Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Is This Website Port Scanning Me?

nullsweep.com

Post reply on HN
Print view View original

371–380 of 448 posts

Re: Why Is This Website Port Scanning Me?

#371

Post by reaperducer »

derefr wrote: post #198
bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

> WebSockets ... haven’t ever wanted to use those. Ever. For anything. For any reason. You’ve never used a web-app chat client? > WebBluetooth APIs like these don’t exist for the sake of regular unprivileged web-apps. They exist for the sake of browser extensions (or browser “apps”, or apps within a browser-projector like Electron), specifically in order to be used to add driver-like or service-like capabilities to d…

You’ve never used a web-app chat client?

Nope. Not once. And I've been using the web since Mosaic.

I see business web sites offering to chat with me all the time. I ignore them. If I want to chat, I'll let you know.

Apple's business-to-Messages thing works so well, I hope it puts the scammy webchat companies out of business.

Re: Why Is This Website Port Scanning Me?

#372

Post by ryan-allen »

crazygringo wrote: post #106

First of all, fraud detection seems like a legitimate use case here. And WebSockets has many valid uses. HOWEVER -- how the hell is localhost port scanning allowed to happen without my permission ?! This feels no different from a website trying to check the existence of named directories on my file system or something. Does WebSockets not require permission to function at all, or shouldn't it be limited to some kind…

If you find a way to prevent this in Chrome/Edge please let me know.

Edit: https://defuse.ca/in-browser-port-scanning.htm

There doesn't seem to be a way to access anything locally, just test for open ports. I use SSH tunneling a lot and was having a minor freak out.

Re: Why Is This Website Port Scanning Me?

#373

Post by cameronperot »

anderspitman wrote: post #351
cameronperot wrote: post #316

Earlier quoted context omitted.

+1 for firejail [1]. There's a guide on how to do this for firefox [2] (see the network setup section), but this can be used with other applications as well. [1] https://firejail.wordpress.com/ [2] https://firejail.wordpress.com/documentation-2/firefox-guide...

Note that the further I went down the sandboxing rabbit-hole, the more questions it raised about whether it's more or actually less secure. The main problem is that in order to work, these tools often use a setuid binary, which actually has more permissions than most users. So in theory if a sandboxed app finds an exploit in the sandboxing program (like firejail) that you're running inside, you could actually be wors…

Interesting point, I hadn't made it that far down the rabbit hole. I agree that it's not a complete solution, and possible risks of exploiting the sandbox itself should be taken into account on a case-by-case basis.

Re: Why Is This Website Port Scanning Me?

#374

Post by [deleted] »

willglynn wrote: post #364
Thriptic wrote: post #362

Earlier quoted context omitted.

It's also possible to run a web browser in a docker container which can be interacted with on the host OS. This avoids the permissions issues with solutions like firejail: https://blog.jessfraz.com/post/docker-containers-on-the-desk...

`docker` implies access to the Docker daemon, which is not an improvement over the setuid binaries anderspitman found distasteful. https://docs.docker.com/engine/security/security/#docker-dae...

[deleted]

Re: Why Is This Website Port Scanning Me?

#375

Post by sitkack »

I can't believe of the 363 comments no one has mentioned Samy K and his awesome Poisontap project. Parts of which did this local scanning and connecting to your internal router management page.

https://github.com/samyk/poisontap

See also, https://www.theregister.co.uk/2010/01/05/geo_location_steali...

Re: Why Is This Website Port Scanning Me?

#376

Post by roywiggins »

khc wrote: post #367
tylerhou wrote: post #358

Earlier quoted context omitted.

To add on to your point, even if you allow evil.com to only access evil.com and not any subdomains, your browser is still vulnerable because of short TTLs on DNS resolution. evil.com can set a short DNS TTL, and after you access it, it can rebind its address to 127.0.0.1. Then subsequent requests to evil.com go to localhost (e.g. fetch("evil.com", ...) on evil.com will go to 127.0.0.1 if the DNS rebound successfully)…

This would prevent most users from visiting that site (since most of the time it will resolve to 127.0.0.1)

Evil.com could be set to resolve normally but redirect you to .evil.com, which resolves normally once and then performs the attack, leaving evil.com able to keep serving new visitors.

Re: Why Is This Website Port Scanning Me?

#377

Post by geofft »

vbezhenar wrote: post #365
gsnedders wrote: post #247

Earlier quoted context omitted.

To add more about why current browsers don't do this: One is clearly that you need to communicate the requesting IP deep enough into the network stack to the point where you get the DNS response (if there is one), which means there's a fair bit of work to ensure this is done everywhere; Another is it's known to break corporate websites ( https://internal.bigcorp.com/ on a public IP expecting to be able to access priv…

In Kazakhstan we have e-government website. This website allows users to use crypto-tokens to access government services (every citizen can get a digital certificate representing his identity). This website used to run Java applet. This applet was signed and it could access restricted APIs to access USB device. So website talked to applet and applet talked to USB device to sign data. After major web browsers disabled…

Since these use cases already require having software installed on your machine, it seems fine and safer to use a browser extension with native messaging for this:

https://developer.chrome.com/extensions/nativeMessaging

https://wiki.mozilla.org/WebExtensions/Native_Messaging

That bypasses the entire certificate question and lets the website know it's communicating with exactly this app and not something happening to listen on the port (and vice versa, too).

... Or, depending on what you're doing, just use a real desktop app, perhaps with an embedded browser.

Re: Why Is This Website Port Scanning Me?

#378

Post by folmar »

mcherm wrote: post #116
louis_pasteur wrote: post #110

Earlier quoted context omitted.

We need a simple browser implementation for the masses. Is there any such browser in existence?

There are no simple browsers, thus certainly no simple browser for the masses.

If you are on mobile there is Firefox Klar/Focus.

Re: Why Is This Website Port Scanning Me?

#379

Post by folmar »

michaelt wrote: post #220
jschwartzi wrote: post #144

Earlier quoted context omitted.

Firefox is open-source, so you could add that. I would really appreciate being able to turn WebUSB WebBluetooth and WebRTC off entirely as those expose a lot of devices that I need not to be exposed to the Internet.

I'm pretty sure someone at Firefox has decided the settings panel should be 'clean' and 'easy to use' rather than providing maximum control. I mean, there's a lot in about:config that the settings panel doesn't support.

... and it was around the time when Firefox 3 was introduced.
Post reply on HN