<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>That really gives a lot to think about at how many other sites
are doing the same thing. But I close up ports that doesn't need
to be open in order to make my system safe. You'd be surprised at
how many ports are open that can leave a system open for attacks.
<br>
</p>
<div class="moz-cite-prefix">On 5/24/20 8:15 PM, Michael Butash via
PLUG-discuss wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CADWnDstHAPgtxn-Lc+wVHMvQGOzg4hdt+PUpne6D0gLcECn6UQ@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div><a
href="https://www.bleepingcomputer.com/news/security/ebay-port-scans-visitors-computers-for-remote-access-programs/"
moz-do-not-send="true">https://www.bleepingcomputer.com/news/security/ebay-port-scans-visitors-computers-for-remote-access-programs/</a></div>
<div><br>
</div>
<div>This was a bit disturbing to read today. Ebay injects a
few javascript connections back to your requesting system,
measures a basic socket connection, telling them if the port
is open or not, amounting to effectively a local host port
scan for specified ports, behind a firewall, from a web page
you visited. They are doing this looking for remote admin
applications in fact, rdp, vnc, teamviewer, many others. Hmm.<br>
</div>
<div><br>
</div>
<div>So any public website can query any port from visiting a
web page, and possibly interact with any sort of local or
other api on my system?<br>
</div>
<div><br>
</div>
<div>I wouldn't think Javascript would be allowed to chain off a
host like that, or at least have protections from certain
abuse. I suppose it's valid if linking to another site, but
JS/Browsers allowing local random port use like this, seems
ebay is probably not the only ones to abuse this in certain
ways. I know you can do some interesting things with
websockets, seems chaining via same methods to remote
interact would be trivial.<br>
</div>
<div><br>
</div>
<div>This is pretty devious actually, I'm both a bit scared for
ebay, not to mention all the other sites I "trust", let alone
the ones I don't. Everyone else that just allows pervasively
javascript is just hozed. Which is standard for everyone
since javascript existed.<br>
</div>
<div><br>
</div>
<div>I use noscript pervasively, and whitelist only valid
sites. Ebay is a valid site, didn't think I had to protect
myself, but how would you protect against this? Curious also
the take from web dev's on this, other than thanks for the
tip. :)</div>
<div><br>
</div>
<div>-mb</div>
<div><br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">---------------------------------------------------
PLUG-discuss mailing list - <a class="moz-txt-link-abbreviated" href="mailto:PLUG-discuss@lists.phxlinux.org">PLUG-discuss@lists.phxlinux.org</a>
To subscribe, unsubscribe, or to change your mail settings:
<a class="moz-txt-link-freetext" href="https://lists.phxlinux.org/mailman/listinfo/plug-discuss">https://lists.phxlinux.org/mailman/listinfo/plug-discuss</a></pre>
</blockquote>
<pre class="moz-signature" cols="72">--
Harold Hartley
17632 N. 5th Pl
Phoenix, Arizona 85022</pre>
</body>
</html>