7 ms·

This raises the question: Is port scanning without consent a violation of the CFAA? Either it is legal, and researchers should face no repercussions for doing

• ajphdiv 6y ago
  Not illegal. Sites like shodan.io would have an issue if it was.
  • bzb3 6y ago
    That's a fallacious argument. The fact that someone is doing something doesn't mean it's automatically legal.
    • TechBro8615 6y ago
      IANAL, but more likely it depends on intent and context. So shodan.io is okay because it’s not explicitly malicious, and they have clear paths to contact them if you suspect abuse. Whereas, if you’re suspected of hacking a website, the fact that you port scanned it a week prior to password spraying it might serve as evidence against you. That is, it seems unlikely anyone would be prosecuted for port scanning alone, but it could be an act that demonstrates intent of a later action. One time, I port scanned my public IP (of my ISP) from an EC2 box, and I got an email from EC2 saying they received an abuse complaint from the ISP for port scanning activity.
      • pbhjpbhj 6y ago
        What's Shodan.io's legitimate use? Sounds like the "torrents can be used for legitimate content" type argument where in reality you a rounding error the use is not lawful??
        • jerf 6y ago
          If I were a serious baddie, I'd be afraid of using Shodan. Who knows who has what logging on that, and what honeypots may have been seeded into it for just such an occasion? It's not that hard to get that information yourself, from sources you control yourself. Legitimate usage from researchers and people reading about infrastructure they have the right to do security testing on may be a larger percentage than you think.
        • 101404 6y ago
          I used to use torrents a lot and always for legitimate data transfers.
          • pbhjpbhj 6y ago
            Yes, I've used it to download Linux distros, but the point still stands.
            • 101404 6y ago
              Not really, it totally contradicts the made-up point.
              • pbhjpbhj 6y ago
                Can you explain. What percentage of torrent traffic do you suppose - or better have stats for - is not copyright infringing? I'd think it's about 0%. Would certainly be interested if you can prove that's wrong.
        • TechBro8615 6y ago
          There are plenty of legitimate uses of port scanning, and specifically, a port scanning database like Shodan. For example: - Monitoring your own network or that of your clients for exposed ports - Researching Internet topology, or performing aggregate queries like “how many nginx servers are connected to the Internet” Can you use it maliciously? Yes. But, most of the time, if you have a target it would make more sense to do the port scan yourself. And if you’re just dragnet searching for vulnerabilities, most you find will probably already have been exploited. Sites like shodan are good for the overall health of the web because they force website owners to maintain security posture. If you know that foregoing a wordpress upgrade means you’re one script kiddy with a shodan account away from getting hacked, you’re going to keep your site up to date. This saves you from script kiddies, but also from the more sophisticated hackers who would run a port scan themselves anyway.
    • ajphdiv 6y ago
      The more pointed argument would be there is no federal law prohibiting port scans.
      • TeMPOraL 6y ago
        Doesn't the Curl/For-loop Abuse Act (CFAA) cover it?
  • wrkronmiller 6y ago
    IANAL but this type of websocket port scan seems inherently different from what Shodan does. Shodan is outside your network's firewall, therefore only able to access services you've exposed to the wider web. If I understand the article, the websocket scan eBay is doing is trying to connect to local listeners on your laptop, behind your network's firewall and possibly even behind your laptop's firewall.
    • gnu8 6y ago
      This is such an obvious consequence of web sockets that I wonder how anyone could have entertained the idea long enough to sober up and write the code. This is worse than letting a web page script have access to the clipboard, record mouse movements, and similar information leaks, because instead of just stealing information, now a web page can actively compromise any host on your network.
      • crankylinuxuser 6y ago
        Yep. Just waiting for this "feature" to be added to metasploit.
      • wrkronmiller 6y ago
        I agree this is quite disturbing. It does not, however, sound like an attacker can establish arbitrary TCP connections (at least using the technique from the article). Instead, the attacker can determine if something is listening on a port because it will take a different amount of time to negotiate/drop a connection to a port when there is a listener than when there is not a listener. In other words, this sounds like a variant of a timing attack. As such, presumably, this particular avenue of attack can be mitigated by the browser vendor inserting a delay s.t. no information can be gleaned from how long it takes to negotiate/drop a websocket connection. EDIT: I also wonder if it would be possible to do a similar port scan using the timing of XHR requests to localhost (e.g. http://localhost:[port] http://localhost:[port]).
        • throwphoton 6y ago
• JoelMcCracken 6y ago
  Was it this? https://news.ycombinator.com/item?id=21023023 https://news.ycombinator.com/item?id=21023023
  • p410n3 6y ago
    That wasn't port scanning. They actually physically went inside the building.
  • badRNG 6y ago
    No, I think it was probably close to a decade ago, but I likely am misremembering some of the details. Could've been a police department, but I'm not sure. That one you linked is a messed up case. There is a phenomenal podcast that interviews those guys and walks through their engagement. https://darknetdiaries.com/episode/59/ https://darknetdiaries.com/episode/59/
• p410n3 6y ago
  This guy got arrested at least: https://www.securityfocus.com/news/126 https://www.securityfocus.com/news/126
  • billme 6y ago
    Article also states civil claims were dismissed - and criminal charges are unlikely to hold.
    • relaunched 6y ago
      I hope they weren't debilitated by the legal fees incurred.
      • badRNG 6y ago
        nmap's "Legal Issues" section states that the guy went on to start a successful digital forensics company, after spending years crushed under 6-figure legal fees. https://nmap.org/book/legal-issues.html https://nmap.org/book/legal-issues.html Edit: Link to the company http://www.forensicstrategy.com/ http://www.forensicstrategy.com/ He also has a data recovery company now http://www.myharddrivedied.com/ http://www.myharddrivedied.com/
• nerdponx 6y ago
  My guess is bot detection + user fingerprinting.
• dollers 6y ago
  Someone's never caught a case. You may not think this is true but the way the legal system works is everything is illegal. Then when they need to get you you are already guilty. Everyone else they just ignore. Crazy, right? LMAO a downvote in 3 seconds. Good old hacker news. Well, downvotes don't make you right. I'm trying to open your eyes and you downvote me. I guess that is to be expected.
  • paulryanrogers 6y ago
    "Innocent until proven guilty" suggests that everything is legal unless there is a law against it.
    • MaxBarraclough 6y ago
      Not quite the same thing. A legal system could use presumed guilt (defaulting to assuming an accusation is true) while still having a 'blacklist' approach to which actions are punishable. https://en.wikipedia.org/wiki/Everything_which_is_not_forbidden_is_allowed https://en.wikipedia.org/wiki/Everything_which_is_not_forbid...
    • crankylinuxuser 6y ago
      It doesn't make any sense in trying innocent people! (No, seriously, I know people who believe that.)
    • pdonis 6y ago
      Do you know how many laws there are? Not to mention common law, which is law established by previous court decisions on matters that have never been covered by any statute?
  • throwaway023421 6y ago
    Over the years I've seen "hacker" news become more of an echo chamber and instantly downvote anything against doctrine... I'll be downvoted for saying this.
    • 6y ago
• duxup 6y ago
  When did networking support we often had old code + lower quality equipment that could / would crash if you used off the shelf security software that would go out and scan and then try all sorts of things and then generate a report. I'd say 90% of the time the powers that be at the company had no idea someone was running that software, or that it was still running at their company, and then someone moved a firewall and the system was exposed to more than intended. Then they'd turn it of ... and find another similar tool running somewhere else. It could be a simple as a test or security system run amok.
  • mcny 6y ago
    > I'd say 90% of the time the powers that be at the company had no idea someone was running that software, or that it was still running at their company, and then someone moved a firewall and the system was exposed to more than intended. Then they'd turn it of ... and find another similar tool running somewhere else. This demonstrates the absurdity of the CFAA more than anything else. Sorry for sounding like a broken record but the CFAA is not salvageable and MUST be repealed.
• wrkronmiller 6y ago
  > I have to wonder what value eBay would get from port scanning its customers. From the article: > Looking at the list of ports they are scanning, they are looking for VNC services being run on the host, which is the same thing that was reported for bank sites. > VNC is sometimes run as part of bot nets or viruses as a way to remotely log into a users computer. There are several malware services that leverage VNC for these purposes.
  • deleted 6y ago
    [deleted]
• bitdivision 6y ago
  They're almost certainly doing it as part of a heuristic to detect bots. Hence the VNC / RDP ports. I would assume it's quite common for bots to have those ports open so they can be monitored
• hn_check 6y ago
  In this case it's a script running on your own web browser that's scanning localhost. You are effectively scanning yourself. It's in a different realm from external scans.
• kube-system 6y ago
  > Either it is legal, and researchers should face no repercussions for doing so, or it isn't and eBay is non-compliant with CFAA. Criminal law is usually not this simple, as most criminal laws will take into account the mental state of the person performing the action.
• rtkwe 6y ago
  It's probably part of their fraud detection and mitigation strategy. Combined with other info about your transactions it could help raise a flag about changes. As for the CFAA that's seemingly down to how aggressive the prosecutor is feeling about your case. I don't think it should be there's no real access happening and unless it's extremely aggressive and degrades network connectivity it's hard to argue there's any real damage done.
• hedora 6y ago
  Bypassing a firewall to run a port scan is almost certainly illegal. That’s what these sites are doing.
  • kchr 6y ago
    I agree with the sentiment, but by visiting the site and running the code, I believe you bypassed the firewall on your own.
    • arpa 6y ago
      Why don't you run this executable. No, this ransomware message has nothing to do with me, it's all you. Why do you do this to yourself?
• tptacek 6y ago
  Almost certainly not. Commercial unauthorized port scans are utterly routine. There are well-known companies premised on it. You can get to the same answer axiomatically from the text and case history of CFAA (a port scan literally can't grant you the access a CFAA claim needs to prove you intended), but that's obviously treacherous for non-experts to do; instead, the empirical demonstration should be conclusive here. I don't know why this scan is occurring, but fingerprinting is the most obvious guess, and intrusive fingerprinting performed by real companies is usually about ATO prevention, which means they're not going to tell you any more about it (ATO defense is an arms race).