Hacker News Reader

Comment by badRNG | Hacker News Reader

This raises the question: Is port scanning without consent a violation of the CFAA? Either it is legal, and researchers should face no repercussions for doing so, or it isn't and eBay is non-compliant with CFAA. I recall hearing about someone either being arrested or convicted due to port scanning a courthouse, but it was many years ago and I can't find the case with a cursory Google search.

I have to wonder what value eBay would get from port scanning its customers. Is it part of an attempt to detect bots/attackers? Is malware running on their server trying to determine if the client is likely vulnerable to some propagation method?

View on HN

When did networking support we often had old code + lower quality equipment that could / would crash if you used off the shelf security software that would go out and scan and then try all sorts of things and then generate a report.

I'd say 90% of the time the powers that be at the company had no idea someone was running that software, or that it was still running at their company, and then someone moved a firewall and the system was exposed to more than intended. Then they'd turn it of ... and find another similar tool running somewhere else.

It could be a simple as a test or security system run amok.

> I'd say 90% of the time the powers that be at the company had no idea someone was running that software, or that it was still running at their company, and then someone moved a firewall and the system was exposed to more than intended. Then they'd turn it of ... and find another similar tool running somewhere else.

This demonstrates the absurdity of the CFAA more than anything else. Sorry for sounding like a broken record but the CFAA is not salvageable and MUST be repealed.

This guy got arrested at least:

https://www.securityfocus.com/news/126

Article also states civil claims were dismissed - and criminal charges are unlikely to hold.

I hope they weren't debilitated by the legal fees incurred.

nmap's "Legal Issues" section states that the guy went on to start a successful digital forensics company, after spending years crushed under 6-figure legal fees.

https://nmap.org/book/legal-issues.html

Edit: Link to the company http://www.forensicstrategy.com/ He also has a data recovery company now http://www.myharddrivedied.com/

It's probably part of their fraud detection and mitigation strategy. Combined with other info about your transactions it could help raise a flag about changes.

As for the CFAA that's seemingly down to how aggressive the prosecutor is feeling about your case. I don't think it should be there's no real access happening and unless it's extremely aggressive and degrades network connectivity it's hard to argue there's any real damage done.

They're almost certainly doing it as part of a heuristic to detect bots. Hence the VNC / RDP ports. I would assume it's quite common for bots to have those ports open so they can be monitored

> Either it is legal, and researchers should face no repercussions for doing so, or it isn't and eBay is non-compliant with CFAA.

Criminal law is usually not this simple, as most criminal laws will take into account the mental state of the person performing the action.

Almost certainly not. Commercial unauthorized port scans are utterly routine. There are well-known companies premised on it.

You can get to the same answer axiomatically from the text and case history of CFAA (a port scan literally can't grant you the access a CFAA claim needs to prove you intended), but that's obviously treacherous for non-experts to do; instead, the empirical demonstration should be conclusive here.

I don't know why this scan is occurring, but fingerprinting is the most obvious guess, and intrusive fingerprinting performed by real companies is usually about ATO prevention, which means they're not going to tell you any more about it (ATO defense is an arms race).

> I have to wonder what value eBay would get from port scanning its customers.

From the article:

> Looking at the list of ports they are scanning, they are looking for VNC services being run on the host, which is the same thing that was reported for bank sites.

> VNC is sometimes run as part of bot nets or viruses as a way to remotely log into a users computer. There are several malware services that leverage VNC for these purposes.

Bypassing a firewall to run a port scan is almost certainly illegal.

That’s what these sites are doing.

I agree with the sentiment, but by visiting the site and running the code, I believe you bypassed the firewall on your own.

Why don't you run this executable. No, this ransomware message has nothing to do with me, it's all you. Why do you do this to yourself?

Was it this? https://news.ycombinator.com/item?id=21023023

That wasn't port scanning. They actually physically went inside the building.

No, I think it was probably close to a decade ago, but I likely am misremembering some of the details. Could've been a police department, but I'm not sure.

That one you linked is a messed up case. There is a phenomenal podcast that interviews those guys and walks through their engagement. https://darknetdiaries.com/episode/59/

My guess is bot detection + user fingerprinting.

Not illegal. Sites like shodan.io would have an issue if it was.

That's a fallacious argument. The fact that someone is doing something doesn't mean it's automatically legal.

IANAL, but more likely it depends on intent and context. So shodan.io is okay because it’s not explicitly malicious, and they have clear paths to contact them if you suspect abuse. Whereas, if you’re suspected of hacking a website, the fact that you port scanned it a week prior to password spraying it might serve as evidence against you. That is, it seems unlikely anyone would be prosecuted for port scanning alone, but it could be an act that demonstrates intent of a later action.

One time, I port scanned my public IP (of my ISP) from an EC2 box, and I got an email from EC2 saying they received an abuse complaint from the ISP for port scanning activity.

What's Shodan.io's legitimate use? Sounds like the "torrents can be used for legitimate content" type argument where in reality you a rounding error the use is not lawful??

If I were a serious baddie, I'd be afraid of using Shodan. Who knows who has what logging on that, and what honeypots may have been seeded into it for just such an occasion? It's not that hard to get that information yourself, from sources you control yourself.

Legitimate usage from researchers and people reading about infrastructure they have the right to do security testing on may be a larger percentage than you think.

I used to use torrents a lot and always for legitimate data transfers.

Yes, I've used it to download Linux distros, but the point still stands.

Not really, it totally contradicts the made-up point.

Can you explain.

What percentage of torrent traffic do you suppose - or better have stats for - is not copyright infringing? I'd think it's about 0%.

Would certainly be interested if you can prove that's wrong.

There are plenty of legitimate uses of port scanning, and specifically, a port scanning database like Shodan. For example:

- Monitoring your own network or that of your clients for exposed ports

- Researching Internet topology, or performing aggregate queries like “how many nginx servers are connected to the Internet”

Can you use it maliciously? Yes. But, most of the time, if you have a target it would make more sense to do the port scan yourself. And if you’re just dragnet searching for vulnerabilities, most you find will probably already have been exploited. Sites like shodan are good for the overall health of the web because they force website owners to maintain security posture. If you know that foregoing a wordpress upgrade means you’re one script kiddy with a shodan account away from getting hacked, you’re going to keep your site up to date. This saves you from script kiddies, but also from the more sophisticated hackers who would run a port scan themselves anyway.

>There are plenty of legitimate uses of port scanning, and specifically, a port scanning database like Shodan. //

Any legitimate security service is going to be doing there own scans, surely.

Statistics, yes, but I can't see those stats being especially good. You could probably get equally good nGinx data from netcraft, who IIUC get the data from http responses banners on :80 :443.

I'm not sure I buy the "security posture" line, isn't it circular. Tools to help crack your site are good because it means to have to have counter-measures to combat tools for cracking your site?

Only legitimate use of port scanning for me has been testing access to my own/clients computers, I feel. That's not too say I've not used it for illegitimate things ...

Shodan is used by most of the Fortune 100 companies for a variety of use cases. Here are the most common ones:

1. External network monitoring: know what you have connected to the Internet and get notified if anything changes unexpectedly. This has actually gotten significantly more challenging with services deployed to the cloud where your IT department might not even know which IPs to keep track of.

2. 3rd-party risk assessment: understand the security exposure of your partners, vendors, supply chain or other 3rd-parties. For example, lets say you're an insurance company that wants to provide cyber insurance. Shodan data can help you understand what sort of risk you'd be taking on. The data has also been used in M&A as part of due diligence to get a metric on the security of the IT department of the company they're thinking of acquiring.

3. Market intelligence: basically Netcraft on steroids. Shodan doesn't just have web information but also for many other protocols. This information is used by hedge funds and vendors to understand which products are purchased and deployed to the Internet. The data is skewed due to the nature of public IPs but there are still things you can do.

4. Policy impact: get a measure for how policies at the country-level are impacting Internet connectivity. For example, the OECD used Shodan to get a measure of Internet-connectivity per capita.

5. Fraud detection: is your customer trying to make a purchase from a machine that's been compromised? Or running a a VPN/ proxy? Shodan is used in transactional fraud detection to flag suspicious payments.

The more pointed argument would be there is no federal law prohibiting port scans.

Doesn't the Curl/For-loop Abuse Act (CFAA) cover it?

IANAL but this type of websocket port scan seems inherently different from what Shodan does.

Shodan is outside your network's firewall, therefore only able to access services you've exposed to the wider web.

If I understand the article, the websocket scan eBay is doing is trying to connect to local listeners on your laptop, behind your network's firewall and possibly even behind your laptop's firewall.

This is such an obvious consequence of web sockets that I wonder how anyone could have entertained the idea long enough to sober up and write the code. This is worse than letting a web page script have access to the clipboard, record mouse movements, and similar information leaks, because instead of just stealing information, now a web page can actively compromise any host on your network.

Yep. Just waiting for this "feature" to be added to metasploit.

I agree this is quite disturbing.

It does not, however, sound like an attacker can establish arbitrary TCP connections (at least using the technique from the article). Instead, the attacker can determine if something is listening on a port because it will take a different amount of time to negotiate/drop a connection to a port when there is a listener than when there is not a listener.

In other words, this sounds like a variant of a timing attack. As such, presumably, this particular avenue of attack can be mitigated by the browser vendor inserting a delay s.t. no information can be gleaned from how long it takes to negotiate/drop a websocket connection.

EDIT: I also wonder if it would be possible to do a similar port scan using the timing of XHR requests to localhost (e.g. http://localhost:[port]).

> It does not, however, sound like an attacker can establish arbitrary TCP connections

Maybe not, but what if the ports you have open actually are HTTP servers for development purposes? In that case wouldn't a website be able to crawl your unreleased work, and/or mess with what you're doing, with requests seemingly "out of nowhere"?

Reply on news.ycombinator.com