Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Is This Website Port Scanning Me?

nullsweep.com

Post reply on HN
Print view View original

301–310 of 448 posts

Re: Why Is This Website Port Scanning Me?

#301

Post by TomMarius »

fxtentacle wrote: post #292
seangrogg wrote: post #280

Earlier quoted context omitted.

WebRTC enables many of these things on the browser. That is the point. So your "I don't need WebRTC because I use native apps" is basically just "I don't need the internet because I can go next door to talk to my neighbors". Just because something doesn't have value for you does not suggest it does not have value, period.

Almost. I'd say my argument is "I don't care about an online egg retailer shipping from China, because using the local supermarket is better in every way." And obviously, Skype and IRC use the internet, too. So what is the benefit to me - the user - of "Skype inside web browser" over "Skype separate of web browser"? I understand that WebRTC makes "Skype inside web browser" possible, but it also makes a lot of less de…

That's just a matter of browser software. The Web platform should not suffer just because the browser is imperfect. You can write your perfect browser, fairly easily with the libraries available. I will try when I have some time.

Re: Why Is This Website Port Scanning Me?

#302

Post by jolmg »

jrockway wrote: post #298
jolmg wrote: post #248

> Port Scanning is Malicious Though port scanning can be (and maybe even frequently is) done with malicious intent by looking for misconfigured/bugged servers, I disagree that it's inherently malicious. Port scanning is just about checking to see what services a host is offering you. It's like going to a random shop at a mall and asking what services they provide. Would asking about their services be malicious? It fe…

I think the dynamics of the Internet have shifted from the early days. Basically, HTTPS on port 443 is pretty much the only service that anyone intends to make publicly available. This is different from 30 years ago, when those same sites had HTTP, FTP, Gopher, a public Telnet server, a public NTP server, etc. and they wanted you to use them. It was very reasonable to look around back then, but nowadays anything that…

Exactly! And do we want to continue on that trend? Personally, I don't.

I dislike the growing idea that HTTP is a core part of the internet, and not just the most popular part. The difference lies in if we're going to see legislation that dictates proper use of the lower networking layers like TCP/IP by stuff of the upper layers like HTTP. I'd really hate to see something along the lines of "it's illegal to use a TCP port unless it was specified as available to the public in some (possibly js-rendered) part of an HTTP response."

Re: Why Is This Website Port Scanning Me?

#303

Post by codezero »

zrobotics wrote: post #97
marcojrfurtado wrote: post #80

Earlier quoted context omitted.

There are legitimate reasons for port scanning, but I'm not sure most websites out there are using it for noble purposes. I guess browsers could allow it based on explicit permission from the user, just like it's already done for microphone and camera.

I'm curious, what would be a good reason to do this? I'm not creative enough to think of anything this enables a site to do that isn't malicious. If I'm running a service on localhost, and that service needs to communicate with the site I'm browsing, surely I could just direct that service to communicate with the site itself. For instance, if I'm running a local chat application and need it to communicate with the we…

Here's my hypothesis: it's to detect bots.

Your bot is running a redis server locally, it allows local connections, because it's just a bot, boom.

Taking it a bit further, if we have really smart people involved: the timing of the attempted connections/rejections tell you something about the system that you can use to detect bots/scrapers.

Another example of this being used in the past is to scan for chrome extensions that scrape site content as well. I believe LinkedIn might have gotten hit hard for trying something similar but they were using extension URLs not localhost. Some extensions do spin up localhost services though.

Re: Why Is This Website Port Scanning Me?

#304

Post by jmchuster »

jolmg wrote: post #260
jmchuster wrote: post #255

Earlier quoted context omitted.

Hmm, then how about going to the changing room area and trying every door instead of waiting for the guy to tell you which one to go to?

I made this edit to the post you replied to. You probably missed it: > If you want to continue using that analogy, then you have to consider that everybody is blind and deaf, and checking to see what's locked is the only way to know if something is available. About this: > instead of waiting for the guy to tell you which one to go to? How does that translate to TCP/IP? What is "the guy" representing? The way I see it…

The guy is you installing Steam to run on port 27036.

Re: Why Is This Website Port Scanning Me?

#306

Post by TekMol »

When you do this:

    new WebSocket("ws://127.0.0.1:8080")
An application listening on 8080 is indeed getting a packet delivered.

Run this to see the packet:

    nc -lp 8080
And the page can figure that out via the error returned.

I wonder if that is in line with the same origin policy.

On the other hand, maybe the same is possible by creating an image with src="http://127.0.0.1/hello.jpg" and looking at the onload/onerror event?

Re: Why Is This Website Port Scanning Me?

#307

Post by thephyber »

throwaway023421 wrote: post #169
dollers wrote: post #15

Earlier quoted context omitted.

Someone's never caught a case. You may not think this is true but the way the legal system works is everything is illegal. Then when they need to get you you are already guilty. Everyone else they just ignore. Crazy, right? LMAO a downvote in 3 seconds. Good old hacker news. Well, downvotes don't make you right. I'm trying to open your eyes and you downvote me. I guess that is to be expected.

Over the years I've seen "hacker" news become more of an echo chamber and instantly downvote anything against doctrine... I'll be downvoted for saying this.

> I'll be downvoted for saying this.

Because it's against the site guidelines.

> Please don't comment about the voting on comments. It never does any good, and it makes boring reading.[1]

[1] https://news.ycombinator.com/newsguidelines.html

Re: Why Is This Website Port Scanning Me?

#308

Post by cygx »

TekMol wrote: post #306

When you do this: new WebSocket("ws://127.0.0.1:8080") An application listening on 8080 is indeed getting a packet delivered. Run this to see the packet: nc -lp 8080 And the page can figure that out via the error returned. I wonder if that is in line with the same origin policy. On the other hand, maybe the same is possible by creating an image with src=" http://127.0.0.1/hello.jpg" and looking at the onload/onerror…

But note that a simple
should do so as well, ie this is just the newest iteration of an old problem that the major browser vendors never chose to properly address - with the exception of Opera, see eg this stackoverflow question [1] and corresponding answer from 2011.

[1] https://stackoverflow.com/questions/5464599

Re: Why Is This Website Port Scanning Me?

#309

Post by TekMol »

cygx wrote: post #308
TekMol wrote: post #306

When you do this: new WebSocket("ws://127.0.0.1:8080") An application listening on 8080 is indeed getting a packet delivered. Run this to see the packet: nc -lp 8080 And the page can figure that out via the error returned. I wonder if that is in line with the same origin policy. On the other hand, maybe the same is possible by creating an image with src=" http://127.0.0.1/hello.jpg" and looking at the onload/onerror…

But note that a simple should do so as well, ie this is just the newest iteration of an old problem that the major browser vendors never chose to properly address - with the exception of Opera, see eg this stackoverflow question [1] and corresponding answer from 2011. [1] https://stackoverflow.com/questions/5464599

The page could never read the contents of the image, right?

If the user has a web-socket-server running (for example because he is a developer) could the page read from it?

Can a page read from any web socket server on the internet?

Re: Why Is This Website Port Scanning Me?

#310

Post by efokschaner »

zrobotics wrote: post #97
marcojrfurtado wrote: post #80

Earlier quoted context omitted.

There are legitimate reasons for port scanning, but I'm not sure most websites out there are using it for noble purposes. I guess browsers could allow it based on explicit permission from the user, just like it's already done for microphone and camera.

I'm curious, what would be a good reason to do this? I'm not creative enough to think of anything this enables a site to do that isn't malicious. If I'm running a service on localhost, and that service needs to communicate with the site I'm browsing, surely I could just direct that service to communicate with the site itself. For instance, if I'm running a local chat application and need it to communicate with the we…

This might be banks trying to detect compromised users. Many "tech support" scams aim to get remote desktop access to users PC's and then have them log in to their bank while scammers are connected. I could see how banks looking for remote access software could be a useful heuristic in fighting this problem.
Post reply on HN