Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Is This Website Port Scanning Me?

nullsweep.com

Post reply on HN
Print view View original

41–50 of 448 posts

Re: Why Is This Website Port Scanning Me?

#41

Post by billme »

p410n3 wrote: post #7
badRNG wrote: post #2

This raises the question: Is port scanning without consent a violation of the CFAA? Either it is legal, and researchers should face no repercussions for doing so, or it isn't and eBay is non-compliant with CFAA. I recall hearing about someone either being arrested or convicted due to port scanning a courthouse, but it was many years ago and I can't find the case with a cursory Google search. I have to wonder what val…

This guy got arrested at least: https://www.securityfocus.com/news/126

Article also states civil claims were dismissed - and criminal charges are unlikely to hold.

Re: Why Is This Website Port Scanning Me?

#42

Post by pbhjpbhj »

jerf wrote: post #31
kgersen wrote: post #17

port scanning is fine and should not be illegal. It's just "looking" at a house to see if there is a door and what type of key (protocol) it uses. Trying to open a connection on the other hand it's like trying to open the door. That should be considered as a violation.

Don't try to understand this with metaphors. It's a trap. Port scanning isn't enough like anything in the real world for the analogies to apply. I'd strengthen pfundstein's claim; port scanning intrinsically works by trying to open connections. That isn't enough "like" any particular physical thing to make it a correct analogy; it isn't knocking, or walking in, or opening, or anything else. But one thing we can say,…

I think your final objection fails by bad analogy too: one has to _actively_ direct ones gaze, in general, if one is to notice a type of lock or other security arrangements.

Re: Why Is This Website Port Scanning Me?

#43

Post by TeMPOraL »

ajphdiv wrote: post #29
bzb3 wrote: post #9

Earlier quoted context omitted.

That's a fallacious argument. The fact that someone is doing something doesn't mean it's automatically legal.

The more pointed argument would be there is no federal law prohibiting port scans.

Doesn't the Curl/For-loop Abuse Act (CFAA) cover it?

Re: Why Is This Website Port Scanning Me?

#44

Post by koheripbal »

jerf wrote: post #31
kgersen wrote: post #17

port scanning is fine and should not be illegal. It's just "looking" at a house to see if there is a door and what type of key (protocol) it uses. Trying to open a connection on the other hand it's like trying to open the door. That should be considered as a violation.

Don't try to understand this with metaphors. It's a trap. Port scanning isn't enough like anything in the real world for the analogies to apply. I'd strengthen pfundstein's claim; port scanning intrinsically works by trying to open connections. That isn't enough "like" any particular physical thing to make it a correct analogy; it isn't knocking, or walking in, or opening, or anything else. But one thing we can say,…

Yeah, I'm not saying it should be illegal, but it's hard to see a use-case for scanning on a remote network that isn't malicious or security related.

Re: Why Is This Website Port Scanning Me?

#45

Post by ozim »

kgersen wrote: post #17

port scanning is fine and should not be illegal. It's just "looking" at a house to see if there is a door and what type of key (protocol) it uses. Trying to open a connection on the other hand it's like trying to open the door. That should be considered as a violation.

It is not fine. Just like burglars looking at a house is not fine (still nothing to do with being legal or not). Intent defines if something is OK or not. Just like killing is always illegal but when you do it to save someone else it is hmm less bad, you see intent...

What are the intents of people doing scan? I don't see any legitimate reason for scanning random people computers or servers that are not yours.

Re: Why Is This Website Port Scanning Me?

#46

Post by bilekas »

xur17 wrote: post #21

Is there a way to block this at the browser level? Ex: block access to localhost for all domains (except from localhost itself)?

Was thinking the same, maybe creating a service account for the browsers, I believe they do need some level of elevation but then using the firewall rules disabling everything expect http/s ports.. Websockets and others might be an issue, might need to be updated on an adhoc basis though and shouldnt be the reposonsibilty of the users.

This is kinda gross practice overall.

Re: Why Is This Website Port Scanning Me?

#47

Post by bilekas »

edoceo wrote: post #39
xur17 wrote: post #21

Is there a way to block this at the browser level? Ex: block access to localhost for all domains (except from localhost itself)?

Whitelist sites that you allow WS features.

I wonder though if it was just a websocket that could do this, surely some client side JS can just itterate the same when loaded.

Re: Why Is This Website Port Scanning Me?

#48

Post by pbhjpbhj »

corentin88 wrote: post #30
kgersen wrote: post #17

port scanning is fine and should not be illegal. It's just "looking" at a house to see if there is a door and what type of key (protocol) it uses. Trying to open a connection on the other hand it's like trying to open the door. That should be considered as a violation.

Imagine you start to look at houses in your neighborhood « to see if there is a door and what type of key it uses ». That sounds pretty suspicious to me. At least you need the consent of the house’s owner.

Do you need consent of the owner?

You might be doing a legitimate survey (as part of a locksmith business, say)?

Re: Why Is This Website Port Scanning Me?

#50

Post by relaunched »

billme wrote: post #41
p410n3 wrote: post #7

Earlier quoted context omitted.

This guy got arrested at least: https://www.securityfocus.com/news/126

Article also states civil claims were dismissed - and criminal charges are unlikely to hold.

I hope they weren't debilitated by the legal fees incurred.
Post reply on HN