Live data from Hacker News

eBay is port scanning visitors to their website

blog.nem.ec

71–80 of 148 posts

Re: eBay is port scanning visitors to their website

#71
post #23
post #15

Just wait until the database of ip and open ports is leaked and hackers start exploiting vulnerabilities of softwares listening to these ports to break into random people devices.

That database has existed for ages: https://www.shodan.io/

Does Shodan have a map of public ip -> natted local network ip:port pairs?

I thought it was only public ip ports.

Re: eBay is port scanning visitors to their website

#72
post #69

Earlier quoted context omitted.

Seller A is selling an item he bought for $5 dollars. He's trying to sell it for $10, for a 100% profit. The current bid is $7 dollars. He logs in to a remote desktop and bids on his own item to bump the price with a different MAC and IP. It sells for $12 and he's happy. Seller B is having a hard time making sales. She thinks he needs better ratings. So she logs into the site using a remote client and 'buys' 10 of he…

> Seller A is selling an item he bought for $5 dollars. He's trying to sell it for $10, for a 100% profit. The current bid is $7 dollars. He logs in to a remote desktop and bids on his own item to bump the price with a different MAC and IP. It sells for $12 and he's happy. So why don't you set the starting price at $10? Does ebay not let you set the base price?

An auction for an item with a history of an apparent bidding war up to $10 appears much more desirable than an auction for an item that just sits there for a week at its opening bid of $10.

Re: eBay is port scanning visitors to their website

#73

Earlier quoted context omitted.

I don't understand the issue you are describing. You can already scan the entire ipv4 space for cheap with tools like zmap[0]. How does a premade list help ? In addition, I would expect such a DB to go stale very quickly. [0] https://zmap.io/

What is the legality of scanning large subsets that you don’t control?

I think it is generally acceptable for public networks, but eBay is using webrtc to bypass firewalls and then scanning private networks.

That’s illegal in most circumstances (at least in the US).

Re: eBay is port scanning visitors to their website

#74

I thought it would be obvious that eBay is doing this to identify bots (usually on servers) vs. real users (on client-only devices).

That is one of the main purposes, yes. I have no problem with it, personally. Many HN users are very privacy-conscious and consider it not acceptable for any purpose, though; including that one. I think both positions are fine.

Re: eBay is port scanning visitors to their website

#75
post #46
post #22

Earlier quoted context omitted.

Ratings are an important part of the eBay ecosystem. He's saying people let others use their eBay accounts through RDC to game the system. Also it's an auction site. People want to raise the price by bidding on their own items

Exactly. So let's we have fraudseller_1 that sell something like iPhone. Here comes honestbuyer_1 that bid for this item with $50. Seller sees offer, but want to rise it. Since seller can't use his own IP he is using some remote desktop to login somewhere else as fraudbuyer_1 (different account!) and bid $100. Then he wait honestbuyer_1 to bid again. If this happens then two - fraudbuyer_1 and honestbuyer_1 can "race…

eBay has a policy that allows buys to not pay with limited consequences. If eBay simplicity forced the bidding account to have enough cash to cover the transaction this would no longer be viable as some percentage of the time the shell bidder would have to pay out the fees.

Re: eBay is port scanning visitors to their website

#76
post #72
post #69

Earlier quoted context omitted.

> Seller A is selling an item he bought for $5 dollars. He's trying to sell it for $10, for a 100% profit. The current bid is $7 dollars. He logs in to a remote desktop and bids on his own item to bump the price with a different MAC and IP. It sells for $12 and he's happy. So why don't you set the starting price at $10? Does ebay not let you set the base price?

An auction for an item with a history of an apparent bidding war up to $10 appears much more desirable than an auction for an item that just sits there for a week at its opening bid of $10.

This is why I never bid till 10sec out using a automated app. It’s stupid to actually bid on items and allow the other bidders to respond.

Re: eBay is port scanning visitors to their website

#77
post #14

It's crystal clear why they do this. Many companies or persons share their desktops for remote usage. Later they sell this service to eBay users. And they're using it for different fraudulent activities - from making real sales (just for stars) to bidding to own items (for rising price). For years eBay fight this.

Part of me thought it was done to combat bots. I still find it distateful. Part of me understands it and I can take an educated guess how it was justified.

Re: eBay is port scanning visitors to their website

#79

Earlier quoted context omitted.

As a developer on a product that uses websocket extensively, I'm afraid that this will lead to the already huge distrust in the technology. If IT admins get wind of this they'll just block it (or never unblock it since it's been blocked by some from day 1) and our product gets degraded experience.

like dropping ICMP replies on firewalls. idiotic because it gives a very false sense of security. it's been a useless "security" practice since the 90s.

But don't firewalls drop everything inbound by default? So it's more that people don't know they should create rules to allow ICMP, no?

Re: eBay is port scanning visitors to their website

#80
post #69

Earlier quoted context omitted.

Seller A is selling an item he bought for $5 dollars. He's trying to sell it for $10, for a 100% profit. The current bid is $7 dollars. He logs in to a remote desktop and bids on his own item to bump the price with a different MAC and IP. It sells for $12 and he's happy. Seller B is having a hard time making sales. She thinks he needs better ratings. So she logs into the site using a remote client and 'buys' 10 of he…

> Seller A is selling an item he bought for $5 dollars. He's trying to sell it for $10, for a 100% profit. The current bid is $7 dollars. He logs in to a remote desktop and bids on his own item to bump the price with a different MAC and IP. It sells for $12 and he's happy. So why don't you set the starting price at $10? Does ebay not let you set the base price?

At a lower starting price, you get people bidding. And then you fraudulently raise it. The legit bidders think they have a now have a "vested interest" in it and will bid up "just a little more".

It's the same thing with the penny auction sites like DealDash which is part of their terribleness.

Post reply on HN