Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

Opera blocks the user from making http requests over very low ports (below 1024). Why does Opera not allow the user to override this setting?

What is wrong with running a web server on, say, port 70 and why does Opera feel the need to prevent the user from doing this?

share|improve this question

2 Answers

up vote 2 down vote accepted

Your assumption that TCP ports below 1024 are block is wrong (you couldn't browse the web with port 80 and 443 blocked, for example). However, it's true that browsers block some ports by blacklisting them (i.e. you cannot open a socket to a certain port from this blacklist). They do this to prevent cross protocol attacks.

Cross protocol attacks

Cross-protocol attacks occur when a user navigates to a malicious HTML page that contains code (e.g. HTML/Javascript) trying to connect to a victim server. The code opening the connection might be:

  • <img src=victim:25> and other tags
  • AJAX communication (XMLHttpRequest)
  • <form> submission

This victim server does not speak HTTP at all, it might be e.g. a SMTP server on port 25. So now HTTP request is sent to a non-HTTP server. It is possible to modify HTTP request so that:

  • most of the HTTP request is ignored by the target server (as it's rubbish)
  • some commands (e.g. SMTP commands to send a mail) are processed

It's also possible to e.g. crash a server by sending invalid commands to it (Denial of Service).

To prevent these attacks non-HTTP servers should not be sent HTTP traffic. As it's not reasonable for a browser to check if a server speaks HTTP before sending the request, an assumption is taken that common ports where non-HTTP servers are usually set up at should be blacklisted. And that is what you're experiencing. You can find the exact port blacklist (though it might not be up to date) for many browsers in Browser security handbook.

share|improve this answer
From reading your explanation, it seems the blacklist is designed to protect servers listening on those ports, not designed to protect the user of the browser. Is that correct? – steampowered Feb 14 '12 at 18:12
It also tries to protect browser users. Sometimes the response from non-HTTP server,when e.g. interpreted as JS code might reveal some important details for an attacker (though it's much harder to prepare such attack due to Same Origin Policy restrictions). It's much easier to send the request than to read the response. – Krzysztof Kotowicz Feb 15 '12 at 5:49
up vote 2 down vote

I am using opera 11.52 right now. For quick local web servers, I used MoWeS Portable. I set apache to listen on port 72, so in opera I typed

http://localhost:72

and I am not having any such error.

However, when I changed the apache configuration to listen on port 70, I can replicate your error.

It's possible that because HTTPS is typically used for HTTP over SSL (HTTPS) that trying to run a url as a regular http://... gives an error. Though, in my testing I can run a non HTTPS server connection on 443.

Now, port 70 in particular is for the (virtually) deprecated gopher protocol which was more common before the rise of WWW http://en.wikipedia.org/wiki/Gopher_(protocol). So maybe they now block port 70 in particular.

As for your 443 error posted on the opera boards, perhaps as the first responder noted you were trying to connect to a port expected SSL and your server is not setup to automagically handle that for you. Did you get the same unsafe port error?

In your case it could be a combination of things, perhaps you can provide some more information to clarify.

share|improve this answer
I was also experiencing the block on port 70. I did not check other ports. – steampowered Feb 14 '12 at 18:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.