TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

eBay is port scanning visitors to their website

478 点作者 joering2将近 5 年前

31 条评论

Maxious将近 5 年前
This might explain why some preinstalled HP laptop software (with open ports?) causes a BSOD when users visit ebay <a href="https:&#x2F;&#x2F;h30434.www3.hp.com&#x2F;t5&#x2F;Notebook-Operating-System-and-Recovery&#x2F;Blu-screen-error-after-login-to-ebay-costumer-page&#x2F;td-p&#x2F;6692602" rel="nofollow">https:&#x2F;&#x2F;h30434.www3.hp.com&#x2F;t5&#x2F;Notebook-Operating-System-and-...</a>
评论 #23440778 未加载
评论 #23438352 未加载
评论 #23439958 未加载
评论 #23441574 未加载
mehrdadn将近 5 年前
I asked this earlier and nobody had a response, so thought I&#x27;d ask it again: is there an extension to block this?<p>Edit: @Windows users: pip install pydivert and then try to write a script to block connections from Chrome to non-Chrome processes. you might need GetTcpTable2() or something. (Looking into this now. Check out <a href="http:&#x2F;&#x2F;stackoverflow.com&#x2F;a&#x2F;25431340" rel="nofollow">http:&#x2F;&#x2F;stackoverflow.com&#x2F;a&#x2F;25431340</a>)
评论 #23437630 未加载
评论 #23437581 未加载
评论 #23437830 未加载
评论 #23441538 未加载
评论 #23438578 未加载
评论 #23440571 未加载
评论 #23440729 未加载
评论 #23441831 未加载
评论 #23437586 未加载
mobilio将近 5 年前
It&#x27;s crystal clear why they do this.<p>Many companies or persons share their desktops for remote usage. Later they sell this service to eBay users. And they&#x27;re using it for different fraudulent activities - from making real sales (just for stars) to bidding to own items (for rising price).<p>For years eBay fight this.
评论 #23437864 未加载
评论 #23437796 未加载
评论 #23437639 未加载
评论 #23437608 未加载
评论 #23439332 未加载
评论 #23439754 未加载
gkoberger将近 5 年前
A similar article was on HN a few days ago:<p><a href="https:&#x2F;&#x2F;www.bleepingcomputer.com&#x2F;news&#x2F;security&#x2F;list-of-well-known-web-sites-that-port-scan-their-visitors&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.bleepingcomputer.com&#x2F;news&#x2F;security&#x2F;list-of-well-...</a><p>Here&#x27;s the discussion about it:<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=23361823" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=23361823</a>
cube00将近 5 年前
Previous discussion: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=23246170" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=23246170</a>
评论 #23437525 未加载
nerdbaggy将近 5 年前
The company that is actually providing this service is by Lexis Nexis <a href="https:&#x2F;&#x2F;risk.lexisnexis.com&#x2F;corporations-and-non-profits&#x2F;fraud-and-identity-management" rel="nofollow">https:&#x2F;&#x2F;risk.lexisnexis.com&#x2F;corporations-and-non-profits&#x2F;fra...</a>
dpenguin将近 5 年前
eBay has a big fraud headache. They have a bunch of algorithms (from the pre-ML-hype days) that take a variety of inputs to determine whether a given transaction is fraudulent or not. Presence of remote login service on the user’s computer may tip the scale heavily in this calculation. Fraud detection is a necessary evil for all financial transaction companies in order to keep costs low for everyone else.<p>If you’re worried about privacy, use CCPA’s right to information and ask them for a dump of everything they have on you. They are supposed to give you info that other SPs like Threatmetrix have on you as well if they really are transmitting it to 3rd parties.
评论 #23440389 未加载
评论 #23438277 未加载
评论 #23438215 未加载
评论 #23438317 未加载
oefrha将近 5 年前
I never understood why websockets aren’t subject to same origin policy and CORS (or similar policies). Any web expert here could explain this design (non-)decision?
评论 #23440390 未加载
评论 #23440365 未加载
z3t4将近 5 年前
This is what happens when there is a browser monopoly. Fixing security do not have priority. Maximizing revenue is the priority. The browser should stop outgoing connections that are not from the same origin. Then users have to opt in like with popup windows.
soraminazuki将近 5 年前
Has anyone confirmed whether they&#x27;re still continuing this practice? I&#x27;m curious, but at the same time feel highly uncomfortable visiting a website that has no problems exploiting a browser loophole.
评论 #23437860 未加载
maett将近 5 年前
Extremely well written sum-up, learned a lot about how to approach an investigation like this. Thank you.
eraserj将近 5 年前
Just wait until the database of ip and open ports is leaked and hackers start exploiting vulnerabilities of softwares listening to these ports to break into random people devices.
评论 #23437733 未加载
评论 #23437745 未加载
fractal618将近 5 年前
Perhaps they&#x27;ve asked threat metrix to handle a portion of their security and this was their solution?<p>At the end of the day, we all need to realize that we send out far more information than we receive when we surf the web.
Nightshaxx将近 5 年前
I saw him talk about how Threat Matrix is usually blocked.....but Threat Matrix has their clients get unique endpoint URLs to disguise it. I don&#x27;t really know how AdBlock works, but aside from the extra time it would take, why doesn&#x27;t adblockers look up the record of any URLs on the page and see if they are a CNAME for an A url that is on the block list?
评论 #23439398 未加载
zajio1am将近 5 年前
The real issue is not that eBay or some other specific website uses Javascript to port scan network. The real issue is that browsers allow such behavior by default.
missblit将近 5 年前
A couple Chrome devtools debugging tips:<p>1. Local Overrides feature allows you to persist and edit source files across page loads (unfortunately only source files currently, so you&#x27;re out of luck if the JS comes from an XHR or something)<p>2. F3 on the network panel will let you search for a string across all resources the page loaded. Can be useful for tracking down where stuff like user-agent checks are called (if not obfuscated).<p>Also calling the code obfuscated is pretty generous. It&#x27;s amazing how common things like shift ciphers, XOR tricks, etc. are when the browser&#x27;s REPL cuts through them like butter.
评论 #23440836 未加载
nsajko将近 5 年前
<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Computer_Fraud_and_Abuse_Act" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Computer_Fraud_and_Abuse_Act</a>
SamReidHughes将近 5 年前
Huh. I&#x27;ve been using eBay a lot this week, and it might have triggered a kernel bug. I had terrible internet performance that got resolved by rebooting my Ubuntu 18.04 laptop.
floatingatoll将近 5 年前
macOS users, I believe based on my testing that you can block your installed web browsers from localhost port scanning using LittleSnitch. This way you can continue to allow WebRTC and WebSockets to the rest of the Internet (where it&#x27;s useful), while denying web browsers access to localhost except for specific ports you allow.<p>However, I encourage you to be careful and <i>only</i> block web browsers to localhost using this method, because lots of macOS applications depend on localhost connections to talk to themselves, so if you block everything from talking to localhost you may break e.g. LittleSnitch, macOS itself, etc. NO WARRANTY, HAVE BACKUPS, standard stuff.<p>To set this up, for each &#x2F;Applications&#x2F;Browser.app, create a LittleSnitch &#x27;Deny Connections&#x27; To &#x27;IP Addresses&#x27; rule and enter &#x27;127.0.0.1, ::1&#x27; without quotes into the text field and click OK. Then right-click on the newly-created application rule and select &#x27;Increase Priority&#x27;, which will bold the rule text &#x27;Deny outgoing connections to 2 IP addresses&#x27;. Repeat this for each Browser.app you use.<p>If you&#x27;d like to specifically enable certain localhost ports to be accessible by your browser (such as 80&#x2F;443), you can create another rule using the above steps, but before saving the rule, change &#x27;Deny&#x27; to &#x27;Allow&#x27; and click the &#x27;\&#x2F;&#x27; dropdown caret button and enter the appropriate port and select TCP. I encountered some UI quirks doing this but once it&#x27;s created it works as it should.<p>Here&#x27;s a screenshot of the results of my testing for comparing against. I&#x27;m not really familiar with how LS works so I can&#x27;t offer much support, but I fresh-installed it and left all the defaults alone and it worked, so more advanced users shouldn&#x27;t have much trouble. <a href="https:&#x2F;&#x2F;i.imgur.com&#x2F;T0yqrdM.png" rel="nofollow">https:&#x2F;&#x2F;i.imgur.com&#x2F;T0yqrdM.png</a><p>Good luck!<p>(For those wondering if other software can do this, I tested various macOS application firewalls today and most of them either global-allow localhost connections or don&#x27;t offer outbound filtering at all. So far, the only one that can block web browsers <i>only</i> from connecting to localhost is LittleSnitch, with some quirks that I wrote a note to their support about. At least one let me create the rule and cheerfully said it was active and then it didn&#x27;t block anything.)
评论 #23441361 未加载
gear54rus将近 5 年前
What can you possibly know from such a scan?<p>Standard clearly states that pretty much nothing: <a href="https:&#x2F;&#x2F;www.w3.org&#x2F;TR&#x2F;websockets&#x2F;#concept-websocket-close-fail" rel="nofollow">https:&#x2F;&#x2F;www.w3.org&#x2F;TR&#x2F;websockets&#x2F;#concept-websocket-close-fa...</a><p>Sure they&#x27;re shady and that needs to be blocked, but security implications? Pretty much nil.
评论 #23438177 未加载
评论 #23438114 未加载
评论 #23438165 未加载
jokoon将近 5 年前
I remember while working at some company, I started using a local flask server.<p>For some reason, I remember one company router kept making http request on port 5000 or 8000, can&#x27;t remember which port, because it was literally showing on the terminal, with the http path, at random times.<p>I&#x27;m sure being a hacker must be pretty fun these days.
hakcermani将近 5 年前
Great article! Finally I got it. Between this one and the original post. &#x27;Why is this website port scanning me&#x27;. Can anyone shed some thoughts &#x2F; reason why the scan is not performed on Linux machines? Maybe not RDP, but VNC servers that the scan performs on Windows m&#x2F;cs ..
_trampeltier将近 5 年前
Could for ex. a website like ebay also access the intern Intranet in a company? Or my cloudstorage like SharePoint that is open in the same browser?
dnebdal将近 5 年前
Here&#x27;s how to block websites from port-scanning localhost through the browser: <a href="https:&#x2F;&#x2F;www.ctrl.blog&#x2F;entry&#x2F;block-localhost-port-scans.html" rel="nofollow">https:&#x2F;&#x2F;www.ctrl.blog&#x2F;entry&#x2F;block-localhost-port-scans.html</a>
zimaalsu将近 5 年前
I thought it was no secret to anyone that all services track digital fingerprints ... and there are many ways to do this. to fight them i use antidetection browser such as <a href="https:&#x2F;&#x2F;gologinapp.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;gologinapp.com&#x2F;</a> or other. Are there any alternatives to this?
uniformlyrandom将近 5 年前
Google&#x27;s internal sso (which I accidentally stumbled upon) collects other endpoint-specific parameters to compose the digital signature (like browser window size and monitor size).<p>This feels more effective and less intrusive. Not sure why ebay went this rather weird and creepy way instead.
评论 #23440496 未加载
olliej将近 5 年前
wasn&#x27;t this on the front page just a few days ago?
评论 #23439410 未加载
评论 #23437539 未加载
sloshnmosh将近 5 年前
I immediately thought about this after reading the Wikipedia page of Peter Theil and Palentir where he stated he wanted to use technology that was used to protect PayPal (that was purchased by eBay)
lazyjones将近 5 年前
I thought it would be obvious that eBay is doing this to identify bots (usually on servers) vs. real users (on client-only devices).
评论 #23439627 未加载
jurassic将近 5 年前
I&#x27;m just a layman, but I don&#x27;t see how ThreatMatrix could possibly be seen as within the spirit of GDPR. I hope regulators throw the book here.
igravious将近 5 年前
Humanity constructed something wonderful and new. (The internet.) And the corporate web has all but destroyed it.
评论 #23437593 未加载