Is there a way to block this at the browser level? Ex: block access to localhost for all domains (except from localhost itself)?
Why Is This Website Port Scanning Me?
21–30 of 448 posts
Re: Why Is This Website Port Scanning Me?
#22port scanning is fine and should not be illegal. It's just "looking" at a house to see if there is a door and what type of key (protocol) it uses. Trying to open a connection on the other hand it's like trying to open the door. That should be considered as a violation.
Most port scanning works by 'Trying to open a connection'. I'm not sure where you're saying the line is, but it's very fuzzy.
Re: Why Is This Website Port Scanning Me?
#23This raises the question: Is port scanning without consent a violation of the CFAA? Either it is legal, and researchers should face no repercussions for doing so, or it isn't and eBay is non-compliant with CFAA. I recall hearing about someone either being arrested or convicted due to port scanning a courthouse, but it was many years ago and I can't find the case with a cursory Google search. I have to wonder what val…
> I have to wonder what value eBay would get from port scanning its customers.
From the article:
> Looking at the list of ports they are scanning, they are looking for VNC services being run on the host, which is the same thing that was reported for bank sites.
> VNC is sometimes run as part of bot nets or viruses as a way to remotely log into a users computer. There are several malware services that leverage VNC for these purposes.
Re: Why Is This Website Port Scanning Me?
#24port scanning is fine and should not be illegal. It's just "looking" at a house to see if there is a door and what type of key (protocol) it uses. Trying to open a connection on the other hand it's like trying to open the door. That should be considered as a violation.
Port scanning from an external host is fine and dandy, but doing it on localhost from the user's browser crosses the line, IMO.
Re: Why Is This Website Port Scanning Me?
#25Earlier quoted context omitted.
IANAL, but more likely it depends on intent and context. So shodan.io is okay because it’s not explicitly malicious, and they have clear paths to contact them if you suspect abuse. Whereas, if you’re suspected of hacking a website, the fact that you port scanned it a week prior to password spraying it might serve as evidence against you. That is, it seems unlikely anyone would be prosecuted for port scanning alone, b…
What's Shodan.io's legitimate use? Sounds like the "torrents can be used for legitimate content" type argument where in reality you a rounding error the use is not lawful??
If I were a serious baddie, I'd be afraid of using Shodan. Who knows who has what logging on that, and what honeypots may have been seeded into it for just such an occasion? It's not that hard to get that information yourself, from sources you control yourself.
Legitimate usage from researchers and people reading about infrastructure they have the right to do security testing on may be a larger percentage than you think.
Re: Why Is This Website Port Scanning Me?
#26Earlier quoted context omitted.
IANAL, but more likely it depends on intent and context. So shodan.io is okay because it’s not explicitly malicious, and they have clear paths to contact them if you suspect abuse. Whereas, if you’re suspected of hacking a website, the fact that you port scanned it a week prior to password spraying it might serve as evidence against you. That is, it seems unlikely anyone would be prosecuted for port scanning alone, b…
What's Shodan.io's legitimate use? Sounds like the "torrents can be used for legitimate content" type argument where in reality you a rounding error the use is not lawful??
I used to use torrents a lot and always for legitimate data transfers.
Re: Why Is This Website Port Scanning Me?
#27Earlier quoted context omitted.
Not illegal. Sites like shodan.io would have an issue if it was.
IANAL but this type of websocket port scan seems inherently different from what Shodan does. Shodan is outside your network's firewall, therefore only able to access services you've exposed to the wider web. If I understand the article, the websocket scan eBay is doing is trying to connect to local listeners on your laptop, behind your network's firewall and possibly even behind your laptop's firewall.
This is such an obvious consequence of web sockets that I wonder how anyone could have entertained the idea long enough to sober up and write the code. This is worse than letting a web page script have access to the clipboard, record mouse movements, and similar information leaks, because instead of just stealing information, now a web page can actively compromise any host on your network.
Re: Why Is This Website Port Scanning Me?
#28Earlier quoted context omitted.
IANAL, but more likely it depends on intent and context. So shodan.io is okay because it’s not explicitly malicious, and they have clear paths to contact them if you suspect abuse. Whereas, if you’re suspected of hacking a website, the fact that you port scanned it a week prior to password spraying it might serve as evidence against you. That is, it seems unlikely anyone would be prosecuted for port scanning alone, b…
What's Shodan.io's legitimate use? Sounds like the "torrents can be used for legitimate content" type argument where in reality you a rounding error the use is not lawful??
There are plenty of legitimate uses of port scanning, and specifically, a port scanning database like Shodan. For example:
- Monitoring your own network or that of your clients for exposed ports
- Researching Internet topology, or performing aggregate queries like “how many nginx servers are connected to the Internet”
Can you use it maliciously? Yes. But, most of the time, if you have a target it would make more sense to do the port scan yourself. And if you’re just dragnet searching for vulnerabilities, most you find will probably already have been exploited. Sites like shodan are good for the overall health of the web because they force website owners to maintain security posture. If you know that foregoing a wordpress upgrade means you’re one script kiddy with a shodan account away from getting hacked, you’re going to keep your site up to date. This saves you from script kiddies, but also from the more sophisticated hackers who would run a port scan themselves anyway.
Re: Why Is This Website Port Scanning Me?
#29Earlier quoted context omitted.
Not illegal. Sites like shodan.io would have an issue if it was.
That's a fallacious argument. The fact that someone is doing something doesn't mean it's automatically legal.
The more pointed argument would be there is no federal law prohibiting port scans.
Re: Why Is This Website Port Scanning Me?
#30port scanning is fine and should not be illegal. It's just "looking" at a house to see if there is a door and what type of key (protocol) it uses. Trying to open a connection on the other hand it's like trying to open the door. That should be considered as a violation.
Imagine you start to look at houses in your neighborhood « to see if there is a door and what type of key it uses ».
That sounds pretty suspicious to me. At least you need the consent of the house’s owner.