be a good reason to do this? I'm not creative enough to think of anything this enables a site to do that isn't malicious. If I'm running a service on localhost, and that service needs to communicate with the site I'm browsing, surely I could just direct that service to communicate with the site itself. For instance, if I'm running a local chat application and need it to communicate with the we…

Ubiquiti routers have a fairly magical browser SPA that can run on their domain and talk to local routers. It involves webrtc connections to local addresses. But I think if same-origin were enforced more strictly, they could have found another way.

How is this different than the admin page for any other router brand? (SPA does not seem relevant to this discussion)

Re: Why Is This Website Port Scanning Me?

#134

Post by _bxg1 »

souterrain wrote: post #52

The greater issue is that browsers are allowing code executing from the public Internet scope (scope meaning security domain) network access to the localhost scope or the Intranet scope (RFC1918 addresses.) If anything, this should require very explicit permission granting from the user. I’d prefer it be something more like an undocumented toggle accessible solely to developer types.

Yes, it's very similar to CORS. They just need to block all localhost requests from non-localhost pages. Maybe carve out an exception for when the dev tools are open.

Re: Why Is This Website Port Scanning Me?

#135

Post by AnIdiotOnTheNet »

zrobotics wrote: post #97
marcojrfurtado wrote: post #80

Earlier quoted context omitted.

There are legitimate reasons for port scanning, but I'm not sure most websites out there are using it for noble purposes. I guess browsers could allow it based on explicit permission from the user, just like it's already done for microphone and camera.

I'm curious, what would be a good reason to do this? I'm not creative enough to think of anything this enables a site to do that isn't malicious. If I'm running a service on localhost, and that service needs to communicate with the site I'm browsing, surely I could just direct that service to communicate with the site itself. For instance, if I'm running a local chat application and need it to communicate with the we…

Synology uses it to find your unconfigured device on the network for first time setup.

Re: Why Is This Website Port Scanning Me?

#138

Post by jimmaswell »

jackewiehose wrote: post #99
bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

There is media.peerconnection.enabled in about:config. When set to false, WebRTC doesn't work but I'm not sure if there isn't anything left active. Also uBlock has an option "Prevent WebRTC from leaking IP adresses". WebRTC should be disabled by default or firefox should ask explicitly like with webcam-access. There have already been reports where sites use your browser as a peer in a P2P-network (without your consen…

> Prevent WebRTC from leaking IP adresses

A local IP?

Re: Why Is This Website Port Scanning Me?

#139

Post by Reelin »

djsumdog wrote: post #108
bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

Websockets are nice for some things. I hack on Mastodon and it uses WSS for streams and they're very helpful. But WebBluetooth, ASM, etc are all fairly insane. WebRTC feels like a massive security issue (I've seen a demo of someone using WebRTC to find computers on an internal network at a security conference years ago. Even if that hole is fixed, it's still a hacky solution to video streaming behind NAT). I agree; m…

> Even if that hole is fixed ...

Last I checked (> 1 year ago) it was WONTFIX because of some very idiotic (IMO) reasoning. I keep it permanently disabled and have never missed it (media.peerconnection.enabled in Firefox btw).

Re: Why Is This Website Port Scanning Me?

#140

Post by LunaSea »

SmallPeePeeMan wrote: post #126
habyte wrote: post #88

Earlier quoted context omitted.

I'm sorry, what's the alternative for (soft-)real-time applications on frontend if not WebSocket? You probably do want to use it.

Native applications.

Native applications have orders of magnitude more access to your system than a website has.
Post reply on HN