Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Is This Website Port Scanning Me?

nullsweep.com

Post reply on HN
Print view View original

51–60 of 448 posts

Re: Why Is This Website Port Scanning Me?

#51

Post by mcny »

duxup wrote: post #19
badRNG wrote: post #2

This raises the question: Is port scanning without consent a violation of the CFAA? Either it is legal, and researchers should face no repercussions for doing so, or it isn't and eBay is non-compliant with CFAA. I recall hearing about someone either being arrested or convicted due to port scanning a courthouse, but it was many years ago and I can't find the case with a cursory Google search. I have to wonder what val…

When did networking support we often had old code + lower quality equipment that could / would crash if you used off the shelf security software that would go out and scan and then try all sorts of things and then generate a report. I'd say 90% of the time the powers that be at the company had no idea someone was running that software, or that it was still running at their company, and then someone moved a firewall a…

> I'd say 90% of the time the powers that be at the company had no idea someone was running that software, or that it was still running at their company, and then someone moved a firewall and the system was exposed to more than intended. Then they'd turn it of ... and find another similar tool running somewhere else.

This demonstrates the absurdity of the CFAA more than anything else. Sorry for sounding like a broken record but the CFAA is not salvageable and MUST be repealed.

Re: Why Is This Website Port Scanning Me?

#52

Post by souterrain »

The greater issue is that browsers are allowing code executing from the public Internet scope (scope meaning security domain) network access to the localhost scope or the Intranet scope (RFC1918 addresses.)

If anything, this should require very explicit permission granting from the user. I’d prefer it be something more like an undocumented toggle accessible solely to developer types.

Re: Why Is This Website Port Scanning Me?

#54

Post by maayank »

If anyone thinks of implementing this, don't forget to guard against reflection attacks[1]

EDIT: revisiting my comment (and the wikipedia article linked), a reflection or amplification attack in this context is sending traffic and generating (perhaps much more) traffic from a different source than yours as part of an attack. For example, you could spoof the IP address of the HTTP packets and cause the server to port scan another machine -> little traffic (HTTP request) causing a lot of traffic (port scanning). As part of a DDOS attack, a botnet for example could use this to amplify their attack and masquerade the source.

[1] https://en.wikipedia.org/wiki/Denial-of-service_attack#Refle...

Re: Why Is This Website Port Scanning Me?

#55

Post by pbhjpbhj »

101404 wrote: post #26
pbhjpbhj wrote: post #18

Earlier quoted context omitted.

What's Shodan.io's legitimate use? Sounds like the "torrents can be used for legitimate content" type argument where in reality you a rounding error the use is not lawful??

I used to use torrents a lot and always for legitimate data transfers.

Yes, I've used it to download Linux distros, but the point still stands.

Re: Why Is This Website Port Scanning Me?

#56

Post by gruez »

xur17 wrote: post #21

Is there a way to block this at the browser level? Ex: block access to localhost for all domains (except from localhost itself)?

Ublock allows you to block websocket requests. eg.

    *$websocket
will block all websocket connections. You probably want to operate on a whitelist on a site by site basis. Blocking localhost or 127.0.0.1 isn't reliable because sites can use dns rebinding attacks to bypass your filters.

Re: Why Is This Website Port Scanning Me?

#57

Post by MaxBarraclough »

paulryanrogers wrote: post #35
dollers wrote: post #15

Earlier quoted context omitted.

Someone's never caught a case. You may not think this is true but the way the legal system works is everything is illegal. Then when they need to get you you are already guilty. Everyone else they just ignore. Crazy, right? LMAO a downvote in 3 seconds. Good old hacker news. Well, downvotes don't make you right. I'm trying to open your eyes and you downvote me. I guess that is to be expected.

"Innocent until proven guilty" suggests that everything is legal unless there is a law against it.

Not quite the same thing. A legal system could use presumed guilt (defaulting to assuming an accusation is true) while still having a 'blacklist' approach to which actions are punishable.

https://en.wikipedia.org/wiki/Everything_which_is_not_forbid...

Re: Why Is This Website Port Scanning Me?

#59

Post by crankylinuxuser »

gnu8 wrote: post #27
wrkronmiller wrote: post #16

Earlier quoted context omitted.

IANAL but this type of websocket port scan seems inherently different from what Shodan does. Shodan is outside your network's firewall, therefore only able to access services you've exposed to the wider web. If I understand the article, the websocket scan eBay is doing is trying to connect to local listeners on your laptop, behind your network's firewall and possibly even behind your laptop's firewall.

This is such an obvious consequence of web sockets that I wonder how anyone could have entertained the idea long enough to sober up and write the code. This is worse than letting a web page script have access to the clipboard, record mouse movements, and similar information leaks, because instead of just stealing information, now a web page can actively compromise any host on your network.

Yep. Just waiting for this "feature" to be added to metasploit.

Re: Why Is This Website Port Scanning Me?

#60

Post by api »

souterrain wrote: post #52

The greater issue is that browsers are allowing code executing from the public Internet scope (scope meaning security domain) network access to the localhost scope or the Intranet scope (RFC1918 addresses.) If anything, this should require very explicit permission granting from the user. I’d prefer it be something more like an undocumented toggle accessible solely to developer types.

Yeah, that's the best solution. It should be like microphone or camera access. It should say "this web site is attempting to access a resource on your local system / network."

I don't think you need to overdo it in terms of making the warning red, etc. Just a popup will really discourage people from trying to use this for fingerprinting.

BTW the site says:

"Port scanning is malicious." I don't agree. There are many many things that can look like a port scan but are not malicious, most notably NAT traversal attempts by WebRTC, games, chat apps, and so on.

Post reply on HN