Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Is This Website Port Scanning Me?

nullsweep.com

Post reply on HN
Print view View original

411–420 of 448 posts

Re: Why Is This Website Port Scanning Me?

#411

Post by mirimir »

hanniabu wrote: post #277
fr2null wrote: post #194

Earlier quoted context omitted.

WebRTC can also leak your IP when you're hiding behind a VPN.

Any way to stop that?

The best solution is running the VPN client in your router. That way, your machine can't see its ISP-assigned public IP address.

If you're using a workspace VM, you can run the VPN client in a pfSense VM, which is functionally equivalent.

If you're not using a workspace VM, and can't run the VPN client in a router, you can run the VPN client in a pfSense VM. You bridge the WAN interface of the pfSense VM to the host LAN adapter. So then the host can't use it. And you configure the LAN interface of the pfSense VM as host-only. So now the host machine (your workspace) can reach the Internet only through the VPN client in the pfSense VM.

Or you can just make sure that WebRTC is disabled.

Re: Why Is This Website Port Scanning Me?

#412

Post by ghostpepper »

sedatk wrote: post #354
jolmg wrote: post #248

> Port Scanning is Malicious Though port scanning can be (and maybe even frequently is) done with malicious intent by looking for misconfigured/bugged servers, I disagree that it's inherently malicious. Port scanning is just about checking to see what services a host is offering you. It's like going to a random shop at a mall and asking what services they provide. Would asking about their services be malicious? It fe…

Port scanning is a brute force, over-reaching probing technique. A better analogy would be like visiting a shopping mall and trying to open every closed door you see, including the ones that say "authorized personnel only", "private", "do not enter" with an excuse like "I was trying to find out which shop was open".

In a store you can read the sign. Where is the sign saying that the port is not for you?

Re: Why Is This Website Port Scanning Me?

#413

Post by titzer »

csagan5 wrote: post #389
souterrain wrote: post #52

The greater issue is that browsers are allowing code executing from the public Internet scope (scope meaning security domain) network access to the localhost scope or the Intranet scope (RFC1918 addresses.) If anything, this should require very explicit permission granting from the user. I’d prefer it be something more like an undocumented toggle accessible solely to developer types.

Exactly, port scans on my public IP address are not an attack, but crossing the boundary to my localhost and private networks is malicious behavior.

Serves you right for browsing the web, you dumb dummy! /s

Re: Why Is This Website Port Scanning Me?

#414

Post by snisarenko »

bradly wrote: post #204
djsumdog wrote: post #108

Earlier quoted context omitted.

Websockets are nice for some things. I hack on Mastodon and it uses WSS for streams and they're very helpful. But WebBluetooth, ASM, etc are all fairly insane. WebRTC feels like a massive security issue (I've seen a demo of someone using WebRTC to find computers on an internal network at a security conference years ago. Even if that hole is fixed, it's still a hacky solution to video streaming behind NAT). I agree; m…

> I hack on Mastodon and it uses WSS for streams and they're very helpful. I'm not familiar with Mastodon or WSS. Can you describe how using WSS make the end user's experience better? What would be different if web sockets weren't used?

I built a simple aggregator to give people a preview of mastodon

https://mastodonia.club

Re: Why Is This Website Port Scanning Me?

#416

Post by tjoff »

jolmg wrote: post #293
tjoff wrote: post #290

Earlier quoted context omitted.

A server most definitely should not be looking at what random services a client has available.

Sure, like I said: > Though port scanning can be (and maybe even frequently is) done with malicious intent I agree that it's wrong for eBay to be doing this. What I disagree with is specifically the statement "Port Scanning is Malicious".

Surely in the context of a website performing a port scan on a client it is always malicious?

Unless it asks for explicit consent for a security audit or something.

Re: Why Is This Website Port Scanning Me?

#417

Post by _nalply »

justinclift wrote: post #397
vbezhenar wrote: post #365

Earlier quoted context omitted.

In Kazakhstan we have e-government website. This website allows users to use crypto-tokens to access government services (every citizen can get a digital certificate representing his identity). This website used to run Java applet. This applet was signed and it could access restricted APIs to access USB device. So website talked to applet and applet talked to USB device to sign data. After major web browsers disabled…

> So government website now uses JavaScript to connect to 127.0.0.1:12345 using websocket. It sounds like random other websites (Ebay, etc) would be able to interact with people's USB devices this way too. Maybe without people knowing?

Yes, if this is programmed badly (missing security or a security hole).

The browser connecting to the government website accesses two servers: the original one and the second local one you install yourself on your system. The local server runs natively and therefore can access the USB device. Like all servers it should be programmed such that misuse by hackers is prevented.

Re: Why Is This Website Port Scanning Me?

#418

Post by segfaultbuserr »

anderspitman wrote: post #351
cameronperot wrote: post #316

Earlier quoted context omitted.

+1 for firejail [1]. There's a guide on how to do this for firefox [2] (see the network setup section), but this can be used with other applications as well. [1] https://firejail.wordpress.com/ [2] https://firejail.wordpress.com/documentation-2/firefox-guide...

Note that the further I went down the sandboxing rabbit-hole, the more questions it raised about whether it's more or actually less secure. The main problem is that in order to work, these tools often use a setuid binary, which actually has more permissions than most users. So in theory if a sandboxed app finds an exploit in the sandboxing program (like firejail) that you're running inside, you could actually be wors…

> these tools often use a setuid binary, which actually has more permissions than most users.

These tools often drop privileges as soon as the program is executed, in firejail, there's also an option to disalble root entirely within a namespace.

Re: Why Is This Website Port Scanning Me?

#420

Post by xorcist »

Thriptic wrote: post #362
anderspitman wrote: post #351

Earlier quoted context omitted.

Note that the further I went down the sandboxing rabbit-hole, the more questions it raised about whether it's more or actually less secure. The main problem is that in order to work, these tools often use a setuid binary, which actually has more permissions than most users. So in theory if a sandboxed app finds an exploit in the sandboxing program (like firejail) that you're running inside, you could actually be wors…

It's also possible to run a web browser in a docker container which can be interacted with on the host OS. This avoids the permissions issues with solutions like firejail: https://blog.jessfraz.com/post/docker-containers-on-the-desk...

That's not a good idea. The attack surface of docker is enormous compared to firejail.
Post reply on HN