Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why Is This Website Port Scanning Me?

nullsweep.com

Post reply on HN
Print view View original

91–100 of 448 posts

Re: Why Is This Website Port Scanning Me?

#91

Post by Cactus2018 »

gruez wrote: post #56
xur17 wrote: post #21

Is there a way to block this at the browser level? Ex: block access to localhost for all domains (except from localhost itself)?

Ublock allows you to block websocket requests. eg. *$websocket will block all websocket connections. You probably want to operate on a whitelist on a site by site basis. Blocking localhost or 127.0.0.1 isn't reliable because sites can use dns rebinding attacks to bypass your filters.

Thanks for this. Adding the string to uBlock Origin's "My Filters" tab worked perfect.

    *$websocket
Tested with https://websocketstest.com/

Re: Why Is This Website Port Scanning Me?

#92

Post by anarcat »

inetknght wrote: post #53
xur17 wrote: post #21

Is there a way to block this at the browser level? Ex: block access to localhost for all domains (except from localhost itself)?

Use uMatrix and set a global block.

specifically, websockets are blocked by the "XHR" component on the popup panel, which also blocks XmlRPC and the Fetch API. as a rule, you could block all XHR requests everywhere with:

    * * xhr block
What I actually do is block everything but first-party requests, apart from CSS and images:

    * * * block
    * * cookie block
    * * css allow
    * * frame block
    * * image allow
    * 1st-party * allow
    * 1st-party css allow
    * 1st-party frame allow
    * 1st-party image allow
i actually allow xhr on third-party requests once i enabled third-party requests, which makes it possible to "enable" a bunch of site with two clicks (popup panel then click on "all").

Re: Why Is This Website Port Scanning Me?

#94

Post by the8472 »

blakesterz wrote: post #40

hmmm, so the conclusion is: "Whether the port scan is used as part of an infection or part of e-commerce or bank "security checks", it is clearly malicious behavior and may fall on the wrong side of the law." Though I really don't know what ebay or banks or any site might be doing, it seems like it's almost certainly a defensive thing looking for signs of trouble. I don't know if I'd call it malicious. Isn't this tot…

You don't know whether they're collecting the data and running analysis on it. What services you're running may already reveal something about you.

Re: Why Is This Website Port Scanning Me?

#95

Post by marcosdumay »

souterrain wrote: post #52

The greater issue is that browsers are allowing code executing from the public Internet scope (scope meaning security domain) network access to the localhost scope or the Intranet scope (RFC1918 addresses.) If anything, this should require very explicit permission granting from the user. I’d prefer it be something more like an undocumented toggle accessible solely to developer types.

> to the localhost scope or the Intranet scope

That's too little. All access from a different origin should be blocked by default, not only to local nets.

Re: Why Is This Website Port Scanning Me?

#96

Post by souterrain »

n0tam3m3 wrote: post #76
souterrain wrote: post #52

The greater issue is that browsers are allowing code executing from the public Internet scope (scope meaning security domain) network access to the localhost scope or the Intranet scope (RFC1918 addresses.) If anything, this should require very explicit permission granting from the user. I’d prefer it be something more like an undocumented toggle accessible solely to developer types.

The company may be interested in whether they want to grant access to the user to access to their systems. Does the user shoulder any responsibility?

I think what you’re saying is the user might be an employee on some internal trusted company network. The employer should have control of that browser (and entire endpoint), otherwise the network should likely not be considered trusted. So, in this case, no, the user shouldn’t have the ability to authorize this; the administrator of that browser should.

Know your network.

Re: Why Is This Website Port Scanning Me?

#97

Post by zrobotics »

marcojrfurtado wrote: post #80
souterrain wrote: post #52

The greater issue is that browsers are allowing code executing from the public Internet scope (scope meaning security domain) network access to the localhost scope or the Intranet scope (RFC1918 addresses.) If anything, this should require very explicit permission granting from the user. I’d prefer it be something more like an undocumented toggle accessible solely to developer types.

There are legitimate reasons for port scanning, but I'm not sure most websites out there are using it for noble purposes. I guess browsers could allow it based on explicit permission from the user, just like it's already done for microphone and camera.

I'm curious, what would be a good reason to do this? I'm not creative enough to think of anything this enables a site to do that isn't malicious. If I'm running a service on localhost, and that service needs to communicate with the site I'm browsing, surely I could just direct that service to communicate with the site itself.

For instance, if I'm running a local chat application and need it to communicate with the web version, why does the website need to be able to port scan to accomplish this? I can think of other ways to accomplish this that are a lot more secure.

Re: Why Is This Website Port Scanning Me?

#98

Post by throwphoton »

wrkronmiller wrote: post #67
gnu8 wrote: post #27

Earlier quoted context omitted.

This is such an obvious consequence of web sockets that I wonder how anyone could have entertained the idea long enough to sober up and write the code. This is worse than letting a web page script have access to the clipboard, record mouse movements, and similar information leaks, because instead of just stealing information, now a web page can actively compromise any host on your network.

I agree this is quite disturbing. It does not, however, sound like an attacker can establish arbitrary TCP connections (at least using the technique from the article). Instead, the attacker can determine if something is listening on a port because it will take a different amount of time to negotiate/drop a connection to a port when there is a listener than when there is not a listener. In other words, this sounds lik…

> It does not, however, sound like an attacker can establish arbitrary TCP connections

Maybe not, but what if the ports you have open actually are HTTP servers for development purposes? In that case wouldn't a website be able to crawl your unreleased work, and/or mess with what you're doing, with requests seemingly "out of nowhere"?

Re: Why Is This Website Port Scanning Me?

#99

Post by jackewiehose »

bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

There is media.peerconnection.enabled in about:config. When set to false, WebRTC doesn't work but I'm not sure if there isn't anything left active.

Also uBlock has an option "Prevent WebRTC from leaking IP adresses".

WebRTC should be disabled by default or firefox should ask explicitly like with webcam-access.

There have already been reports where sites use your browser as a peer in a P2P-network (without your consent). This can be really problematic depending on where you live.

Re: Why Is This Website Port Scanning Me?

#100

Post by dvdkhlng »

owaislone wrote: post #89

This is scary. I've always left locally running services unprotected for convenience given they can't be accessed from outside. I can imagine a lot of people running local apps, servers or databases without any auth that could contain sensitive information. Would a webpage be able scrape data from such services? Any way to disable this completely in Firefox and Chrome?

No, webpage javascript is limited to using websocket protocol [1] for connections. That means your database or IP camera, or VoIP phone or router are safe for now. Though the websocket connection establishment seems to allow the javascript to differntiate between a closed and an open TCP socket and a TCP socket that speaks websocket.

[1] https://en.wikipedia.org/wiki/WebSocket

Post reply on HN