Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Is This Website Port Scanning Me?

nullsweep.com

Post reply on HN
Print view View original

441–448 of 448 posts

Re: Why Is This Website Port Scanning Me?

#441

Post by tripzilch »

jolmg wrote: post #252
Cakez0r wrote: post #250

Earlier quoted context omitted.

I think it's a bit more like going on to a shop and trying to open all the doors, cupboards and drawers to see which ones are locked ;)

That's a bad analogy. It wrong because you can see what doors, cupboards and drawers are available for the public. Doors that are in-reach but that shouldn't be used by the public have signs like "restricted access" or "employees only". You can't do that with the internet. You can't see that a port is not available to you until you try it. If you want to continue using that analogy, then you have to consider that eve…

> That's a bad analogy. It wrong because you can see what doors, cupboards and drawers are available for the public. Doors that are in-reach but that shouldn't be used by the public have signs like "restricted access" or "employees only". You can't do that with the internet. You can't see that a port is not available to you until you try it.

But you can see what ports/doors are available. TCP doors are defined in the RFC and they are numbered 0-65535. Those are the ones available.

Port scanning still is analogous to trying all these doors and see which one are open.

Just because it is a lot of doors to choose from doesn't make it very different. That's why guests ask a host where the bathroom is.

When you visit a website, it's not very cool for that site to check which of all your TCP ports are open. It's none of their business.

Re: Why Is This Website Port Scanning Me?

#442

Post by tripzilch »

ghostpepper wrote: post #412
sedatk wrote: post #354

Earlier quoted context omitted.

Port scanning is a brute force, over-reaching probing technique. A better analogy would be like visiting a shopping mall and trying to open every closed door you see, including the ones that say "authorized personnel only", "private", "do not enter" with an excuse like "I was trying to find out which shop was open".

In a store you can read the sign. Where is the sign saying that the port is not for you?

But when I'm visiting a website, I am not a "store". These ports are on localhost, that's more like asking where is the sign saying that my bedroom door is not for you to try and open. However, I will tell you behind which door the bathroom is.

Re: Why Is This Website Port Scanning Me?

#443

Post by sedatk »

m463 wrote: post #438
sedatk wrote: post #436

Earlier quoted context omitted.

Any port that isn’t advertised to you explicitly is an overreach. You don’t run through hosts and ports to “find out services to use”. What’s a legitimate use case for that other than peeping?

I used to think the exact same thing about wardriving. Nobody should catalog wifi access points and their location! Of course, now this ethical lapse is a business model and apple, google and everyone else does it. literally anyone with a smartphone is doing this to your wifi access point. And they will do the reverse to find out precise location.

Exactly. There are assumptions in every threat model, and violating them isn't a legitimate use case because someone "forgot to protect" their private resource. "Door wasn't locked" isn't an excuse.

Re: Why Is This Website Port Scanning Me?

#444

Post by thejynxed »

m463 wrote: post #438
sedatk wrote: post #436

Earlier quoted context omitted.

Any port that isn’t advertised to you explicitly is an overreach. You don’t run through hosts and ports to “find out services to use”. What’s a legitimate use case for that other than peeping?

I used to think the exact same thing about wardriving. Nobody should catalog wifi access points and their location! Of course, now this ethical lapse is a business model and apple, google and everyone else does it. literally anyone with a smartphone is doing this to your wifi access point. And they will do the reverse to find out precise location.

Or in the case of being a Comcast customer, you get no say in the matter as they force an open guest network if you use their equipment.

Re: Why Is This Website Port Scanning Me?

#445

Post by thejynxed »

splonk wrote: post #291

> Furthermore, when I installed and ran a VNC server, I didn't detect any difference in site behavior - so why is it looking for it? Not an eBay employee, but used to work in fraud detection. Two very obvious related guesses from my experience: 1. Fingerprinting a user to help identify account takeover (ATO). Open port signatures is probably a pretty good signal for that kind of thing (and it doesn't seem to be measu…

Those four are still considered untrustworthy, and I've had to add India, Ukraine, and Brazil to the list of nations I filter entirely.

Re: Why Is This Website Port Scanning Me?

#446

Post by louhike »

jolmg wrote: post #248

> Port Scanning is Malicious Though port scanning can be (and maybe even frequently is) done with malicious intent by looking for misconfigured/bugged servers, I disagree that it's inherently malicious. Port scanning is just about checking to see what services a host is offering you. It's like going to a random shop at a mall and asking what services they provide. Would asking about their services be malicious? It fe…

FWIW port scanning is illegal in some countries as France.

Re: Why Is This Website Port Scanning Me?

#447

Post by closeparen »

vbezhenar wrote: post #365
gsnedders wrote: post #247

Earlier quoted context omitted.

To add more about why current browsers don't do this: One is clearly that you need to communicate the requesting IP deep enough into the network stack to the point where you get the DNS response (if there is one), which means there's a fair bit of work to ensure this is done everywhere; Another is it's known to break corporate websites ( https://internal.bigcorp.com/ on a public IP expecting to be able to access priv…

In Kazakhstan we have e-government website. This website allows users to use crypto-tokens to access government services (every citizen can get a digital certificate representing his identity). This website used to run Java applet. This applet was signed and it could access restricted APIs to access USB device. So website talked to applet and applet talked to USB device to sign data. After major web browsers disabled…

There's no need to roll your own hardware integration for crypto tokens. Browsers have been able to do PKCS#11 client certificates from smart cards for a long time, in case WebAuthN / U2F are too modern for you.

Re: Why Is This Website Port Scanning Me?

#448

Post by Shorel »

_nalply wrote: post #417
justinclift wrote: post #397

Earlier quoted context omitted.

> So government website now uses JavaScript to connect to 127.0.0.1:12345 using websocket. It sounds like random other websites (Ebay, etc) would be able to interact with people's USB devices this way too. Maybe without people knowing?

Yes, if this is programmed badly (missing security or a security hole). The browser connecting to the government website accesses two servers: the original one and the second local one you install yourself on your system. The local server runs natively and therefore can access the USB device. Like all servers it should be programmed such that misuse by hackers is prevented.

That's already a security hole.

The only thing missing is a rogue website abusing it.

There's no guarantee you will never connect to any rogue website that abuses this government mandated backdoor.

Post reply on HN