<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hey,</p>
<p>Institutions do in fact scan local systems and public networks on
connection to as they say "fight bots" and "malicious/compromised
users". Here is an example of someone going through and pulling
apart ebay's use of it:
<a class="moz-txt-link-freetext" href="https://blog.nem.ec/2020/05/24/ebay-port-scanning/">https://blog.nem.ec/2020/05/24/ebay-port-scanning/</a> <br>
</p>
<p>They also use information gained from this for fraud factors.
Example, if you are using a VPN or TOR some of your system
information can still leak if you have misconfigured settings. See
here for an example leak test: <a class="moz-txt-link-freetext" href="https://ipleak.net/">https://ipleak.net/</a> . You'll see a
lot of the techniques here also used on big institutions.</p>
<p>Coming from the corporations.....it is really surprising how much
fraud can be identified. <u>Spammers aren't smart</u>. Even when
they use Tor or VPN they leak information. The financial
institution I work with wants to keep TOR and VPNs allowed for
connections so they employ stuff like this to fingerprint traffic.
When someone is switching IPs trying to credential stuff or
bruteforce our users, it is one of the only ways to mass-identify
and block.</p>
<p>Many institutions are on the hook for fraud. Many also have a
fiduciary and regulatory duty to "Know Your Customer" (KYC). Some
would rather fingerprint than block all risky traffic that they
couldnt KYC.<br>
</p>
<p>Thanks,</p>
<p>-</p>
<p>Anthony<br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 5/20/22 9:20 PM, Michael Butash via
PLUG-discuss wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CADWnDsuU=jFqFj2hK8_51UgkW39Lk1Fc2PtQNnzv-wmEVwvZ0w@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">
<div>This is something I posted here a while back, how sites
like banks and other financials were making scripted local
queries to check for open "services" or ports as referrals to
localhost and ports known to be malicious ala some worm or
botnet if they should trust you or not. Quick way for them to
determine what stupid customers of theirs got got already, and
lower your credit score while at it. While ok, I get it,
trust no one, but that's a bit creepy that they're forcing my
browser to open sockets to local ports to essentially bypass
my firewall, port scan my host, while connecting to their
site, and figure no one mostly will notice.</div>
<div><br>
</div>
<div>Far as I know ublock and noscript inherently block most of
that (it's usually some affiliate credit check firm the bank
uses for plausible deniability and blame pointing), but I do
this by default for the past ~20 years to notice much.</div>
<div><br>
</div>
<div>Such is the world we live in. Shields up!<br>
</div>
<div><br>
</div>
<div>-mb</div>
<div><br>
</div>
<div><br>
</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Fri, May 20, 2022 at 8:27
PM der.hans via PLUG-discuss <<a
href="mailto:plug-discuss@lists.phxlinux.org"
moz-do-not-send="true" class="moz-txt-link-freetext">plug-discuss@lists.phxlinux.org</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">moin
moin,<br>
<br>
once in a while I run into a site trying to make JavaScript or
XHR<br>
connections to localhost.<br>
<br>
What are they doing?<br>
<br>
Are they setting up backdoor tunnels on localhost?<br>
<br>
Are they trying to run a daemon out of the browser?<br>
<br>
Are they trying to escape the sandbox and exfiltrate data?<br>
<br>
ciao,<br>
<br>
der.hans<br>
-- <br>
# <a href="https://www.LuftHans.com" rel="noreferrer"
target="_blank" moz-do-not-send="true">https://www.LuftHans.com</a>
<a href="https://www.PhxLinux.org" rel="noreferrer"
target="_blank" moz-do-not-send="true">https://www.PhxLinux.org</a><br>
# Eternal vigilance is the price of liberty. -- Thomas
Jefferson<br>
---------------------------------------------------<br>
PLUG-discuss mailing list - <a
href="mailto:PLUG-discuss@lists.phxlinux.org"
target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">PLUG-discuss@lists.phxlinux.org</a><br>
To subscribe, unsubscribe, or to change your mail settings:<br>
<a
href="https://lists.phxlinux.org/mailman/listinfo/plug-discuss"
rel="noreferrer" target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">https://lists.phxlinux.org/mailman/listinfo/plug-discuss</a></blockquote>
</div>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
<pre class="moz-quote-pre" wrap="">---------------------------------------------------
PLUG-discuss mailing list - <a class="moz-txt-link-abbreviated" href="mailto:PLUG-discuss@lists.phxlinux.org">PLUG-discuss@lists.phxlinux.org</a>
To subscribe, unsubscribe, or to change your mail settings:
<a class="moz-txt-link-freetext" href="https://lists.phxlinux.org/mailman/listinfo/plug-discuss">https://lists.phxlinux.org/mailman/listinfo/plug-discuss</a></pre>
</blockquote>
</body>
</html>