13 ms·
eBay is port scanning visitors to their website
- cube00 6y agoPrevious discussion: https://news.ycombinator.com/item?id=23246170 https://news.ycombinator.com/item?id=23246170
- robert_tweed 6y agoIn case anyone thinks this is a dupe, it's not. This post is inspired by the first article. It gives a much more detailed analysis of the code and what data is sent where.
- maett 6y agoExtremely well written sum-up, learned a lot about how to approach an investigation like this. Thank you.
- olliej 6y agowasn't this on the front page just a few days ago?
- scollet 6y agoMore than one discussion can be had.
- Wowfunhappy 6y agoI respectfully disagree in this case—the last story was too recent, and this one does not contain any significant new information, so we're likely to end up just rehashing the same points (and have so far, in my estimation). Edit: But, thefreeman above just informed me there's actual new information in this article (which I originally hadn't read, because the comments here made me assume it was the same as the last story on HN). So, thanks!
- thefreeman 6y agoThis article actually reverse engineers the javascript and has a lot more information about what they are tracking and how they are doing it.
- soraminazuki 6y agoHas anyone confirmed whether they're still continuing this practice? I'm curious, but at the same time feel highly uncomfortable visiting a website that has no problems exploiting a browser loophole.
- cfn 6y agoJust tried ebay.co.uk and I can see several clear.png calls with 204 and a payload as described in the article.
- lazyjones 6y agoI thought it would be obvious that eBay is doing this to identify bots (usually on servers) vs. real users (on client-only devices).
- meowface 6y agoThat is one of the main purposes, yes. I have no problem with it, personally. Many HN users are very privacy-conscious and consider it not acceptable for any purpose, though; including that one. I think both positions are fine.
- lazyjones 6y ago> Many HN users are very privacy-conscious and consider it not acceptable for any purpose, though; including that one It's an opinion, I suppose, but it doesn't seem to be based on reasonable expectations. Anyone can portscan anyone else, lots of security researchers have published their findings from portscanning large IP address ranges etc. ... If I don't want other people to see or access open ports on my system, I can firewall them.
- detaro 6y agoExternal portscans are quite different from using your own machine to portscan itself/the local network.
- mehrdadn 6y agoI asked this earlier and nobody had a response, so thought I'd ask it again: is there an extension to block this? Edit: @Windows users: pip install pydivert and then try to write a script to block connections from Chrome to non-Chrome processes. you might need GetTcpTable2() or something. (Looking into this now. Check out http://stackoverflow.com/a/25431340 http://stackoverflow.com/a/25431340)
- sva_ 6y agoAs far as I know these port scans are done using WebRTC. Using a browser extension[0] it is easy to deactivate it on the go. Personally, I always have WebRTC disabled by default (as it has several nasty security implications), and only activate it if I explicitly need it for something. [0] https://addons.mozilla.org/en-US/firefox/addon/happy-bonobo-disable-webrtc/ https://addons.mozilla.org/en-US/firefox/addon/happy-bonobo-...
- moooo99 6y agoirrc, eBay uses websocket connections [0] to scan the ports. Firefox doesn't offer an option to disable websockets in the about:config page. However, I have read about workarounds by setting network.websocket.max-connections=0 This is a global setting and is applied to all websites. I also wasn't able to test this myself yet. Are there any good extensions for blocking websockets on for specific domains? [0] https://nullsweep.com/why-is-this-website-port-scanning-me/ https://nullsweep.com/why-is-this-website-port-scanning-me/
- hazz99 6y agoTo people reading this, many websites rely on websockets for real-time information. They would likely fallback to per-refresh HTTP requests, but it also may break a bunch of sites.
- narrowtux 6y agoAs a developer on a product that uses websocket extensively, I'm afraid that this will lead to the already huge distrust in the technology. If IT admins get wind of this they'll just block it (or never unblock it since it's been blocked by some from day 1) and our product gets degraded experience.
- igravious 6y agoHumanity constructed something wonderful and new. (The internet.) And the corporate web has all but destroyed it.
- phs318u 6y agoSlightly OT but I’d suggest that the thing that has “ruined” the internet (for me) more than any other single thing are trolls, and they predate the corporate web by a long way.
- anewdirection 6y agoI would take 2x trolls over the abusive advertising and tracking network we have now.
- mobilio 6y agoIt's crystal clear why they do this. Many companies or persons share their desktops for remote usage. Later they sell this service to eBay users. And they're using it for different fraudulent activities - from making real sales (just for stars) to bidding to own items (for rising price). For years eBay fight this.
- kburman 6y agoThey should find a better way instead of compromising privacy of all the users. And even if they decided don't they have any responsibility to tell the users.
- matz1 6y agoI don't think they shouldn't, most people don't think this is an issue. I certainly don't.
- hedora 6y agoThey’re bypassing your local network firewall, and local machine firewall, then attempting to connect to blocked ports. People have been jailed for less.
- matz1 6y agoI definitely don't agree with jail. Unless there is real damage, then I wouldn't consider it an issue.
- dontbenebby 6y agoSucks for that corporation. They have teams and teams of lawyers - they should have consulted one of them. It is not just for a corporation to suddenly decide the law is unfair when they are subjected to it when real people have been harmed by the same law.
- grooling 6y ago
- eraserj 6y agoJust wait until the database of ip and open ports is leaked and hackers start exploiting vulnerabilities of softwares listening to these ports to break into random people devices.
- Erwin 6y agoThat database has existed for ages: https://www.shodan.io/ https://www.shodan.io/
- hedora 6y agoDoes Shodan have a map of public ip -> natted local network ip:port pairs? I thought it was only public ip ports.
- antoinealb 6y agoI don't understand the issue you are describing. You can already scan the entire ipv4 space for cheap with tools like zmap[0]. How does a premade list help ? In addition, I would expect such a DB to go stale very quickly. [0] https://zmap.io/ https://zmap.io/
- nerdbaggy 6y agoWhat is the legality of scanning large subsets that you don’t control?
- hedora 6y agoI think it is generally acceptable for public networks, but eBay is using webrtc to bypass firewalls and then scanning private networks. That’s illegal in most circumstances (at least in the US).
- whydoyoucare 6y agoAny further pointer on the "illegal" aspect? Thanks.
- Maxious 6y agoThis might explain why some preinstalled HP laptop software (with open ports?) causes a BSOD when users visit ebay https://h30434.www3.hp.com/t5/Notebook-Operating-System-and-Recovery/Blu-screen-error-after-login-to-ebay-costumer-page/td-p/6692602 https://h30434.www3.hp.com/t5/Notebook-Operating-System-and-...
- canofbars 6y agoPreinstalled vendor software is just an endless stream of exploits
- ww520 6y agoA family member with a Dell has similar BSOD problem when visiting some of these websites. Do we know what software preinstalled on Dell causing the problem?
- woodrowbarlow 6y agothe BSOD minidump should tell you which driver crashed. GUIs exist for analyzing minidumps, it might even be feasible to talk someone through the process over the phone.
- aspenmayer 6y agoOne example of a GUI analysis tool for these kinds of memory dumps is WhoCrashed; another is BlueScreenView. https://www.resplendence.com/whocrashed https://www.resplendence.com/whocrashed http://www.nirsoft.net/utils/blue_screen_view.html http://www.nirsoft.net/utils/blue_screen_view.html
- ww520 6y agoGood to know. Thanks.
- ezoe 6y agoA preinstalled local server, presumably running in kernel space for it cause BSOD, crash when connected from localhost and attempted TLS handshake? The preinstalled crapware never changes.
- z3t4 6y agoThis is what happens when there is a browser monopoly. Fixing security do not have priority. Maximizing revenue is the priority. The browser should stop outgoing connections that are not from the same origin. Then users have to opt in like with popup windows.
- SamReidHughes 6y agoHuh. I've been using eBay a lot this week, and it might have triggered a kernel bug. I had terrible internet performance that got resolved by rebooting my Ubuntu 18.04 laptop.
- gear54rus 6y agoWhat can you possibly know from such a scan? Standard clearly states that pretty much nothing: https://www.w3.org/TR/websockets/#concept-websocket-close-fail https://www.w3.org/TR/websockets/#concept-websocket-close-fa... Sure they're shady and that needs to be blocked, but security implications? Pretty much nil.
- Sohcahtoa82 6y agoTiming attacks can be used to determine if the TCP connection was successful, even if no data could be exchanged because the WebSocket failed to negotiate.
- olliej 6y agoThe original post about this seemed to indicate it might be being used to track, identify, and/or verify a client is a real system vs. a bot
- cygx 6y agoSure they're shady and that needs to be blocked, but security implications? Pretty much nil. Fingerprinting. Vulnerability discovery. Messing up programs that don't know how to deal with unexpected HTTP requests.
- gkoberger 6y agoA similar article was on HN a few days ago: https://www.bleepingcomputer.com/news/security/list-of-well-known-web-sites-that-port-scan-their-visitors/ https://www.bleepingcomputer.com/news/security/list-of-well-... Here's the discussion about it: https://news.ycombinator.com/item?id=23361823 https://news.ycombinator.com/item?id=23361823
- dpenguin 6y agoeBay has a big fraud headache. They have a bunch of algorithms (from the pre-ML-hype days) that take a variety of inputs to determine whether a given transaction is fraudulent or not. Presence of remote login service on the user’s computer may tip the scale heavily in this calculation. Fraud detection is a necessary evil for all financial transaction companies in order to keep costs low for everyone else. If you’re worried about privacy, use CCPA’s right to information and ask them for a dump of everything they have on you. They are supposed to give you info that other SPs like Threatmetrix have on you as well if they really are transmitting it to 3rd parties.
- dpenguin 6y agoGreat analysis In the original article BTW. Hope to see more of these on HN.
- class4behavior 6y ago>They are supposed to give you info that other SPs like Threatmetrix have on you as well if they really are transmitting it to 3rd parties. This isn't a privacy protection, though, but a measure for accountability. That is, only the absence of data aggregation would still someone's worry about privacy.
- zappo2938 6y agoAgreed. This is for fingerprinting the user.
- matheusmoreira 6y ago> Fraud detection is a necessary evil for all financial transaction companies in order to keep costs low for everyone else. That doesn't mean they should be allowed to behave like cybercriminals. The risk of fraud doesn't give them a free pass to abuse our trust and invade our privacy. They aren't entitled to know what software people run on their own computers. Especially if they learn this information through underhanded means like port scanning people's local networks without their permission or knowledge. It doesn't matter how much money they're losing because of fraud, they don't get to violate these boundaries in order to reduce the risk associated with their own business.
- Nightshaxx 6y agoI saw him talk about how Threat Matrix is usually blocked.....but Threat Matrix has their clients get unique endpoint URLs to disguise it. I don't really know how AdBlock works, but aside from the extra time it would take, why doesn't adblockers look up the record of any URLs on the page and see if they are a CNAME for an A url that is on the block list?
- thefreeman 6y agouBlock origin does exactly that on browsers which support it. Which I believe is only Firefox at this time. https://github.com/uBlockOrigin/uBlock-issues/issues/780 https://github.com/uBlockOrigin/uBlock-issues/issues/780
- Nightshaxx 6y agoWell, I was already using Ff+UblockO, so this is just another reason to keep using it. I would really prefer I not get port scanned.
- nsajko 6y agohttps://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
- nerdbaggy 6y agoThe company that is actually providing this service is by Lexis Nexis https://risk.lexisnexis.com/corporations-and-non-profits/fraud-and-identity-management https://risk.lexisnexis.com/corporations-and-non-profits/fra...
- jurassic 6y agoI'm just a layman, but I don't see how ThreatMatrix could possibly be seen as within the spirit of GDPR. I hope regulators throw the book here.
- uniformlyrandom 6y agoGoogle's internal sso (which I accidentally stumbled upon) collects other endpoint-specific parameters to compose the digital signature (like browser window size and monitor size). This feels more effective and less intrusive. Not sure why ebay went this rather weird and creepy way instead.
- rtkwe 6y agoLooking for fraud signs is my guess, people don't usually use eBay through TeamViewer so if it's on and the port is open then an otherwise normal transaction gets really suspicious for example. They're probably feeding the open port info into their model to determine fraud risk for user logins and transactions. They may not even be using it actively yet because they'd need to gather a lot of example data to detect outliers.
- solnyshok 6y agohow can they differentiate between idling tv server running on (all) my machines vs. active tv session?
- rtkwe 6y agoI don't know if there's a detectable difference just looking at the ports; just having TeamViewer installed slightly increases the risk of any transaction being fraudulent though. I'm just trying to provide an example of how port data could be used for a meaningful purpose. Even just as an additional fingerprinting component it could be useful.
- fractal618 6y agoPerhaps they've asked threat metrix to handle a portion of their security and this was their solution? At the end of the day, we all need to realize that we send out far more information than we receive when we surf the web.
- missblit 6y agoA couple Chrome devtools debugging tips: 1. Local Overrides feature allows you to persist and edit source files across page loads (unfortunately only source files currently, so you're out of luck if the JS comes from an XHR or something) 2. F3 on the network panel will let you search for a string across all resources the page loaded. Can be useful for tracking down where stuff like user-agent checks are called (if not obfuscated). Also calling the code obfuscated is pretty generous. It's amazing how common things like shift ciphers, XOR tricks, etc. are when the browser's REPL cuts through them like butter.
- nemec0 6y agoThanks for the tips! Local Overrides is new to me and would have helped a lot. I made heavy use of F3 (also Ctrl+Shift+F) to find my way around those scripts, and to find my place again after each page refresh.
- jokoon 6y agoI remember while working at some company, I started using a local flask server. For some reason, I remember one company router kept making http request on port 5000 or 8000, can't remember which port, because it was literally showing on the terminal, with the http path, at random times. I'm sure being a hacker must be pretty fun these days.
- _trampeltier 6y agoCould for ex. a website like ebay also access the intern Intranet in a company? Or my cloudstorage like SharePoint that is open in the same browser?
- floatingatoll 6y agomacOS users, I believe based on my testing that you can block your installed web browsers from localhost port scanning using LittleSnitch. This way you can continue to allow WebRTC and WebSockets to the rest of the Internet (where it's useful), while denying web browsers access to localhost except for specific ports you allow. However, I encourage you to be careful and only block web browsers to localhost using this method, because lots of macOS applications depend on localhost connections to talk to themselves, so if you block everything from talking to localhost you may break e.g. LittleSnitch, macOS itself, etc. NO WARRANTY, HAVE BACKUPS, standard stuff. To set this up, for each /Applications/Browser.app, create a LittleSnitch 'Deny Connections' To 'IP Addresses' rule and enter '127.0.0.1, ::1' without quotes into the text field and click OK. Then right-click on the newly-created application rule and select 'Increase Priority', which will bold the rule text 'Deny outgoing connections to 2 IP addresses'. Repeat this for each Browser.app you use. If you'd like to specifically enable certain localhost ports to be accessible by your browser (such as 80/443), you can create another rule using the above steps, but before saving the rule, change 'Deny' to 'Allow' and click the '\/' dropdown caret button and enter the appropriate port and select TCP. I encountered some UI quirks doing this but once it's created it works as it should. Here's a screenshot of the results of my testing for comparing against. I'm not really familiar with how LS works so I can't offer much support, but I fresh-installed it and left all the defaults alone and it worked, so more advanced users shouldn't have much trouble. https://i.imgur.com/T0yqrdM.png https://i.imgur.com/T0yqrdM.png Good luck! (For those wondering if other software can do this, I tested various macOS application firewalls today and most of them either global-allow localhost connections or don't offer outbound filtering at all. So far, the only one that can block web browsers only from connecting to localhost is LittleSnitch, with some quirks that I wrote a note to their support about. At least one let me create the rule and cheerfully said it was active and then it didn't block anything.)
- apple4ever 6y agoAh thanks for this. I was looking for a way to accomplish this. I own LS so I'm going to give this a shot.
- deleted 6y ago[deleted]
- oefrha 6y agoI never understood why websockets aren’t subject to same origin policy and CORS (or similar policies). Any web expert here could explain this design (non-)decision?
- wsxcde 6y agoWebsockets are subject to the same origin policy. There's nothing you can do to violate the SOP via websockets that you wouldn't be able to do with regular HTTP or XHR.
- oefrha 6y agoThat's not true. You can talk to any other origin with ws. Simple example: index.html: <html> <head></head> <body> <div id="message"></div> <script> let ws = new WebSocket("ws://localhost:5000/"); ws.onopen = () => ws.send("hello server!"); ws.onmessage = ev => { const $message = document.getElementById("message"); $message.textContent = `ws://localhost:5000/ response: ${ev.data}`; }; </script> </body> </html> server.js: const express = require("express"); const http = require("http"); const WebSocket = require("ws"); const app = express(); const server = http.createServer(app); const wss = new WebSocket.Server({ server }); wss.on("connection", ws => { ws.on("message", message => { console.log(`received: ${message}`); ws.send("hello client"); }); }); server.listen(5000, () => console.log("ws server listening on localhost:5000")); Server runs on localhost:5000. Now serve index.html from any other origin and see it talk to the server without any problem.
- bostik 6y agoSurprisingly often websocket connections are made to a different domain from what is serving the site itself. I'm not sure about the root cause to the pattern, but sure as hell know that our company has been doing it at least since 2013. Browsers set the "Origin" header for ws:// calls, and the websocket servers are expected to check that. Without the check, it'd be possible to issue blind writes (CSRF) from random webpages to the ws:// endpoints. If you're using main site authentication with a separate websocket domain and auth'd requests, all garden variety security scanners will flag the separate websocket domain as a problem, and only the robust ones actually try to validate the server side configuration. Disclosure: I have triaged and responded to a few of such reports.
- sloshnmosh 6y agoI immediately thought about this after reading the Wikipedia page of Peter Theil and Palentir where he stated he wanted to use technology that was used to protect PayPal (that was purchased by eBay)
- zimaalsu 6y agoI thought it was no secret to anyone that all services track digital fingerprints ... and there are many ways to do this. to fight them i use antidetection browser such as https://gologinapp.com/ https://gologinapp.com/ or other. Are there any alternatives to this?
- hakcermani 6y agoGreat article! Finally I got it. Between this one and the original post. 'Why is this website port scanning me'. Can anyone shed some thoughts / reason why the scan is not performed on Linux machines? Maybe not RDP, but VNC servers that the scan performs on Windows m/cs ..
- zajio1am 6y agoThe real issue is not that eBay or some other specific website uses Javascript to port scan network. The real issue is that browsers allow such behavior by default.
- dnebdal 6y agoHere's how to block websites from port-scanning localhost through the browser: https://www.ctrl.blog/entry/block-localhost-port-scans.html https://www.ctrl.blog/entry/block-localhost-port-scans.html