eBay is port scanning visitors to their website

Re:eBay is port scanning visitors to their website by moooo99 on Saturday June 06, 2020 @05:07AM (#23437752)

irrc, eBay uses websocket connections [0] to scan the ports. Firefox doesn't offer an option to disable websockets in the about:config page. However, I have read about workarounds by setting

  network.websocket.max-connections=0

This is a global setting and is applied to all websites. I also wasn't able to test this myself yet. Are there any good extensions for blocking websockets on for specific domains?

[0] https://nullsweep.com/why-is-this-website-port-scanning-me/

[ Parent | on HN ]

Re:eBay is port scanning visitors to their website by hazz99 on Saturday June 06, 2020 @06:02AM (#23438053)

To people reading this, many websites rely on websockets for real-time information. They would likely fallback to per-refresh HTTP requests, but it also may break a bunch of sites.

[ Parent | on HN ]

Re:eBay is port scanning visitors to their website by narrowtux on Saturday June 06, 2020 @06:55AM (#23438294)

As a developer on a product that uses websocket extensively, I'm afraid that this will lead to the already huge distrust in the technology.

If IT admins get wind of this they'll just block it (or never unblock it since it's been blocked by some from day 1) and our product gets degraded experience.

[ Parent | on HN ]

Re:eBay is port scanning visitors to their website by dicknuckle on Saturday June 06, 2020 @08:16AM (#23438625)

like dropping ICMP replies on firewalls. idiotic because it gives a very false sense of security. it's been a useless "security" practice since the 90s.

[ Parent | on HN ]

Re:eBay is port scanning visitors to their website by rasz on Monday June 08, 2020 @07:18PM (#23461848)

Zonealarm's "!1ALERT!! x.x.x.x is h4x0r1ng you with ICMP packets!" sold $millions worth of placebo in early 2000.

http://download.zonelabs.com/bin/media/pdf/ZA_Manual.pdf

[ Parent | on HN ]

Re:eBay is port scanning visitors to their website by 1over137 on Saturday June 06, 2020 @11:32AM (#23439846)

But don't firewalls drop everything inbound by default? So it's more that people don't know they should create rules to allow ICMP, no?

[ Parent | on HN ]

Re:eBay is port scanning visitors to their website by concerned_user on Saturday June 06, 2020 @11:57AM (#23440036)

Connection comes from your browser i.e. localhost to yourself, firewall is not setup to block such connections in most cases.

[ Parent | on HN ]

Re:eBay is port scanning visitors to their website by narrowtux on Monday June 08, 2020 @09:14AM (#23456193)

Yes, false sense of security hits the nail on the head.

Fits right there with unnecessary password rules too.

[ Parent | on HN ]

Re:eBay is port scanning visitors to their website by anewdirection on Saturday June 06, 2020 @10:19AM (#23439350)

You could say that about JS and I am not running that shit either.

[ Parent | on HN ]

Re:eBay is port scanning visitors to their website by dndvr on Saturday June 06, 2020 @07:34AM (#23438448)

Surely the websockets angle is a bit of a red herring?

Ebay will have your IP from your request so they can run nmap against your machine from their server without your browser ever knowing about it.

I also know of a bank that does similar via an old school sort of way, their online banking login page tries to load images from urls made up of your IP and various ports.

Presumably these are targeting known ports for online banking malware C&C http traffic rather than remote desktop services though.

And this is a bank that still uses frames 'for security', so it must be an old technique!

[ Parent | on HN ]

Re:eBay is port scanning visitors to their website by wongarsu on Saturday June 06, 2020 @07:44AM (#23438491)

Websockets bring them past the router and any other hardware firewall or NAT. Also various software only listens to localhost, on the assumption that local traffic is trustworthy.

They could still portscan from afar and it would still be sketchy, but using Websockets makes it worse

[ Parent | on HN ]

Re:eBay is port scanning visitors to their website by dndvr on Saturday June 06, 2020 @08:30AM (#23438698)

So does using websockets allow you to scan local IP ranges and find other devices on the LAN?

[ Parent | on HN ]

Re:eBay is port scanning visitors to their website by hedora on Saturday June 06, 2020 @10:26AM (#23439408)

By the rule of all web technology sucks and is untrustworthy, they block 10.0.0.0 and 192.168.0.0, but inexplicably allow 172.16.0.0-172.31.255.255.

(Or at least, that was what someone else claimed last time this came up on HN)

[ Parent | on HN ]

Re:eBay is port scanning visitors to their website by eganist on Saturday June 06, 2020 @02:51PM (#23441435)

Who's "they" in this context? It's unclear to me if this refers to eBay or browser vendors.

[ Parent | on HN ]

Re:eBay is port scanning visitors to their website by disposekinetics on Saturday June 06, 2020 @10:28AM (#23439413)

My understanding is it allows them to check for things listening on loopback, given they appear to be checking for SSH tunnels.

[ Parent | on HN ]

Re:eBay is port scanning visitors to their website by ilikenwf on Saturday June 06, 2020 @03:10PM (#23441530)

This won't actually disable websockets if I recall.

There's a blocklist that may make it into uBO in the future that blocks 3rd party access to localhost and other IANA reserved IP addresses, though.

https://github.com/uBlockOrigin/uBlock-issues/issues?q=is%3A...

[ Parent | on HN ]

Re:eBay is port scanning visitors to their website by the_pwner224 on Saturday June 06, 2020 @05:04PM (#23442211)

That link is incorrect.

https://github.com/uBlockOrigin/uBlock-issues/issues/1070

[ Parent | on HN ]

Re:eBay is port scanning visitors to their website by mycall on Saturday June 06, 2020 @09:13PM (#23443846)

That thread was a fun rabbit hole. !/s

[ Parent | on HN ]