Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Is This Website Port Scanning Me?

nullsweep.com

Post reply on HN
Print view View original

291–300 of 448 posts

Re: Why Is This Website Port Scanning Me?

#291

Post by splonk »

> Furthermore, when I installed and ran a VNC server, I didn't detect any difference in site behavior - so why is it looking for it?

Not an eBay employee, but used to work in fraud detection. Two very obvious related guesses from my experience:

1. Fingerprinting a user to help identify account takeover (ATO). Open port signatures is probably a pretty good signal for that kind of thing (and it doesn't seem to be measured in https://panopticlick.eff.org/).

> However it is also a valid tool used by administrators for remote access to machines, or by some end user support software, so the presence of VNC is a poor indicator of malware.

2. In a Bayesian sense, this probably isn't right. I don't know what eBay's traffic looks like but I'm willing to bet that all other things being equal, traffic coming from a machine with an open VNC port is riskier. Fraud detection is a game of probabilities, so the existence of a valid user showing a particular characteristic doesn't mean that the characteristic isn't useful in a fraud model. The example I always give is that when I was doing this (quite some time ago), we could have had a 99% accuracy rate for a simple rule banning IPs from Turkey, Ghana, Nigeria, and Vietnam. It's not because there weren't any valid users from those countries, it's just that the fraudsters where overwhelmingly likely to be using IPs from those countries.

Re: Why Is This Website Port Scanning Me?

#292

Post by fxtentacle »

seangrogg wrote: post #280
fxtentacle wrote: post #258

Earlier quoted context omitted.

Plenty of downvotes, but no productive suggestion of what use-case would be best served with WebRTC ...

WebRTC enables many of these things on the browser. That is the point. So your "I don't need WebRTC because I use native apps" is basically just "I don't need the internet because I can go next door to talk to my neighbors". Just because something doesn't have value for you does not suggest it does not have value, period.

Almost. I'd say my argument is "I don't care about an online egg retailer shipping from China, because using the local supermarket is better in every way."

And obviously, Skype and IRC use the internet, too. So what is the benefit to me - the user - of "Skype inside web browser" over "Skype separate of web browser"?

I understand that WebRTC makes "Skype inside web browser" possible, but it also makes a lot of less desirable behavior possible. So there is be a trade-off between the advantages and the risks from adding WebRTC.

Which benefit does WebRTC generate for the user? I.e. why is it a good thing that web browsers added this?

Re: Why Is This Website Port Scanning Me?

#293

Post by jolmg »

tjoff wrote: post #290
jolmg wrote: post #248

> Port Scanning is Malicious Though port scanning can be (and maybe even frequently is) done with malicious intent by looking for misconfigured/bugged servers, I disagree that it's inherently malicious. Port scanning is just about checking to see what services a host is offering you. It's like going to a random shop at a mall and asking what services they provide. Would asking about their services be malicious? It fe…

A server most definitely should not be looking at what random services a client has available.

Sure, like I said:

> Though port scanning can be (and maybe even frequently is) done with malicious intent

I agree that it's wrong for eBay to be doing this. What I disagree with is specifically the statement "Port Scanning is Malicious".

Re: Why Is This Website Port Scanning Me?

#294

Post by dullgiulio »

Wowfunhappy wrote: post #288
bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

I realize Hacker News isn't a hivemind, but I see these two assertions frequently, and I find the contradiction striking: 1. Why are web browsers becoming application platforms? Web browsers are document readers, and we should treat them as such. 2. Why does Zoom (or Slack, or insert-thing-here) want me to download a native app? I should be able to do it in my web browser! I sympathize with both philosophies, but the…

Nope, this is a strawman argument you're making.

Parent is asking for granular access control over these very advanced and double-edged features, which is a perfectly valid request.

Having permissions is the norm for native apps on mobile, and it's slowly becoming the norm also on desktop, finally.

Browsers are the new OS, they have to implement permissions too without anything enabled by default.

Re: Why Is This Website Port Scanning Me?

#296

Post by CobrastanJorji »

anderspitman wrote: post #287

Curious what HN thinks about this hypothetical: Imagine you have a web app designed to talk to a specific backend server API. It's also common for users to run instances of the server on their local machine. How would you feel about the app checking a (single) well-known port to see if there's a local server running, and prompting the user: "we detected you're running a local copy of the server, do you want to connec…

I don't think the case that you're describing is unethical, but I also don't see it as beneficial enough to outweigh the security risks of it being possible.

Re: Why Is This Website Port Scanning Me?

#298

Post by jrockway »

jolmg wrote: post #248

> Port Scanning is Malicious Though port scanning can be (and maybe even frequently is) done with malicious intent by looking for misconfigured/bugged servers, I disagree that it's inherently malicious. Port scanning is just about checking to see what services a host is offering you. It's like going to a random shop at a mall and asking what services they provide. Would asking about their services be malicious? It fe…

I think the dynamics of the Internet have shifted from the early days. Basically, HTTPS on port 443 is pretty much the only service that anyone intends to make publicly available. This is different from 30 years ago, when those same sites had HTTP, FTP, Gopher, a public Telnet server, a public NTP server, etc. and they wanted you to use them. It was very reasonable to look around back then, but nowadays anything that is available publicly is probably an accident.

Re: Why Is This Website Port Scanning Me?

#299

Post by jgwil2 »

clarry wrote: post #246
akerro wrote: post #158

Interesting, port scanning is illegal in some countries as it's classified as security testing, it can be only performed with permission. How would you feel is someone was walking on busy car parking and checking if doors of the cars are open? It' what port scanning is, checking if the car has open door.

> How would you feel is someone was walking on busy car parking and checking if doors of the cars are open? It' what port scanning is, checking if the car has open door. More like sending a "hi, can I enter?" signal to a self-driving taxi that has been left waiting in a public arena. Don't put a server online with a public IP if you don't want to receive those signals. Don't send "hi yes you can enter!" responses whe…

Except in the case described by the article, the port scanning is being done not on servers on the public internet but on clients of certain websites.

Re: Why Is This Website Port Scanning Me?

#300

Post by jolmg »

AaronFriel wrote: post #257
Cakez0r wrote: post #250

Earlier quoted context omitted.

I think it's a bit more like going on to a shop and trying to open all the doors, cupboards and drawers to see which ones are locked ;)

Isn't that the wrong analogy? In this case, eBay is the shop, and I'm the customer. It's like walking into eBay and when I walk in I have to empty out all of my pockets and open my phone screen to show them that no one is telling me what to shop for (VNC).

No, because of the existence of client-side scripting with javascript, it's actually eBay that's running on your computer acting as the customer toward the shop that's your computer. You're right that the end effect is similar to having to empty out your pockets, but the underlying issue of why they're able to do that is a whole 'nother can of worms.
Post reply on HN