Port scanning localhost from a webpage has been possible for a long time and does not require websockets.
Why Is This Website Port Scanning Me?
161–170 of 448 posts
Re: Why Is This Website Port Scanning Me?
#162Earlier quoted context omitted.
Native applications? Not everything needs to run in a browser.
But that’s even worse! Native apps have even less (i.e. zero most of the time) sandboxing than the browser. This wouldn’t be a meaningful security improvement for anyone.
You use a much smaller set of applications than web sites. Moreover, you usually vet your applications and do not run random stuff. Application developers build up trust over time.
Even if I want to use the web as hypertext + some Javascript for interactivity, every stupid web site can pull these shenanigans.
Re: Why Is This Website Port Scanning Me?
#163Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…
> Opening a WebSocket to netcat dumps out a HTTP request, so it seems unlikely that you'd be able to talk with anything that doesn't talk HTTP and WebSockets. AFAIK this is only partly true, if the web server does not support the websocket protocol, you cannot connect to it [0]. So if I am understanding this correctly, WebSockets only support a small subset of HTTP and it should therefore not be possible to use them…
WebSocket connections are initialized by sending an HTTP request.
Re: Why Is This Website Port Scanning Me?
#164This raises the question: Is port scanning without consent a violation of the CFAA? Either it is legal, and researchers should face no repercussions for doing so, or it isn't and eBay is non-compliant with CFAA. I recall hearing about someone either being arrested or convicted due to port scanning a courthouse, but it was many years ago and I can't find the case with a cursory Google search. I have to wonder what val…
Bypassing a firewall to run a port scan is almost certainly illegal.
That’s what these sites are doing.
Re: Why Is This Website Port Scanning Me?
#165Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…
The ability to selectively enable those features would be ideal, but I disagree that their presence alone is a net negative.
Web browsers are the new cross-platform runtime, better to get used to it.
Re: Why Is This Website Port Scanning Me?
#166Earlier quoted context omitted.
Websockets are nice for some things. I hack on Mastodon and it uses WSS for streams and they're very helpful. But WebBluetooth, ASM, etc are all fairly insane. WebRTC feels like a massive security issue (I've seen a demo of someone using WebRTC to find computers on an internal network at a security conference years ago. Even if that hole is fixed, it's still a hacky solution to video streaming behind NAT). I agree; m…
Why is ASM insane? Are you talking about WASM? That’s got the same security model as JavaScript.
Which is where the trouble started.
Re: Why Is This Website Port Scanning Me?
#167It's why Tor Browser restricts access to localhost by default. This problem was already predicted and considered by Tor developers back in 2014, see ticket #10419 - Can requests to 127.0.0.1 be used to fingerprint the browser [0] and has been fixed since then. Scanning localhost is a dangerous way to fingerprint the user if there are local open ports.
If you are not using Tor Browser and want to fix the security hole without disabling WebSocket completely, running the web browser in a separate network namespace is a workaround - you get a loopback interface which is independent from the main namespace, and you create a NAT interface within the network namespace to allow outgoing traffic. It's also a possibility for a website to probe other machines, such as the setting page on your router. For better protection, you should block all the local addresses defined by RFC1918 via netfilter/iptables as well.
For developers who needs less restrictive blocking for debugging, you can run multiple Firefox processes in different profiles (firefox -P --new-instance), each running in a different network namespace - to make it easy, you can code everything in a shell script and create desktop icons for them. I normally use an ad-blocked and 3rd-party-cookies-blocked profile for web browsing, but a naked Firefox profile for development.
Re: Why Is This Website Port Scanning Me?
#168Earlier quoted context omitted.
CORS is not in the hands of the user. I don’t want a CORS policy authorizing access to my intranet or localhost.
If the user decides to run a service on their intranet or localhost with a wide open CORS policy, isn't that their choice? Forgoing CORS and making all inter domain requests user opt-in would make the web experience a lot worse, IMO. Making all intranet or localhost requests user opt-in seems less disruptive.
However, TCP sockets can't publish CORS policies.
In the case of scanning, a CORS denial can still reveal information about the user's internal network, as a CORS denial is a different result than a network timeout or a TCP RST.
Re: Why Is This Website Port Scanning Me?
#169This raises the question: Is port scanning without consent a violation of the CFAA? Either it is legal, and researchers should face no repercussions for doing so, or it isn't and eBay is non-compliant with CFAA. I recall hearing about someone either being arrested or convicted due to port scanning a courthouse, but it was many years ago and I can't find the case with a cursory Google search. I have to wonder what val…
Someone's never caught a case. You may not think this is true but the way the legal system works is everything is illegal. Then when they need to get you you are already guilty. Everyone else they just ignore. Crazy, right? LMAO a downvote in 3 seconds. Good old hacker news. Well, downvotes don't make you right. I'm trying to open your eyes and you downvote me. I guess that is to be expected.
Over the years I've seen "hacker" news become more of an echo chamber and instantly downvote anything against doctrine...
I'll be downvoted for saying this.
Re: Why Is This Website Port Scanning Me?
#170This does suggest to me that browser websocket requests against localhost should at least:
1) return the same error message for all failures (unless some opt-in / launch flag is set)
2) fiddle with the timing slightly to make timing attacks less useful? (how long is a localhost TLS connection? 100ms? I think devs can wait a handful of frames for their failure response.)
I have no idea how many legitimate apps are leveraging some kind of localhost connection -- it sounds like an unusual use case but I can certainly imagine some enterprise app that ties into desktop services or programs by that route.
EDIT: Of course banning them outright or requiring specific user whitelisting of domains would work as well. Just trying to get away with the smallest change.