Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Is This Website Port Scanning Me?

nullsweep.com

Post reply on HN
Print view View original

151–160 of 448 posts

Re: Why Is This Website Port Scanning Me?

#151

Post by jschwartzi »

bjt2n3904 wrote: post #123
asudosandwich wrote: post #87

Earlier quoted context omitted.

>> There are legitimate reasons for port scanning Such as?

You run a network, and want to run a security audit. You need to know what devices are operating on it, and what services they are offering. I don't get upset if someone opens and closes a socket to my VPS to see if something's there. My VPS is exposed to the internet. If a socket opens, it should be secure anyways. There's the chance nginx has an unknown zero day, but if I wanted to avoid that, I'd firewall it. Thin…

What about port scanning your service before you've secured it during development? At some point we have to be able to trust the network we're on. It's ludicrous to expect everything to be configured correctly and securely right from the start especially if you're developing the thing being scanned while it's being scanned. I'd much rather websites not be able to scan my home or office network than have to treat that network like I treat the Internet.

Re: Why Is This Website Port Scanning Me?

#152

Post by owaislone »

dvdkhlng wrote: post #132
owaislone wrote: post #111

Earlier quoted context omitted.

So if a local service allows WS connections, can data be scrapped off such a service?

Yes, the primary (or only) reason to even implement a WS server connection is exactly to allow data to be scrapped off using a web-browser. E.g. Asterisk nowadays allows enabling SIP protocol access over websocket so that you can run a javascript VoIP client from inside a browser [1] (and WebRTC for the media layer). [1] https://wiki.asterisk.org/wiki/display/AST/Asterisk+Builtin+...

Sure but such servers would always implement authentication when deployed to the web but a lot of such services could run locally unauthenticated to serve local apps. For example services to power electron apps. This tells me data from such services can be stolen very easily.

Re: Why Is This Website Port Scanning Me?

#153

Post by thanksforfish »

gruez wrote: post #56
xur17 wrote: post #21

Is there a way to block this at the browser level? Ex: block access to localhost for all domains (except from localhost itself)?

Ublock allows you to block websocket requests. eg. *$websocket will block all websocket connections. You probably want to operate on a whitelist on a site by site basis. Blocking localhost or 127.0.0.1 isn't reliable because sites can use dns rebinding attacks to bypass your filters.

This helps, but can't you also do this sort of scanning without websockets?

Re: Why Is This Website Port Scanning Me?

#154

Post by have_faith »

bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

I don't think there's anything wrong with any of those things with a sane permissions system attached (strict opt in per site).

The web is now a no-install app delivery platform, it makes sense for these things to exist.

Re: Why Is This Website Port Scanning Me?

#155

Post by cgranier »

bjt2n3904 wrote: post #123
asudosandwich wrote: post #87

Earlier quoted context omitted.

>> There are legitimate reasons for port scanning Such as?

You run a network, and want to run a security audit. You need to know what devices are operating on it, and what services they are offering. I don't get upset if someone opens and closes a socket to my VPS to see if something's there. My VPS is exposed to the internet. If a socket opens, it should be secure anyways. There's the chance nginx has an unknown zero day, but if I wanted to avoid that, I'd firewall it. Thin…

But that's a very different use case than having a website you visit portscan your computer (which I believe is what the user above you is referring to.

There's really no legitimate reason for eBay, or any other website, to portscan your computer. There's nothing there needed for browsing their website.

Re: Why Is This Website Port Scanning Me?

#156

Post by jorams »

jimmaswell wrote: post #120
asudosandwich wrote: post #87

Earlier quoted context omitted.

>> There are legitimate reasons for port scanning Such as?

IRC servers detect open proxies that way.

IRC servers don't run in a browser. Instead they scan ports from the outside, which is not a problem. Anything they find is open to the entire internet anyway.

Re: Why Is This Website Port Scanning Me?

#158

Post by akerro »

Interesting, port scanning is illegal in some countries as it's classified as security testing, it can be only performed with permission.

How would you feel is someone was walking on busy car parking and checking if doors of the cars are open? It' what port scanning is, checking if the car has open door.

Re: Why Is This Website Port Scanning Me?

#160

Post by dvdkhlng »

owaislone wrote: post #152
dvdkhlng wrote: post #132

Earlier quoted context omitted.

Yes, the primary (or only) reason to even implement a WS server connection is exactly to allow data to be scrapped off using a web-browser. E.g. Asterisk nowadays allows enabling SIP protocol access over websocket so that you can run a javascript VoIP client from inside a browser [1] (and WebRTC for the media layer). [1] https://wiki.asterisk.org/wiki/display/AST/Asterisk+Builtin+...

Sure but such servers would always implement authentication when deployed to the web but a lot of such services could run locally unauthenticated to serve local apps. For example services to power electron apps. This tells me data from such services can be stolen very easily.

Electron apps have much more access permissions than a normal website. I don't know technical details of how electron apps interact with the bundled chrome, however this post [1] suggests that electron apps can just talk low-level TCP protocol, no need to wrap everything in an additional websocket protocol layer.

[1] https://stackoverflow.com/questions/41674063/is-it-possible-...

Post reply on HN