Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Is This Website Port Scanning Me?

nullsweep.com

Post reply on HN
Print view View original

311–320 of 448 posts

Re: Why Is This Website Port Scanning Me?

#311

Post by neurostimulant »

klodolph wrote: post #141
djsumdog wrote: post #108

Earlier quoted context omitted.

Websockets are nice for some things. I hack on Mastodon and it uses WSS for streams and they're very helpful. But WebBluetooth, ASM, etc are all fairly insane. WebRTC feels like a massive security issue (I've seen a demo of someone using WebRTC to find computers on an internal network at a security conference years ago. Even if that hole is fixed, it's still a hacky solution to video streaming behind NAT). I agree; m…

Why is ASM insane? Are you talking about WASM? That’s got the same security model as JavaScript.

WASM is great peace of tech but I can't help to think it would be abused a lot in the future. For example, right now we can use ad blocker to block ads and analytics by blocking its js from loading. Imagine when wasm gains mainstream popularity and ad companies begin to ship their ads and analytics product as a libaries to be linked at compile time. How do we block something like that? Sure the adblocker can hide the relevant dom contents, but the code is still run and doing whatever it want on your browser.

Re: Why Is This Website Port Scanning Me?

#312

Post by cygx »

TekMol wrote: post #309
cygx wrote: post #308

Earlier quoted context omitted.

But note that a simple should do so as well, ie this is just the newest iteration of an old problem that the major browser vendors never chose to properly address - with the exception of Opera, see eg this stackoverflow question [1] and corresponding answer from 2011. [1] https://stackoverflow.com/questions/5464599

The page could never read the contents of the image, right? If the user has a web-socket-server running (for example because he is a developer) could the page read from it? Can a page read from any web socket server on the internet?

If the user has a web-socket-server running (for example because he is a developer) could the page read from it?

Only if that server chooses to accept the request, which it can decide based on the Origin header.

Personally, I was more concerned with getting spurious requests on ports bound to 127.0.0.1 (which I've been using for IPC), but that issue already existed before the introduction of WebSockets.

WebSockets of course do make things like port scanning easier, but as others have pointed out, you could already do that with a bit of ingenuity eg through tracking response times.

Re: Why Is This Website Port Scanning Me?

#314

Post by coribuci »

fxtentacle wrote: post #258
fxtentacle wrote: post #208

Earlier quoted context omitted.

Most of the other uses are pointless. I don't need WebRTC for chat, because IRC is still working just fine. I don't need WebRTC for video calls, because Skype is still working just fine. I don't need WebRTC and WebAssembly for online gaming, because I have Steam to install games locally. Plus latency and performance of games emscripten-ed to wasm tends to be atrocious. So the only uses where I have seen the new Web*…

Plenty of downvotes, but no productive suggestion of what use-case would be best served with WebRTC ...

> Plenty of downvotes, but no productive suggestion of what use-case would be best served with WebRTC ...

Worms. Todays web browser are like MS office 15 years ago. A disaster waiting to happen.

Re: Why Is This Website Port Scanning Me?

#315

Post by kevingadd »

souterrain wrote: post #109
oplav wrote: post #104

Earlier quoted context omitted.

That's what CORS is for, but it appears that there is no CORS for WebSockets.

CORS is not in the hands of the user. I don’t want a CORS policy authorizing access to my intranet or localhost.

CORS is set by the target, so localhost CORS policy is directly in the hands of the user. intranet CORS policy is set by whoever operates that intranet service

Re: Why Is This Website Port Scanning Me?

#316

Post by cameronperot »

anderspitman wrote: post #281
hanniabu wrote: post #271

Earlier quoted context omitted.

> If you are not using Tor Browser and want to fix the security hole without disabling WebSocket completely, running the web browser in a separate network namespace is a workaround - you get a loopback interface which is independent from the main namespace, and you create a NAT interface within the network namespace to allow outgoing traffic. It's also a possibility for a website to probe other machines, such as the…

You can look into tools like firejail to make this easier.

+1 for firejail [1]. There's a guide on how to do this for firefox [2] (see the network setup section), but this can be used with other applications as well.

[1] https://firejail.wordpress.com/

[2] https://firejail.wordpress.com/documentation-2/firefox-guide...

Re: Why Is This Website Port Scanning Me?

#317

Post by neurostimulant »

travisporter wrote: post #274
wronex wrote: post #210

Earlier quoted context omitted.

Agreed. Firefox99, latest Firefox but party like it's 1999. Web* disabled. Canvas disabled. LocalStorage disabled. DRM-content disabled. Anything else we don't need?

You've inpsired me! In Firefox: LocalStorage - about:config Dom.storage.enabled Canvas - block JS via noscript DRM - Preferences->Disable DRM content checkbox WebRTC - about:config media.peerconnection.enabled; As a side note, noscript has been an eye-opener for how many things are loaded when I open anywebsite! It's been fast, but I've been getting annoyed by guessing what to enable to move past a blank webpage. And…

Newrelic is an application performance monitoring platform, basically give you performance insight on your webapp, so it gain popularity really fast. Really great for identifying performance bottleneck on the server side. Later on, they launched browser monitoring too, so now all webserver that uses newrelic automatically insert newrelic js analytics on every html endpoint.

Re: Why Is This Website Port Scanning Me?

#318

Post by ekimekim »

xur17 wrote: post #21

Is there a way to block this at the browser level? Ex: block access to localhost for all domains (except from localhost itself)?

I do this by running my browser in its own network namespace, with NAT to the outside world. A couple more firewall rules explicitly add forwarding for specific localhost ports.

Re: Why Is This Website Port Scanning Me?

#320

Post by grendelt »

api wrote: post #60
souterrain wrote: post #52

The greater issue is that browsers are allowing code executing from the public Internet scope (scope meaning security domain) network access to the localhost scope or the Intranet scope (RFC1918 addresses.) If anything, this should require very explicit permission granting from the user. I’d prefer it be something more like an undocumented toggle accessible solely to developer types.

Yeah, that's the best solution. It should be like microphone or camera access. It should say "this web site is attempting to access a resource on your local system / network." I don't think you need to overdo it in terms of making the warning red, etc. Just a popup will really discourage people from trying to use this for fingerprinting. BTW the site says: "Port scanning is malicious." I don't agree. There are many m…

Right. "it is clearly malicious behavior and may fall on the wrong side of the law."

It's not against the law. It might be _shady_ but it's not illegal. When I'm teaching cyber intro classes, I let folks know portscanning is NOT illegal but shady. It's like going to a business after hours. It's not illegal to rattle doors and windows to see if they're locked. The police might have a different take on it, but it's not illegal.

Post reply on HN