I can see your local web servers

Re:I can see your local web servers by gnomewascool on Tuesday May 28, 2019 @05:32AM (#20028516)

If you use uMatrix, you can easily block the localhost and local network "sniffing" with the following rule[0]:

  * 127       * block    ### block access to IPv4 localhost 127.x.x.x
  * localhost * block
  * [::1]     * block    ### block access to IPv6 localhost
  * 192.168   * block    ### block access to LAN 192.168.x.x

In principle, you can use this without any other blocking, i.e. with the rule:

  * * * allow

and hence without disabling javascript on any sites.

[0] https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.2.3-uM...

Edit: as pointed out by DarkWiiPlayer below, if you want to be able to access the localhost websites from the same browser, you need:

  localhost localhost * allow

and similarly for the LAN. In full:

  127       127       * allow
  localhost localhost * allow
  [::1]     [::1]     * allow
  192.168   192.168   * allow

[ Parent | on HN ]

Re:I can see your local web servers by spyder on Tuesday May 28, 2019 @06:07AM (#20028673)

Also, uBlock has an option in its settings to block the webrtc leak (but not enabled by default):

"Prevent WebRTC from leaking local IP addresses"

[ Parent | on HN ]

Re:I can see your local web servers by dredmorbius on Tuesday May 28, 2019 @05:13PM (#20034486)

Add all the RFC1918 unroutable private networks.

https://en.wikipedia.org/wiki/Private_network

    10.0.0.0 – 10.255.255.255 (10.0.0.0/8)
    172.16.0.0 – 172.31.255.255 (172.16.0.0/12)
    192.168.0.0 - 192.168.255.255 (192.168.0.0/16)
    127.0.0.0 - 127.255.255.255 (127.0.0.0/8)

https://tools.ietf.org/html/rfc1918

Possibly also 100.64.0.0/10 for carriers.

https://tools.ietf.org/html/rfc6598#page-8

[ Parent | on HN ]

Re:I can see your local web servers by johnp_ on Wednesday May 29, 2019 @07:32PM (#20046832)

Possibly also the IPv6 ULAs:

https://en.wikipedia.org/wiki/Unique_local_address

Not sure if those can be expressed in uMatrix as a prefix rule.

[ Parent | on HN ]

Re:I can see your local web servers by OJFord on Tuesday May 28, 2019 @05:57AM (#20028627)

Presumably also:

    * 10      * block    ### block access to LAN 10.x.x.x

[ Parent | on HN ]

Re:I can see your local web servers by captn3m0 on Tuesday May 28, 2019 @05:58AM (#20028634)

uMatrix blocked all of it for me by default.

[ Parent | on HN ]

Re:I can see your local web servers by gnomewascool on Tuesday May 28, 2019 @06:08AM (#20028681)

Yes, but by default uMatrix might be overly strict for many people. For instance, by default it blocks all third-party javascript.

[ Parent | on HN ]

Re:I can see your local web servers by black_puppydog on Tuesday May 28, 2019 @05:38AM (#20028541)

that's awesome, using it!

but to be fair, the point seemed to be more that if you run something that's "only" exposed locally... don't. securing each and every machine with uMatrix doesn't seem the answer to this.

[ Parent | on HN ]

Re:I can see your local web servers by DarkWiiPlayer on Tuesday May 28, 2019 @05:48AM (#20028585)

you'd need at least

    localhost localhost * allow

to be able to open sites on localhost directly.

[ Parent | on HN ]

Re:I can see your local web servers by bg0 on Tuesday May 28, 2019 @10:05AM (#20030102)

Anyone know if this can be done on a hosts level instead of a browser level?

[ Parent | on HN ]

Re:I can see your local web servers by comex on Tuesday May 28, 2019 @07:15PM (#20035357)

It can’t. At best you can try to modify the hosts file to point localhost to somewhere bogus, but aside from the potential breakage that could cause, it won’t help against any site that simply accesses http://127.0.0.1 instead of http://localhost. In general, the hosts file can be useful for quick-and-dirty blocking, but it’s not really capable of enforcing a security barrier.

Edit: But there may be other ways to do it at an OS level, depending on your OS.

[ Parent | on HN ]