7 ms·
Using non-standard ports can actually be quite a severe security risk. Browsers block many ports, if you move your internal service to an unblocked port, you e
by zeepzeep 6y ago
Using non-standard ports can actually be quite a severe security risk.
Browsers block many ports, if you move your internal service to an unblocked port, you expose it to every browser in the network! (e.g. a mail server or IRC, something that can be talked to over http.)
- tgflynn 6y agoDo you have a reference for "Browsers block many ports" ? I thought there are even ssh clients that run in javascript in the browser. That wouldn't work if browsers were blocking access to port 22 for outgoing packets/connections.
- zeepzeep 6y agoGo to https://google.com:22 https://google.com:22 "This address uses a network port which is normally used for purposes other than Web browsing. Firefox has canceled the request for your protection."
- tgflynn 6y agoHmm. There's some more information here: https://www-archive.mozilla.org/projects/netlib/portbanning https://www-archive.mozilla.org/projects/netlib/portbanning. I'm up-voting your original comment because it does seem like a potentially valid concern, at least worthy of discussion, and shouldn't be down-voted in my opinion.
- pwinnski 6y agoSo moving my SSHD port opens me up to the wide array of SSHD exploits that run inside of Firefox? I'm not sure that web browsers are a popular vector for network exploits. Counting on anything client-side is not a wise approach to network security.
- tgflynn 6y agoAny piece of javascript code on any website you visit is going to be running inside of Firefox on your local network. I don't know how widespread these kinds of attacks are but they are reasonably well known which is why these port blacklists were implemented in the first place: https://www-archive.mozilla.org/projects/netlib/portbanning https://www-archive.mozilla.org/projects/netlib/portbanning.
- liability 6y agoUh, that doesn't make much sense. If you point a browser at an IRCd it will simply not work. Where's the security issue?
- zeepzeep 6y agohttps://en.wikipedia.org/wiki/Inter-protocol_exploitation#Example https://en.wikipedia.org/wiki/Inter-protocol_exploitation#Ex... You could join and spam an IRC server via javascript in the past. Now if you try it you get something like NS_ERROR_PORT_ACCESS_NOT_ALLOWED. If you move to a non-standard port javascript can talk to your internal IRC again.
- liability 6y agoIf your IRCd allows an unauthenticated connection to start spamming like that, changing the port so a browser can't do it is just wallpapering over the real problem. Anybody that cared to could just use any other software to spam your IRCd.
- zeepzeep 6y agoYes, a public & open IRC would be another problem... but that's not what I'm saying. I'm talking about an internal server. > Anybody that cared to could just use any other software to spam your IRCd. No they couldn't use other software. They couldn't access the server, cuz they are not inside of the network. Their javascript is inside the network tho, that's why browsers implement this port blacklist. Moving an internal app to a non-standard port might expose it to malicious javascript, that's all I'm saying.
- liability 6y agoThe issue remains that your ircd is still wide open, waiting for somebody more creative to find another way of opening connections inside your LAN on arbitrary ports. Counting on browsers to keep your network secure is foolish.