Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Is This Website Port Scanning Me?

nullsweep.com

Post reply on HN
Print view View original

321–330 of 448 posts

Re: Why Is This Website Port Scanning Me?

#321

Post by AdmiralAsshat »

segfaultbuserr wrote: post #167

It's why Tor Browser restricts access to localhost by default. This problem was already predicted and considered by Tor developers back in 2014, see ticket #10419 - Can requests to 127.0.0.1 be used to fingerprint the browser [0] and has been fixed since then. Scanning localhost is a dangerous way to fingerprint the user if there are local open ports. If you are not using Tor Browser and want to fix the security hole…

I feel like uMatrix covers this as well. I've sometimes found myself redirected to some shady Chinese site and seen blocked attempts to localhost or 127.0.0.1 show up in the dashboard.

Re: Why Is This Website Port Scanning Me?

#322

Post by loeg »

gsnedders wrote: post #247
gsnedders wrote: post #221

Earlier quoted context omitted.

> It's why Tor Browser restricts access to localhost by default. This problem was already predicted and considered by Tor developers back in 2014, see ticket #10419 Sorry to invoke the meme, but Opera did it first[0], in Opera 9.50 (2008). I don't have a good reference to hand, but [1] is a developer complaining about this. [Edit: [2] covers the feature in some detail.] Opera also blocked access to private IP address…

To add more about why current browsers don't do this: One is clearly that you need to communicate the requesting IP deep enough into the network stack to the point where you get the DNS response (if there is one), which means there's a fair bit of work to ensure this is done everywhere; Another is it's known to break corporate websites ( https://internal.bigcorp.com/ on a public IP expecting to be able to access priv…

Outside of DNS, the other reasons are about local networks, not 127.0/8. There's no good reason to permit port-scanning 127.0/8.

Re: Why Is This Website Port Scanning Me?

#323

Post by ohazi »

bjt2n3904 wrote: post #123
asudosandwich wrote: post #87

Earlier quoted context omitted.

>> There are legitimate reasons for port scanning Such as?

You run a network, and want to run a security audit. You need to know what devices are operating on it, and what services they are offering. I don't get upset if someone opens and closes a socket to my VPS to see if something's there. My VPS is exposed to the internet. If a socket opens, it should be secure anyways. There's the chance nginx has an unknown zero day, but if I wanted to avoid that, I'd firewall it. Thin…

> I don't get upset if someone opens and closes a socket to my VPS to see if something's there. My VPS is exposed to the internet.

That's not what's happening here.

My laptop is not exposed to the public internet because it's behind a firewall / NAT. This is like going to my house, plugging a device into an Ethernet port on my router, and scanning my internal network from inside my network.

Except instead of them planting a device, all they have to do is get you to navigate to their webpage. They're getting your laptop to do the port scanning for them, and in so doing, they get access to your internal network. The problem isn't port scanning, the problem is NAT busting.

Re: Why Is This Website Port Scanning Me?

#324

Post by arpa »

kchr wrote: post #219
hedora wrote: post #164

Earlier quoted context omitted.

Bypassing a firewall to run a port scan is almost certainly illegal. That’s what these sites are doing.

I agree with the sentiment, but by visiting the site and running the code, I believe you bypassed the firewall on your own.

Why don't you run this executable. No, this ransomware message has nothing to do with me, it's all you. Why do you do this to yourself?

Re: Why Is This Website Port Scanning Me?

#326

Post by souterrain »

kevingadd wrote: post #315
souterrain wrote: post #109

Earlier quoted context omitted.

CORS is not in the hands of the user. I don’t want a CORS policy authorizing access to my intranet or localhost.

CORS is set by the target, so localhost CORS policy is directly in the hands of the user. intranet CORS policy is set by whoever operates that intranet service

You’re right; a bit of a brain fail there for me.

Still, doesn’t mitigate attacks against non-HTTP speakers.

Re: Why Is This Website Port Scanning Me?

#327

Post by jhhh »

gruez wrote: post #56
xur17 wrote: post #21

Is there a way to block this at the browser level? Ex: block access to localhost for all domains (except from localhost itself)?

Ublock allows you to block websocket requests. eg. *$websocket will block all websocket connections. You probably want to operate on a whitelist on a site by site basis. Blocking localhost or 127.0.0.1 isn't reliable because sites can use dns rebinding attacks to bypass your filters.

Ublock origin says it supports ABP filter rules which allow for whitelisting sites which seems like it should allow something approximating:

  ~site.com$websocket
  *,~site.com$websocket
However this seems like it's invalid syntax because switching your example to this opens all websocket use back up tested via https://websocketstest.com/

Re: Why Is This Website Port Scanning Me?

#328

Post by SmallPeePeeMan »

rpastuszak wrote: post #175
LunaSea wrote: post #140

Earlier quoted context omitted.

Native applications have orders of magnitude more access to your system than a website has.

This isn't a loaded question, but how come people (especially the people here) don't know that?

the real question is: Why do people write websites to behave more and more like native apps? In order to prevent a client-side install?

For applications that want special access to my machine, there SHOULD be a barrier to entry or inconvenience like a client-side installation.

Re: Why Is This Website Port Scanning Me?

#329

Post by klodolph »

neurostimulant wrote: post #311
klodolph wrote: post #141

Earlier quoted context omitted.

Why is ASM insane? Are you talking about WASM? That’s got the same security model as JavaScript.

WASM is great peace of tech but I can't help to think it would be abused a lot in the future. For example, right now we can use ad blocker to block ads and analytics by blocking its js from loading. Imagine when wasm gains mainstream popularity and ad companies begin to ship their ads and analytics product as a libaries to be linked at compile time. How do we block something like that? Sure the adblocker can hide the…

These kind of complaints are based on a misunderstanding of how JS works or how the browser works.

You can do the same exact thing in JS right now. In fact, if anything, JavaScript makes this way easier than WASM. With JS, you can just use something like Rollup or Webpack to put your analytics code in the same code.

Re: Why Is This Website Port Scanning Me?

#330

Post by gonehome »

api wrote: post #60
souterrain wrote: post #52

The greater issue is that browsers are allowing code executing from the public Internet scope (scope meaning security domain) network access to the localhost scope or the Intranet scope (RFC1918 addresses.) If anything, this should require very explicit permission granting from the user. I’d prefer it be something more like an undocumented toggle accessible solely to developer types.

Yeah, that's the best solution. It should be like microphone or camera access. It should say "this web site is attempting to access a resource on your local system / network." I don't think you need to overdo it in terms of making the warning red, etc. Just a popup will really discourage people from trying to use this for fingerprinting. BTW the site says: "Port scanning is malicious." I don't agree. There are many m…

Yeah - if anything this post is evidence of a use case that isn't malicious.

While it can be used to get information to bad things, it itself can be used for good things too.

Post reply on HN