Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Is This Website Port Scanning Me?

nullsweep.com

Post reply on HN
Print view View original

391–400 of 448 posts

Re: Why Is This Website Port Scanning Me?

#391

Post by cwkoss »

sedatk wrote: post #354
jolmg wrote: post #248

> Port Scanning is Malicious Though port scanning can be (and maybe even frequently is) done with malicious intent by looking for misconfigured/bugged servers, I disagree that it's inherently malicious. Port scanning is just about checking to see what services a host is offering you. It's like going to a random shop at a mall and asking what services they provide. Would asking about their services be malicious? It fe…

Port scanning is a brute force, over-reaching probing technique. A better analogy would be like visiting a shopping mall and trying to open every closed door you see, including the ones that say "authorized personnel only", "private", "do not enter" with an excuse like "I was trying to find out which shop was open".

> including the ones that say "authorized personnel only", "private", "do not enter" with an excuse like "I was trying to find out which shop was open".

I don't think this part of the analogy is accurate. There are no "authorized personnel only" ports

The first half of the analogy is good though.

Re: Why Is This Website Port Scanning Me?

#392

Post by csagan5 »

gsnedders wrote: post #247
gsnedders wrote: post #221

Earlier quoted context omitted.

> It's why Tor Browser restricts access to localhost by default. This problem was already predicted and considered by Tor developers back in 2014, see ticket #10419 Sorry to invoke the meme, but Opera did it first[0], in Opera 9.50 (2008). I don't have a good reference to hand, but [1] is a developer complaining about this. [Edit: [2] covers the feature in some detail.] Opera also blocked access to private IP address…

To add more about why current browsers don't do this: One is clearly that you need to communicate the requesting IP deep enough into the network stack to the point where you get the DNS response (if there is one), which means there's a fair bit of work to ensure this is done everywhere; Another is it's known to break corporate websites ( https://internal.bigcorp.com/ on a public IP expecting to be able to access priv…

In Chromium it might not be blocked just because of an oversight (or because there was no consensus), see my other comment (and its parent): https://news.ycombinator.com/item?id=23253264

Re: Why Is This Website Port Scanning Me?

#393

Post by rurban »

Many questionable Russian sites do full port scans not only on localhost but on all the private subnets. I had to block all access to ports above 1024 for all local subnets. Usually people don't have firewall rules for that.

Re: Why Is This Website Port Scanning Me?

#394

Post by nemothekid »

upofadown wrote: post #253
derefr wrote: post #198

Earlier quoted context omitted.

> WebSockets ... haven’t ever wanted to use those. Ever. For anything. For any reason. You’ve never used a web-app chat client? > WebBluetooth APIs like these don’t exist for the sake of regular unprivileged web-apps. They exist for the sake of browser extensions (or browser “apps”, or apps within a browser-projector like Electron), specifically in order to be used to add driver-like or service-like capabilities to d…

>You’ve never used a web-app chat client? BOSH? Awkward, but it works without websockets. * https://en.wikipedia.org/wiki/BOSH_(protocol)

BOSH is essentially long polling which is pretty difficult to scale (the worst case scenario can become 1 connection per message for a single client).

I'm pretty surprised however, that a nearly 10 year old standard is being considered as "superflous" as newer technology like WebBluetooth and WebUSB. What we had before Websockets wasn't really long polling, it was Flash.

Re: Why Is This Website Port Scanning Me?

#395

Post by MrStonedOne »

xg15 wrote: post #105

To my knowledge, a lot of effort has been put into the design of CORS (and related APIs) to specifically prevent misuse like that. A well-behaved Websocket implementation should not give the calling script any indication why a connection failed. I know timing oracles are difficult to avoid in many cases - but the technique shown here seems to actually exploit different kinds of exceptions being thrown by the browser.…

cors/csp allow the webpage owner to control what servers the javascript running on on their webpage can access and allow web servers to control what 3rd party websites make requests to them.

Notice the missing piece? Neither of those allow the user to control these things.

At the end of the day, it is reasonable to assume that localhost access is a valid security barrier in the general networking sense. Making an exception for certain types of networked applications is just adding a pitfall for some dev to fall into. Good process design has to take into account the inevitability of human error, and leverage things like "forget safe" rather then "remember safe" (forgetting a step should fail safely, with an error or incorrect but still safe behavior, then unsafely, with an exploit or an explosion)

Using websockets or XHR to transverse internet firewalls is browsers transversing security barriers as a feature, and needs to go the way of the mic access, with a per-site prompt.

Re: Why Is This Website Port Scanning Me?

#396

Post by nemothekid »

90minuteAPI wrote: post #178
habyte wrote: post #88

Earlier quoted context omitted.

I'm sorry, what's the alternative for (soft-)real-time applications on frontend if not WebSocket? You probably do want to use it.

Server Sent Events and HTTP? With a modern setup it’s going to be sharing an HTTP/2 pipe anyway. Even handles disconnections gracefully/transparently if you’re clever about it. Can anyone expand on why this technique isn’t more common? I’m so sick of seeing folks reinvent HTTP (poorly) on top of WebSockets. I get if extreme low latency is (allegedly) a requirement.

>Can anyone expand on why this technique isn’t more common?

Because WebSockets is 10 years old and HTTP/2 is 5 years old, and that's not including support in major frameworks for SSE.

Re: Why Is This Website Port Scanning Me?

#397

Post by justinclift »

vbezhenar wrote: post #365
gsnedders wrote: post #247

Earlier quoted context omitted.

To add more about why current browsers don't do this: One is clearly that you need to communicate the requesting IP deep enough into the network stack to the point where you get the DNS response (if there is one), which means there's a fair bit of work to ensure this is done everywhere; Another is it's known to break corporate websites ( https://internal.bigcorp.com/ on a public IP expecting to be able to access priv…

In Kazakhstan we have e-government website. This website allows users to use crypto-tokens to access government services (every citizen can get a digital certificate representing his identity). This website used to run Java applet. This applet was signed and it could access restricted APIs to access USB device. So website talked to applet and applet talked to USB device to sign data. After major web browsers disabled…

> So government website now uses JavaScript to connect to 127.0.0.1:12345 using websocket.

It sounds like random other websites (Ebay, etc) would be able to interact with people's USB devices this way too. Maybe without people knowing?

Re: Why Is This Website Port Scanning Me?

#398

Post by gfxgirl »

oplav wrote: post #104
marcosdumay wrote: post #95

Earlier quoted context omitted.

> to the localhost scope or the Intranet scope That's too little. All access from a different origin should be blocked by default, not only to local nets.

That's what CORS is for, but it appears that there is no CORS for WebSockets.

CORS has nothing to help with here. The site doing the scanning is not able to make connections. Rather it's only able to tell if the port is listening or not. CORS would still be listening so they'd get the same info they're getting now.

Re: Why Is This Website Port Scanning Me?

#399

Post by gfxgirl »

Yes, a drive by web page shouldn't be able to do this but similarly a native app shouldn't be able to do this and yet I suspect some not insignificant percent of native apps, especially on mobile on both OSes are doing this either directly, the app dev is doing it deliberately, or via one of the many 3rd party libraries they included but aren't aware of the behavior.

I really want the OS to prevent this by default and require permission from the user. I want apps (probably only possible on iOS/Android) to have to list the sites they'll connect to, that list will have to be reasonably small 10-30 sites with special exceptions for browsers

This would have 2 positive affects. #1 it would prevent the apps from scanning the network. #2 it would effectively force apps to launch the user's browser for external links instead of an embedded browser in which they can spy on all activity.

Re: Why Is This Website Port Scanning Me?

#400

Post by gfxgirl »

splonk wrote: post #291

> Furthermore, when I installed and ran a VNC server, I didn't detect any difference in site behavior - so why is it looking for it? Not an eBay employee, but used to work in fraud detection. Two very obvious related guesses from my experience: 1. Fingerprinting a user to help identify account takeover (ATO). Open port signatures is probably a pretty good signal for that kind of thing (and it doesn't seem to be measu…

panopticlick is specifically about browser fingerprints. It doesn't include your IP address for example.
Post reply on HN