7 ms·
eBay port scans visitors' computers for remote access programs
- vorticalbox 6y agoRead about this the other day but I have yet to be able to reproduce port scanning.
- thinkindie 6y agome neither on a Mac, and the article mentions that it doesn't happen on Linux. It might be restricted (or allowed) in Windows only
- ziml77 6y agoMe and a coworker found that uBO blocks it. Also from my tests without uBO enabled it didn't scan every time (seemed to only scan when logged out, but that could have been a coincidence)
- girst 6y agoNote that a browser firewall like uBlock Origin with EasyPrivacy (easylist.to) already blocks this: https://imgur.com/s7efEez.png https://imgur.com/s7efEez.png
- JMTQp8lwXL 6y agoThis image doesn't show any local ports trying to be accessed. I'm guessing this endpoint is what gets called after the scan is completed, but context is missing to be certain.
- nickt 6y agoPrevious discussion: https://news.ycombinator.com/item?id=23246170 https://news.ycombinator.com/item?id=23246170
- _qulr 6y agoAh, sorry. I searched HN stories for "eBay" and didn't find anything. Not sure why that story's author chose "This Website" for the title.
- robertlutece 6y agoYour article links to that exact story though.
- _qulr 6y agoYes, and the vague article title was a big reason I submitted this one instead. :-) I thought about submitting the other article with my own title, but I didn't want to "editorialize".
- shreve 6y agoIt looks like port 63333 is a common forwarding port for Postgresql. https://github.com/search?q=port+63333+database&type=Code https://github.com/search?q=port+63333+database&type=Code
- ferros 6y agoFair enough, they’re doing it to protect their business. But why should a user have to subject their machine internals to inspection by eBay? And, without their consent.
- nojito 6y agoVisiting a website implies consent.
- heinrich5991 6y agoNot in the GDPR.
- mschuster91 6y agoGDPR allows "necessary" data processing for "legitimate interests". IANAL but I believe a non-damaging portscan to check for security issues to be allowed. Especially as eBay has the legitimate interest to ward off fraud - and customers have the legitimate interest to have their accounts protected.
- TehCorwiz 6y agoThen they need to disclose that behavior. Because my firewall marks portscans as a malicious activity.
- rocqua 6y agoSince the portscan happens clientside on 127.0.0.1 I doubt your firewall will be able to notice the portscan.
- mschuster91 6y agoThat depends if you use IPv4 with NAT like almost everyone on a residential Internet uplink or IPv6 with a public routed address...
- crypt1d 6y agoThis is suppose to help with fraud? Lets be serious for a moment. The only thing that this is going to change is that the supposedly hacked computers will no longer run VNC on standard ports. I think what we might be seeing here is the outcome of some overpaid consultant's claim that they can protect ebay from fraud with 'sophisticated' malware detection.
- zu03776 6y agoHas anyone investigated how this protection works? That is, deliberately create an eBay account, log into eBay using a remote tool, and trigger the fraud detection? My curiosity is piqued, but I don't have an account to offer up. I'm wondering if eBay displays a fraud warning, or pretends to allow the transaction to occur (shadow bidding?), or just hellbans the account being used. For shill-bidding farms, the obvious counter is to move remote screen access to non-standard ports, or move to headless browser operation via other scripting methods.
- phire 6y agoIt probably does nothing directly. It will just feed the data-point into an anti-fraud/anti-spam system along with everything else. And the anti-fraud/anti-spam system is probably a machine learning black box. It will learn if this data-point is actually correlated with naughty behaviour, and what other factors are usually correlated.
- tinus_hn 6y agoIt might be some kind of system that tries to determine if the client is a ‘normal’ browser.
- badrabbit 6y agoIt helps but there are projects like censys.io and shadowserver ebay can use instead of a direct scan. Bad guys do use compromised seevers and devices,often it's bind() shell (like a webshell) that can easily be detected. I think it helps when they use compromised hosts as proxies to avoid IP restrictions.
- 6y ago
- jalla 6y agohttps://www.cbronline.com/news/halifax-port-scans https://www.cbronline.com/news/halifax-port-scans
- TekMol 6y agoIs it possible to configure uMatrix so it either blocks WebRTC completely or asks when a page tries to use it?
- TD-Linux 6y agoeBay's technique does not use WebRTC at all.
- yalogin 6y agoThis site is a standard reblogger. They just regurgitate stuff that they find on other sites or even reddit and Facebook. They don’t add anything new to the story. If anything they take away some context from when it was originally reported. I some how despise it a lot, the y provide no value but consistently take away advertisement dollars and clicks from the original author.
- richij 6y agoBleeping isn't churnalism. Daft name, so for the longest time I assumed it was garbage, but Lawrence and crew actually do good work.
- sloshnmosh 6y agoCopying the JavaScript to “beautifier(.)io” will show that this script does more than just poet scan. It also uses some low-level fingerprinting techniques using flash and various fonts to determine browser type. It also produces a public and private key.
- sdoering 6y agoSo you are saying this violates GDPR if it is done without user consent?
- afrcnc 6y agoDuplicate from this: https://news.ycombinator.com/item?id=23246170 https://news.ycombinator.com/item?id=23246170 Also, the BC article is highly sensationalized coverage with no links to actual source. smh, today's journalists
- MintelIE 6y agoI used to be able to turn off Websockets in Firefox (still can with Icecat), why was this feature removed?
- cornishpixels 6y ago> This makes sense as the programs being scanned for are all Windows remote access tools. Wait. VNC is a Windows remote access tool? LOL.