Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Is This Website Port Scanning Me?

nullsweep.com

Post reply on HN
Print view View original

351–360 of 448 posts

Re: Why Is This Website Port Scanning Me?

#351

Post by anderspitman »

cameronperot wrote: post #316
anderspitman wrote: post #281

Earlier quoted context omitted.

You can look into tools like firejail to make this easier.

+1 for firejail [1]. There's a guide on how to do this for firefox [2] (see the network setup section), but this can be used with other applications as well. [1] https://firejail.wordpress.com/ [2] https://firejail.wordpress.com/documentation-2/firefox-guide...

Note that the further I went down the sandboxing rabbit-hole, the more questions it raised about whether it's more or actually less secure. The main problem is that in order to work, these tools often use a setuid binary, which actually has more permissions than most users. So in theory if a sandboxed app finds an exploit in the sandboxing program (like firejail) that you're running inside, you could actually be worse off than it breaking out of whatever program you're sandboxing in the first place.

I think in this case though where you're more concerned about the very real problem of websites accessing localhost, it probably outweighs the maybe of a firejail exploit.

Re: Why Is This Website Port Scanning Me?

#352

Post by jrockway »

jolmg wrote: post #302
jrockway wrote: post #298

Earlier quoted context omitted.

I think the dynamics of the Internet have shifted from the early days. Basically, HTTPS on port 443 is pretty much the only service that anyone intends to make publicly available. This is different from 30 years ago, when those same sites had HTTP, FTP, Gopher, a public Telnet server, a public NTP server, etc. and they wanted you to use them. It was very reasonable to look around back then, but nowadays anything that…

Exactly! And do we want to continue on that trend? Personally, I don't. I dislike the growing idea that HTTP is a core part of the internet, and not just the most popular part. The difference lies in if we're going to see legislation that dictates proper use of the lower networking layers like TCP/IP by stuff of the upper layers like HTTP. I'd really hate to see something along the lines of "it's illegal to use a TCP…

I don't think it's worth getting caught up on which data framing protocol everyone is using. Everything that Gopher, IRC, FTP, etc. did are perfectly expressible as any other RPC protocol; these things were just RPCs before we invented the term RPC. Now we have protocols that can generically transport any RPC, and so we don't need to think about these things in terms of port numbers or running services.

Re: Why Is This Website Port Scanning Me?

#353

Post by pantalaimon »

marcojrfurtado wrote: post #80
souterrain wrote: post #52

The greater issue is that browsers are allowing code executing from the public Internet scope (scope meaning security domain) network access to the localhost scope or the Intranet scope (RFC1918 addresses.) If anything, this should require very explicit permission granting from the user. I’d prefer it be something more like an undocumented toggle accessible solely to developer types.

There are legitimate reasons for port scanning, but I'm not sure most websites out there are using it for noble purposes. I guess browsers could allow it based on explicit permission from the user, just like it's already done for microphone and camera.

Yea this is very surprising. I run a file server in my local network. There is no access control on it because it’s behind my router’s firewall, but everyone in the LAN can access it.

I find it very surprising that now any random website can access it with no oversight. Why worry about spectre and meltdown when such blatant backdoors are implemented in browsers?!

Re: Why Is This Website Port Scanning Me?

#354

Post by sedatk »

jolmg wrote: post #248

> Port Scanning is Malicious Though port scanning can be (and maybe even frequently is) done with malicious intent by looking for misconfigured/bugged servers, I disagree that it's inherently malicious. Port scanning is just about checking to see what services a host is offering you. It's like going to a random shop at a mall and asking what services they provide. Would asking about their services be malicious? It fe…

Port scanning is a brute force, over-reaching probing technique. A better analogy would be like visiting a shopping mall and trying to open every closed door you see, including the ones that say "authorized personnel only", "private", "do not enter" with an excuse like "I was trying to find out which shop was open".

Re: Why Is This Website Port Scanning Me?

#355

Post by neurostimulant »

derefr wrote: post #198
bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

> WebSockets ... haven’t ever wanted to use those. Ever. For anything. For any reason. You’ve never used a web-app chat client? > WebBluetooth APIs like these don’t exist for the sake of regular unprivileged web-apps. They exist for the sake of browser extensions (or browser “apps”, or apps within a browser-projector like Electron), specifically in order to be used to add driver-like or service-like capabilities to d…

> You’ve never used a web-app chat client?

A decade ago people use comet for this, with php and apache! Every single ongoing comet connection occupy an apache process, a significant resource hog, yet people still use it because they have no other choice. These days we have websocket but I bet comet can be implemented with minimal resource penalty these days thanks to proliferation of async webserver support in modern backend stacks.

Re: Why Is This Website Port Scanning Me?

#356

Post by blablabla123 »

jolmg wrote: post #302
jrockway wrote: post #298

Earlier quoted context omitted.

I think the dynamics of the Internet have shifted from the early days. Basically, HTTPS on port 443 is pretty much the only service that anyone intends to make publicly available. This is different from 30 years ago, when those same sites had HTTP, FTP, Gopher, a public Telnet server, a public NTP server, etc. and they wanted you to use them. It was very reasonable to look around back then, but nowadays anything that…

Exactly! And do we want to continue on that trend? Personally, I don't. I dislike the growing idea that HTTP is a core part of the internet, and not just the most popular part. The difference lies in if we're going to see legislation that dictates proper use of the lower networking layers like TCP/IP by stuff of the upper layers like HTTP. I'd really hate to see something along the lines of "it's illegal to use a TCP…

True, as if the browser is the only tool to access the Internet. Today with the much bigger security awareness it would be thinkable to allow file sharing over Internet or to fail-over to the neighbour's Internet uplink when the own DSL provider has a problem. All these things become increasingly difficult. (Actually Bruce Schneier was once writing on his blog that he has an open Wifi at home)

Re: Why Is This Website Port Scanning Me?

#357

Post by [deleted] »

thephyber wrote: post #307
throwaway023421 wrote: post #169

Earlier quoted context omitted.

Over the years I've seen "hacker" news become more of an echo chamber and instantly downvote anything against doctrine... I'll be downvoted for saying this.

> I'll be downvoted for saying this. Because it's against the site guidelines. > Please don't comment about the voting on comments. It never does any good, and it makes boring reading.[1] [1] https://news.ycombinator.com/newsguidelines.html

[deleted]

Re: Why Is This Website Port Scanning Me?

#358

Post by tylerhou »

derefr wrote: post #215
souterrain wrote: post #107

Earlier quoted context omitted.

I stand corrected. I think yours is the correct approach. How shall origin be defined? I can envision the likes of Microsoft which have many, many second-level domains making calls between them. We can’t allow the site itself to grant access. How would this be managed, other than “please stop and think what a domain name is supposed to be before spraying your product across twelve of them?”

To be clear, evil.com can define sub.evil.com to resolve to 127.0.0.1. You basically can’t look at domains to mean anything much. You have to look at IP addresses. (Which is in turn made harder by IPv6 public addressing, where you can’t just block the private IP range because you might not be behind a NAT in the first place, instead only behind a firewall. So your address A::B, can route to your Intranet peer A::C, w…

To add on to your point, even if you allow evil.com to only access evil.com and not any subdomains, your browser is still vulnerable because of short TTLs on DNS resolution.

evil.com can set a short DNS TTL, and after you access it, it can rebind its address to 127.0.0.1. Then subsequent requests to evil.com go to localhost (e.g. fetch("evil.com", ...) on evil.com will go to 127.0.0.1 if the DNS rebound successfully).

Caching a website's IP on first use doesn't help, either, because it breaks long sessions on websites that use DNS rebinding for legitimate purposes (load balancing, fallover).

The only real way to fix this is for the local webserver to check the Host header on the HTTP request... or look at IP addresses. But building a global registry of IP addresses is hard, so we're stuck with trusting application developers (and malware writers) who run servers on localhost to use good security practices.

Re: Why Is This Website Port Scanning Me?

#359

Post by Gibbon1 »

thephyber wrote: post #307
throwaway023421 wrote: post #169

Earlier quoted context omitted.

Over the years I've seen "hacker" news become more of an echo chamber and instantly downvote anything against doctrine... I'll be downvoted for saying this.

> I'll be downvoted for saying this. Because it's against the site guidelines. > Please don't comment about the voting on comments. It never does any good, and it makes boring reading.[1] [1] https://news.ycombinator.com/newsguidelines.html

Your comment is even more worthless than his

Re: Why Is This Website Port Scanning Me?

#360

Post by jolmg »

sedatk wrote: post #354
jolmg wrote: post #248

> Port Scanning is Malicious Though port scanning can be (and maybe even frequently is) done with malicious intent by looking for misconfigured/bugged servers, I disagree that it's inherently malicious. Port scanning is just about checking to see what services a host is offering you. It's like going to a random shop at a mall and asking what services they provide. Would asking about their services be malicious? It fe…

Port scanning is a brute force, over-reaching probing technique. A better analogy would be like visiting a shopping mall and trying to open every closed door you see, including the ones that say "authorized personnel only", "private", "do not enter" with an excuse like "I was trying to find out which shop was open".

I answered an almost identical reply, here[1].

> including the ones that say "authorized personnel only", "private", "do not enter"

Basically, to answer you separately, an analogy like that doesn't represent TCP accurately. In your analogy, you can

1) see from afar for visual cues indicating whether access is being given to you, and

2) try opening it.

Your argument is that doing 2 is invasive, because they can do 1.

However, in TCP, you can only try to make the connection. There is no see from afar. If I give you an IP address, there's no standard way for you to tell me whether FTP is available, without trying to connect to the port! That's your only choice!

So, yes, "I was trying to find out which [service is available]" is a very valid reason.

> Port scanning is a brute force, over-reaching probing technique.

It certainly is brute-force, and that sucks. I think there's a network service / protocol called Portmapper/rpcbind[2] that lists the services available and port numbers they're on. I only know that NFS uses it, but nothing else. If that were standard, then I'd agree port scanning is over-reaching. As it stands, though, I don't consider it over-reaching when it's the only TCP mechanism to see what's available online.

[1] https://news.ycombinator.com/item?id=23249246

[2] https://en.wikipedia.org/wiki/Portmap

Post reply on HN