Why Is This Website Port Scanning Me? • Hacker News Board

Re: Why Is This Website Port Scanning Me?

#271

Post by hanniabu » Wed, May 20, 2020, 5:40 PM UTC

segfaultbuserr wrote: post #167

It's why Tor Browser restricts access to localhost by default. This problem was already predicted and considered by Tor developers back in 2014, see ticket #10419 - Can requests to 127.0.0.1 be used to fingerprint the browser [0] and has been fixed since then. Scanning localhost is a dangerous way to fingerprint the user if there are local open ports. If you are not using Tor Browser and want to fix the security hole…

> If you are not using Tor Browser and want to fix the security hole without disabling WebSocket completely, running the web browser in a separate network namespace is a workaround - you get a loopback interface which is independent from the main namespace, and you create a NAT interface within the network namespace to allow outgoing traffic. It's also a possibility for a website to probe other machines, such as the setting page on your router. For better protection, you should block all the local addresses defined by RFC1918 via netfilter/iptables as well.

As someone less tech savvy but still concerned, are there any guides available on how to do this?

Re: Why Is This Website Port Scanning Me?

#272

Post by bjt2n3904 » Wed, May 20, 2020, 5:41 PM UTC

gsnedders wrote: post #240

bjt2n3904 wrote: post #119

Earlier quoted context omitted.

That would be amazing, but it would never happen. Mom and Pop would always click "no" out of fear of the unknown, and my awesome feature wouldn't get used! It has to be enabled by default, they don't know what they're missing!

That's literally the opposite of the concern with permission prompts: all the evidence from years of SSL/TLS certificate errors is that users will blindly grant permission.

This is true -- and it may also be the same for miscellaneous permissions. But that doesn't mean it won't be used as an excuse by the feature developers.

Honestly though, this is just me being bitter at web developers.

Re: Why Is This Website Port Scanning Me?

#273

Post by Kipters » Wed, May 20, 2020, 5:43 PM UTC

gsnedders wrote: post #221

segfaultbuserr wrote: post #167

It's why Tor Browser restricts access to localhost by default. This problem was already predicted and considered by Tor developers back in 2014, see ticket #10419 - Can requests to 127.0.0.1 be used to fingerprint the browser [0] and has been fixed since then. Scanning localhost is a dangerous way to fingerprint the user if there are local open ports. If you are not using Tor Browser and want to fix the security hole…

> It's why Tor Browser restricts access to localhost by default. This problem was already predicted and considered by Tor developers back in 2014, see ticket #10419 Sorry to invoke the meme, but Opera did it first[0], in Opera 9.50 (2008). I don't have a good reference to hand, but [1] is a developer complaining about this. [Edit: [2] covers the feature in some detail.] Opera also blocked access to private IP address…

UWP apps block requests to localhost too for the same reason

Re: Why Is This Website Port Scanning Me?

#274

Post by travisporter » Wed, May 20, 2020, 5:45 PM UTC

wronex wrote: post #210

louis_pasteur wrote: post #110

Earlier quoted context omitted.

We need a simple browser implementation for the masses. Is there any such browser in existence?

Agreed. Firefox99, latest Firefox but party like it's 1999. Web* disabled. Canvas disabled. LocalStorage disabled. DRM-content disabled. Anything else we don't need?

You've inpsired me!

In Firefox:

LocalStorage - about:config Dom.storage.enabled

Canvas - block JS via noscript

DRM - Preferences->Disable DRM content checkbox

WebRTC - about:config media.peerconnection.enabled;

As a side note, noscript has been an eye-opener for how many things are loaded when I open anywebsite! It's been fast, but I've been getting annoyed by guessing what to enable to move past a blank webpage. And WTF is newrelic and why does half of my internet browsing use it?

Re: Why Is This Website Port Scanning Me?

#275

Post by parliament32 » Wed, May 20, 2020, 5:46 PM UTC

gruez wrote: post #56

xur17 wrote: post #21

Is there a way to block this at the browser level? Ex: block access to localhost for all domains (except from localhost itself)?

Ublock allows you to block websocket requests. eg. *$websocket will block all websocket connections. You probably want to operate on a whitelist on a site by site basis. Blocking localhost or 127.0.0.1 isn't reliable because sites can use dns rebinding attacks to bypass your filters.

That helps one of the vectors, but you can scan with pure JS too: https://portswigger.net/research/exposing-intranets-with-rel...

Re: Why Is This Website Port Scanning Me?

#276

Post by brainzap » Wed, May 20, 2020, 5:48 PM UTC

This is why the websocket implementation does not have meaningful error codes, so people can not abuse it. But they still do.

Re: Why Is This Website Port Scanning Me?

#277

Post by hanniabu » Wed, May 20, 2020, 5:50 PM UTC

fr2null wrote: post #194

Reelin wrote: post #145

Earlier quoted context omitted.

Yes, oddly enough. It can be used by a website you visit to gain information about your local network which turns out to be incredibly effective for fingerprinting.

WebRTC can also leak your IP when you're hiding behind a VPN.

Any way to stop that?

Re: Why Is This Website Port Scanning Me?

#278

Post by awinter-py » Wed, May 20, 2020, 5:53 PM UTC

TLDR because you have javascript enabled

Re: Why Is This Website Port Scanning Me?

#279

Post by ac29 » Wed, May 20, 2020, 5:54 PM UTC

kchr wrote: post #224

akerro wrote: post #158

Interesting, port scanning is illegal in some countries as it's classified as security testing, it can be only performed with permission. How would you feel is someone was walking on busy car parking and checking if doors of the cars are open? It' what port scanning is, checking if the car has open door.

Is opening car doors illegal if you never enter the car/steal anything?

A motivated prosecutor could almost certainly find something to throw at you - some variety of public nuisance law or something.

Re: Why Is This Website Port Scanning Me?

#280

Post by seangrogg » Wed, May 20, 2020, 5:54 PM UTC

fxtentacle wrote: post #258

fxtentacle wrote: post #208

Earlier quoted context omitted.

Most of the other uses are pointless. I don't need WebRTC for chat, because IRC is still working just fine. I don't need WebRTC for video calls, because Skype is still working just fine. I don't need WebRTC and WebAssembly for online gaming, because I have Steam to install games locally. Plus latency and performance of games emscripten-ed to wasm tends to be atrocious. So the only uses where I have seen the new Web*…

Plenty of downvotes, but no productive suggestion of what use-case would be best served with WebRTC ...

WebRTC enables many of these things on the browser. That is the point. So your "I don't need WebRTC because I use native apps" is basically just "I don't need the internet because I can go next door to talk to my neighbors".

Just because something doesn't have value for you does not suggest it does not have value, period.