In the filter used in uBlock Origin , rules have been added to block typical network port scanning scripts on the user's local system. Recall that in May that local port scanning occurs when opening the website eBay.com. It turned out that this practice is not limited to eBay, and many (Citibank, TD Bank, Sky, GumTree, WePay, etc.) perform local system port scanning when their pages are opened, using code to detect attempts from compromised computers provided by ThreatMetrix.
In the case of eBay, 14 network ports associated with remote access servers such as VNC, TeamViewer, Anyplace Control, Aeroadmin, Ammy Admin, and RDP were checked. Presumably, this check is performed for traces of malware infection in order to prevent fraudulent purchases using botnets. Scanning can also be used to gather data for indirect .
The scanning technique is based on attempting to establish connections to various network ports of the host 127.0.0.1 (localhost) through . The presence of an open network port is indirectly determined based on the difference in error handling for connections to active and unused network ports. WebSocket allows sending only HTTP requests, but such a request for an inactive network port results in an error immediately, whereas for an active port, it only results in an error after some time spent attempting to establish a connection. Additionally, for an inactive port, WebSocket returns a connection error code (ERR_CONNECTION_REFUSED), while for an active one, it provides a connection negotiation error code.
Besides port scanning, WebSockets can also be used for attacks on web developers running WebSocket handlers for React applications on their local systems. An external site can scan network ports, detect the presence of such a handler and connect to it. If the developer makes a mistake, the attacker can access debugging data, which may include snippets of confidential information.
Source: opennet.ru
