Beitrag von: coin am 29.11.2020, 10:17:03
Essentiell soll der nachstehende eintrag in "uBlock Origin" unter "My filters" sein:
||localhost^$important,third-party
||127.*^$important,third-party
||[::1]^$important,third-party
https://www.golem.de/news/tutorial-portscans-durch-webseiten-unterbinden-2010-150936.html
Beitrag von: DJ-Bino am 29.11.2020, 15:52:09
ich würde es nicht unbedingt so machen wie in golem beschrieben.
"Das uBlock Team hat eine Blockliste für das Blockieren des Zugriffs von Drittseiten auf lokale URLs und Adressen im LAN sowie für gängige Router zusammengestellt:"
Quelle: Beitrag vom 25.11.2020
https://www.privacy-handbuch.de/changelog.htm
Erklärungen: Hinweis am Ende des Textes lesen.
https://www.privacy-handbuch.de/handbuch_21g.htm#25_11_20
Beitrag von: coin am 29.11.2020, 17:23:06
...
Interessanter hinweis!
Ich hatte vor mich in den nächsten tagen enmal mit dem Golem tip zu beschäftigen, dann kann ich gleichzeitig die filterliste unter die lupe nehmen.
Die nichtrelevanten dinge kann man ja auskommentieren.
Beitrag von: coin am 30.11.2020, 16:03:01
Da muss es eine intelligentere lösung geben.
Im moment muss ich erst einmal das etwas lädierte funkgerät eines bekannten wieder in gang bringen.
Aber ich bleibe an der sache dran.
Beitrag von: coin am 01.12.2020, 11:23:31
Bis dato stellt sich mir die situation wie folgt dar:
Aufgefallen ist der portscan um ersten mal bei "EBay".
Vermutlich wird das EBay script verwendet um betrug zu detektieren.
Denkbar auch dass es verwendet wird um die entropie beim fingerprinting zu erhöhen.
EBay äusserte sich zum sachverhalt wie folgt:
"Our customers’ privacy and data remains a top priority.
We are committed to creating an experience on our sites
and services that is safe, secure, and trustworthy."
Was sollen sie auch anderes sagen?
Verhindern lässt sich der portscan weder über iptables oder über router einstellungen.
Dan Nemec (Entwickler) äusserte sich zur sache: "I couldn’t replicate the behavior in Linux even after spoofing a Windows User Agent and disabling all of my extensions."
Um nun aus vorsicht bei jedem meiner browser "uBlock Origin" als add-on einzusetzen, fehlt mir persönlich die eindeutigkeit der gefahr.
- - -
2020-12-02
https://nullsweep.com/why-is-this-website-port-scanning-me/
Auch hier wieder der hinweis auf eine geringe oder nichtvorhandene gefärdung von Linux rechnern.
Jedenfalls solange kein Windows in einer VM läuft:
"I was given the example of ebay as a site that includes port scanning,
but when I initially navigated there I didn't see any suspicious behavior.
I thought they might use some heuristics to determine who to scan, so tried
a few different browsers and spoofed settings, without any luck."
"I thought it might be because I run Linux, so I created a new Windows VM
and sure enough, I saw the port scan occurring in the browser tools from
the ebay home page:"
Das ganze ist -grosso modo- ein alter hut und seit jahren bekannt.
Beitrag von: coin am 01.12.2020, 16:34:37
Off-Topic:
Yes, you do that. And maybe we will even see capitalized nouns in your next article.
At best, this would be a small step for you and a big step for the community. ;)
Off-Topic:I'm in doubt that you can judge what is a small step for me.
Pls. point out where is written that only native germans with a profound knowledge of your language may be a part of this forum.
On the other hand, it will be a small step for you to ignore my humble contributions to LMU ;)
Pls. keep the change...
Pls. point out where is written that only native germans with a profound knowledge of your language may be a part of this forum.
On the other hand, it will be a small step for you to ignore my humble contributions to LMU ;)
Pls. keep the change...
Beitrag von: thebookkeeper am 02.12.2020, 02:47:21
...
https://www.golem.de/news/tutorial-portscans-durch-webseiten-unterbinden-2010-150936.html
Zitat
... Webseiten können per Javascript Verbindungen in das lokale Netzwerk von Webseitenbesuchern aufbauen. Mit der Technik scannen bekannte Webseiten wie Ebay.de oder Ebay.com den lokalen Rechner auf offene Ports ...Da ist eh' nicht viel offen:
Code: [Auswählen]
thebookkeeper@Dell-DV051:~$ nmap -T4 -A -v localhost
Starting Nmap 7.60 ( https://nmap.org ) at 2020-12-02 21:31 CET
NSE: Loaded 146 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 21:31
Completed NSE at 21:31, 0.00s elapsed
Initiating NSE at 21:31
Completed NSE at 21:31, 0.00s elapsed
Initiating Ping Scan at 21:31
Scanning localhost (127.0.0.1) [2 ports]
Completed Ping Scan at 21:31, 0.00s elapsed (1 total hosts)
Initiating Connect Scan at 21:31
Scanning localhost (127.0.0.1) [1000 ports]
Discovered open port 445/tcp on 127.0.0.1
Discovered open port 139/tcp on 127.0.0.1
Discovered open port 5900/tcp on 127.0.0.1
Discovered open port 22/tcp on 127.0.0.1
Discovered open port 9050/tcp on 127.0.0.1
Discovered open port 631/tcp on 127.0.0.1
Completed Connect Scan at 21:31, 0.09s elapsed (1000 total ports)
Initiating Service scan at 21:31
Scanning 6 services on localhost (127.0.0.1)
Completed Service scan at 21:32, 11.03s elapsed (6 services on 1 host)
NSE: Script scanning 127.0.0.1.
Initiating NSE at 21:32
Completed NSE at 21:32, 10.08s elapsed
Initiating NSE at 21:32
Completed NSE at 21:32, 0.00s elapsed
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00072s latency).
Not shown: 994 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 4.10.13 (workgroup: WORKGROUP)
631/tcp open ipp CUPS 2.2
| http-methods:
| Supported Methods: GET HEAD OPTIONS POST PUT
|_ Potentially risky methods: PUT
| http-robots.txt: 1 disallowed entry
|_/
|_http-server-header: CUPS/2.2 IPP/2.1
|_http-title: Home - CUPS 2.2.7
5900/tcp open vnc VNC (protocol 3.8)
| vnc-info:
| Protocol version: 3.8
| Security types:
|_ VNC Authentication (2)
9050/tcp open tor-socks Tor SOCKS proxy
| socks-auth-info:
| No authentication
|_ Username and password
| socks-open-proxy:
| status: open
| versions:
| socks4
|_ socks5
Service Info: Host: DELL-DV051; OS: Linux; CPE: cpe:/o:linux:linux_kernel
... Wer zu neugierig ist, wird von meiner Firewall geblockt:
Code: [Auswählen]
thebookkeeper@Dell-DV051:~$ cat /var/log/ufw.log
Nov 29 02:04:34 Dell-DV051 kernel: [21642.743874] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=148.251.64.134 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=51 ID=0 DF PROTO=TCP SPT=443 DPT=46084 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:04:34 Dell-DV051 kernel: [21642.753885] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=148.251.64.134 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=51 ID=0 DF PROTO=TCP SPT=443 DPT=46084 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:04:44 Dell-DV051 kernel: [21652.903948] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=91.215.100.40 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=49 ID=46044 DF PROTO=TCP SPT=443 DPT=42344 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:04:44 Dell-DV051 kernel: [21652.904673] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=91.215.100.40 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=49 ID=46045 DF PROTO=TCP SPT=443 DPT=42344 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:04:55 Dell-DV051 kernel: [21663.216189] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=128.65.210.184 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=53 ID=0 DF PROTO=TCP SPT=443 DPT=58776 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:04:55 Dell-DV051 kernel: [21663.416496] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=2.18.215.9 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=443 DPT=50844 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:04:55 Dell-DV051 kernel: [21663.475362] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=2.18.215.9 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=443 DPT=50844 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:04:55 Dell-DV051 kernel: [21663.495512] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=2.18.215.9 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=443 DPT=50844 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:04:55 Dell-DV051 kernel: [21663.935368] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=2.18.232.23 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=53 ID=0 DF PROTO=TCP SPT=443 DPT=50522 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:05:29 Dell-DV051 kernel: [21697.006200] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=148.251.64.134 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=51 ID=0 DF PROTO=TCP SPT=443 DPT=46092 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:05:29 Dell-DV051 kernel: [21697.046204] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=148.251.64.134 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=51 ID=0 DF PROTO=TCP SPT=443 DPT=46092 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:10:24 Dell-DV051 kernel: [21992.536684] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=2.18.215.9 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=443 DPT=50962 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:10:24 Dell-DV051 kernel: [21992.576715] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=2.18.215.9 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=443 DPT=50962 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:10:24 Dell-DV051 kernel: [21992.616681] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=2.18.215.9 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=54 ID=0 DF PROTO=TCP SPT=443 DPT=50962 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:10:31 Dell-DV051 kernel: [21999.177546] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=128.65.210.184 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=53 ID=0 DF PROTO=TCP SPT=443 DPT=58888 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:10:33 Dell-DV051 kernel: [22001.306694] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=161.156.66.178 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=47 ID=0 DF PROTO=TCP SPT=443 DPT=46278 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:10:33 Dell-DV051 kernel: [22001.346870] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=161.156.66.178 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=47 ID=0 DF PROTO=TCP SPT=443 DPT=46278 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:10:54 Dell-DV051 kernel: [22022.737564] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=148.251.64.134 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=51 ID=0 DF PROTO=TCP SPT=443 DPT=46200 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:10:54 Dell-DV051 kernel: [22022.777698] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=148.251.64.134 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=51 ID=0 DF PROTO=TCP SPT=443 DPT=46200 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:10:55 Dell-DV051 kernel: [22023.617231] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=148.251.64.134 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=51 ID=0 DF PROTO=TCP SPT=443 DPT=46210 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:10:55 Dell-DV051 kernel: [22023.657328] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=148.251.64.134 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=51 ID=0 DF PROTO=TCP SPT=443 DPT=46210 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:10:55 Dell-DV051 kernel: [22023.697324] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=148.251.64.134 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=51 ID=0 DF PROTO=TCP SPT=443 DPT=46210 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:24:59 Dell-DV051 kernel: [22867.664841] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=161.156.66.184 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=47 ID=0 DF PROTO=TCP SPT=443 DPT=46552 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:25:33 Dell-DV051 kernel: [22901.271226] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=54.171.42.33 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=234 ID=7548 DF PROTO=TCP SPT=443 DPT=60236 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:31:53 Dell-DV051 kernel: [23281.077130] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=63.32.152.233 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=231 ID=0 DF PROTO=TCP SPT=443 DPT=33870 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:31:53 Dell-DV051 kernel: [23281.277267] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=54.171.42.33 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=235 ID=1479 DF PROTO=TCP SPT=443 DPT=60334 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:31:53 Dell-DV051 kernel: [23281.317000] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=54.171.42.33 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=235 ID=1485 DF PROTO=TCP SPT=443 DPT=60334 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:31:53 Dell-DV051 kernel: [23281.516875] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=63.32.152.233 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=231 ID=0 DF PROTO=TCP SPT=443 DPT=33870 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:31:54 Dell-DV051 kernel: [23282.267126] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=194.40.217.50 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=49 ID=16006 DF PROTO=TCP SPT=443 DPT=53744 WINDOW=0 RES=0x00 RST URGP=0
Nov 29 02:31:54 Dell-DV051 kernel: [23282.307117] [UFW BLOCK] IN=ppp0 OUT= MAC= SRC=194.40.217.50 DST=10.128.147.239 LEN=40 TOS=0x00 PREC=0x00 TTL=49 ID=16016 DF PROTO=TCP SPT=443 DPT=53744 WINDOW=0 RES=0x00 RST URGP=0
...Mit Fail2ban könnte man Portscan ausbremsen, aber wozu?
https://www.kneup-media.com/portscanning-verhindern-fail2ban-ufw/ (https://www.kneup-media.com/portscanning-verhindern-fail2ban-ufw/)