Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

eBay is port scanning visitors to their website

blog.nem.ec

Post reply on HN
Print view View original

31–40 of 148 posts

Re: eBay is port scanning visitors to their website

#31

Post by hazz99 »

moooo99 wrote: post #25
sva_ wrote: post #17

Earlier quoted context omitted.

As far as I know these port scans are done using WebRTC. Using a browser extension[0] it is easy to deactivate it on the go. Personally, I always have WebRTC disabled by default (as it has several nasty security implications), and only activate it if I explicitly need it for something. [0] https://addons.mozilla.org/en-US/firefox/addon/happy-bonobo-...

irrc, eBay uses websocket connections [0] to scan the ports. Firefox doesn't offer an option to disable websockets in the about:config page. However, I have read about workarounds by setting network.websocket.max-connections=0 This is a global setting and is applied to all websites. I also wasn't able to test this myself yet. Are there any good extensions for blocking websockets on for specific domains? [0] https://n…

To people reading this, many websites rely on websockets for real-time information. They would likely fallback to per-refresh HTTP requests, but it also may break a bunch of sites.

Re: eBay is port scanning visitors to their website

#35

Post by Sohcahtoa82 »

gear54rus wrote: post #33

What can you possibly know from such a scan? Standard clearly states that pretty much nothing: https://www.w3.org/TR/websockets/#concept-websocket-close-fa... Sure they're shady and that needs to be blocked, but security implications? Pretty much nil.

Timing attacks can be used to determine if the TCP connection was successful, even if no data could be exchanged because the WebSocket failed to negotiate.

Re: eBay is port scanning visitors to their website

#36

Post by olliej »

sva_ wrote: post #17
mehrdadn wrote: post #9

I asked this earlier and nobody had a response, so thought I'd ask it again: is there an extension to block this? Edit: @Windows users: pip install pydivert and then try to write a script to block connections from Chrome to non-Chrome processes. you might need GetTcpTable2() or something. (Looking into this now. Check out http://stackoverflow.com/a/25431340 )

As far as I know these port scans are done using WebRTC. Using a browser extension[0] it is easy to deactivate it on the go. Personally, I always have WebRTC disabled by default (as it has several nasty security implications), and only activate it if I explicitly need it for something. [0] https://addons.mozilla.org/en-US/firefox/addon/happy-bonobo-...

This is the kind of thing the webkit team at apple raised as privacy problems with webrtc. They got called IE.

But seriously, many new specs are very obviously abusable, yet on HN people seem unwilling to accept "this feature is trivially abusable" as a reason to not give developers a new feature, even when it is user hostile.

Web specs, and the webdevs he frequently want them, need to consider abusive developers being the default users of the API.

When working on WebGL it took an absurd amount of work to get non-web folk to understand that the spec had to be very tight and verifiable. I literally had to deal with people arguing that "developers won't ship shaders that crash the machine". It was painful.

Re: eBay is port scanning visitors to their website

#37

Post by olliej »

gear54rus wrote: post #33

What can you possibly know from such a scan? Standard clearly states that pretty much nothing: https://www.w3.org/TR/websockets/#concept-websocket-close-fa... Sure they're shady and that needs to be blocked, but security implications? Pretty much nil.

The original post about this seemed to indicate it might be being used to track, identify, and/or verify a client is a real system vs. a bot

Re: eBay is port scanning visitors to their website

#38

Post by cygx »

gear54rus wrote: post #33

What can you possibly know from such a scan? Standard clearly states that pretty much nothing: https://www.w3.org/TR/websockets/#concept-websocket-close-fa... Sure they're shady and that needs to be blocked, but security implications? Pretty much nil.

Sure they're shady and that needs to be blocked, but security implications? Pretty much nil.

Fingerprinting. Vulnerability discovery. Messing up programs that don't know how to deal with unexpected HTTP requests.

Re: eBay is port scanning visitors to their website

#39

Post by Google234 »

kevsim wrote: post #29
mobilio wrote: post #14

It's crystal clear why they do this. Many companies or persons share their desktops for remote usage. Later they sell this service to eBay users. And they're using it for different fraudulent activities - from making real sales (just for stars) to bidding to own items (for rising price). For years eBay fight this.

It seems like eBay wants it both ways. They want to have a huge user base with low friction to get started, but they also don't want fraudulent players. Instead of doing KYC (know your customer) like many financial services, they're stuck doing dirty tricks like this to try and combat fraud.

Why is it bad to have it both ways?

Re: eBay is port scanning visitors to their website

#40

Post by dpenguin »

eBay has a big fraud headache. They have a bunch of algorithms (from the pre-ML-hype days) that take a variety of inputs to determine whether a given transaction is fraudulent or not. Presence of remote login service on the user’s computer may tip the scale heavily in this calculation. Fraud detection is a necessary evil for all financial transaction companies in order to keep costs low for everyone else.

If you’re worried about privacy, use CCPA’s right to information and ask them for a dump of everything they have on you. They are supposed to give you info that other SPs like Threatmetrix have on you as well if they really are transmitting it to 3rd parties.

Post reply on HN