Any suggestions of ways to block this? Any Safari extensions?
Why Is This Website Port Scanning Me?
361–370 of 448 posts
Re: Why Is This Website Port Scanning Me?
#362Earlier quoted context omitted.
+1 for firejail [1]. There's a guide on how to do this for firefox [2] (see the network setup section), but this can be used with other applications as well. [1] https://firejail.wordpress.com/ [2] https://firejail.wordpress.com/documentation-2/firefox-guide...
Note that the further I went down the sandboxing rabbit-hole, the more questions it raised about whether it's more or actually less secure. The main problem is that in order to work, these tools often use a setuid binary, which actually has more permissions than most users. So in theory if a sandboxed app finds an exploit in the sandboxing program (like firejail) that you're running inside, you could actually be wors…
It's also possible to run a web browser in a docker container which can be interacted with on the host OS. This avoids the permissions issues with solutions like firejail:
https://blog.jessfraz.com/post/docker-containers-on-the-desk...
Re: Why Is This Website Port Scanning Me?
#363It's why Tor Browser restricts access to localhost by default. This problem was already predicted and considered by Tor developers back in 2014, see ticket #10419 - Can requests to 127.0.0.1 be used to fingerprint the browser [0] and has been fixed since then. Scanning localhost is a dangerous way to fingerprint the user if there are local open ports. If you are not using Tor Browser and want to fix the security hole…
I feel like uMatrix covers this as well. I've sometimes found myself redirected to some shady Chinese site and seen blocked attempts to localhost or 127.0.0.1 show up in the dashboard.
I always wondered what was going on when I saw localhost show up in the connections listing for a site in uMatrix, TIL.
Re: Why Is This Website Port Scanning Me?
#364Earlier quoted context omitted.
Note that the further I went down the sandboxing rabbit-hole, the more questions it raised about whether it's more or actually less secure. The main problem is that in order to work, these tools often use a setuid binary, which actually has more permissions than most users. So in theory if a sandboxed app finds an exploit in the sandboxing program (like firejail) that you're running inside, you could actually be wors…
It's also possible to run a web browser in a docker container which can be interacted with on the host OS. This avoids the permissions issues with solutions like firejail: https://blog.jessfraz.com/post/docker-containers-on-the-desk...
`docker` implies access to the Docker daemon, which is not an improvement over the setuid binaries anderspitman found distasteful.
https://docs.docker.com/engine/security/security/#docker-dae...
Re: Why Is This Website Port Scanning Me?
#365Earlier quoted context omitted.
> It's why Tor Browser restricts access to localhost by default. This problem was already predicted and considered by Tor developers back in 2014, see ticket #10419 Sorry to invoke the meme, but Opera did it first[0], in Opera 9.50 (2008). I don't have a good reference to hand, but [1] is a developer complaining about this. [Edit: [2] covers the feature in some detail.] Opera also blocked access to private IP address…
To add more about why current browsers don't do this: One is clearly that you need to communicate the requesting IP deep enough into the network stack to the point where you get the DNS response (if there is one), which means there's a fair bit of work to ensure this is done everywhere; Another is it's known to break corporate websites ( https://internal.bigcorp.com/ on a public IP expecting to be able to access priv…
In Kazakhstan we have e-government website. This website allows users to use crypto-tokens to access government services (every citizen can get a digital certificate representing his identity).
This website used to run Java applet. This applet was signed and it could access restricted APIs to access USB device. So website talked to applet and applet talked to USB device to sign data.
After major web browsers disabled Java applets, they implemented another approach. Now user must install a software which runs a web server on 127.0.0.1. This webserver listens on a specific port and uses web socket to communicate.
So government website now uses JavaScript to connect to 127.0.0.1:12345 using websocket. And then it uses that connection to interact with USB device.
So an ability for external website to connect to 127.0.0.1 actually is essential for this use-case.
My guess is that there are plenty of other websites which use local web server to interact with locally installed software. I know at least one another such a website: Blizzard website. It runs web server in its game launcher and website can communicate with it.
PS also they have to install custom trusted certificate because browser requires wss from https and there's no easy way to get a legitimate certificate for that kind of use.
Re: Why Is This Website Port Scanning Me?
#366Javascript was a mistake, seriously. The benefit-cost ratio from the user's point of view is disastrous. I'd rather slog through less fancy data entry forms than suffer endless tracking, privacy and security attacks.
Re: Why Is This Website Port Scanning Me?
#367Earlier quoted context omitted.
To be clear, evil.com can define sub.evil.com to resolve to 127.0.0.1. You basically can’t look at domains to mean anything much. You have to look at IP addresses. (Which is in turn made harder by IPv6 public addressing, where you can’t just block the private IP range because you might not be behind a NAT in the first place, instead only behind a firewall. So your address A::B, can route to your Intranet peer A::C, w…
To add on to your point, even if you allow evil.com to only access evil.com and not any subdomains, your browser is still vulnerable because of short TTLs on DNS resolution. evil.com can set a short DNS TTL, and after you access it, it can rebind its address to 127.0.0.1. Then subsequent requests to evil.com go to localhost (e.g. fetch("evil.com", ...) on evil.com will go to 127.0.0.1 if the DNS rebound successfully)…
This would prevent most users from visiting that site (since most of the time it will resolve to 127.0.0.1)
Re: Why Is This Website Port Scanning Me?
#368I've noticed many of the survey for cash sites use websockets to scan for running services on your machine
Personally I think its straight up evil
Re: Why Is This Website Port Scanning Me?
#369Earlier quoted context omitted.
It's also possible to run a web browser in a docker container which can be interacted with on the host OS. This avoids the permissions issues with solutions like firejail: https://blog.jessfraz.com/post/docker-containers-on-the-desk...
`docker` implies access to the Docker daemon, which is not an improvement over the setuid binaries anderspitman found distasteful. https://docs.docker.com/engine/security/security/#docker-dae...
Genuine question, would LXD be any better? I'm not an expert in containerization but I find it really interesting.
There are some blogs that talk about how to do this: https://blog.simos.info/how-to-easily-run-graphics-accelerat...
Re: Why Is This Website Port Scanning Me?
#370Earlier quoted context omitted.
To add more about why current browsers don't do this: One is clearly that you need to communicate the requesting IP deep enough into the network stack to the point where you get the DNS response (if there is one), which means there's a fair bit of work to ensure this is done everywhere; Another is it's known to break corporate websites ( https://internal.bigcorp.com/ on a public IP expecting to be able to access priv…
Outside of DNS, the other reasons are about local networks, not 127.0/8. There's no good reason to permit port-scanning 127.0/8.
So remove "port scanning" since the only difference between port scanning and "legitimate" connection attempts is rate.
Should websockets be able to connect to the local machine?
In some cases that could be useful (even if something the kinds of people visiting this site might be uncomfortable with). E.g., a local daemon that listens for a websocket connection and a public web page that's used for managing it.
I don't think it was implemented this way, but think something like Battlefield 3's matchmaking: the user visits the online service and finds a match to join, and when they want to join it passes the relevant information to the game via websocket.
I imagine stuff like this has been implemented in at least a couple cases that you'd break just wholesale blocking connections to 127/8.