We’re rewarding the question askers & reputations are being recalculated! Read more.
2 deleted 6 characters in body
source | link

Are there any security risks associated with client-side port scanning? Or, more specifically, a "trusted" site (e.g., banking website) loading javascript trying to connect to various localhost ports?

This looks suspicious to me, but seems to be an emerging (or standard?) practice, as referenced in earlier questions here:

Strange Payment Gateway

Port scanning legal or not?

Also, some redditorsRedditors noticed Facebook and banking sites doing this as well:

https://www.reddit.com/r/AskNetsec/comments/4j0nas/why_is_facebook_checking_my_open_ports/

https://www.reddit.com/r/AskNetsec/comments/6825ki/why_is_my_internet_banking_is_scanning_for_vncrdp/

And even cybersecurity researcher Paul Moore sought to sue over this as well:

https://www.cbronline.com/news/halifax-port-scans

https://www.theregister.co.uk/2018/08/07/halifax_bank_ports_scans/

So, what's really going on? Why are they doing this? Can there be security or privacy risks involved? (Perhaps, is this even legal as well?)

Edit: thisThis answer suggests they may be doing it for some kind of threat detection or anti-fraud process perhaps, but all of this still seems somewhat fishy to me, not to mention possibly even from a legal standpoint as well! .

Are there any security risks associated with client-side port scanning? Or, more specifically, a "trusted" site (e.g., banking website) loading javascript trying to connect to various localhost ports?

This looks suspicious to me, but seems to be an emerging (or standard?) practice, as referenced in earlier questions here:

Strange Payment Gateway

Port scanning legal or not?

Also, some redditors noticed Facebook and banking sites doing this as well:

https://www.reddit.com/r/AskNetsec/comments/4j0nas/why_is_facebook_checking_my_open_ports/

https://www.reddit.com/r/AskNetsec/comments/6825ki/why_is_my_internet_banking_is_scanning_for_vncrdp/

And even cybersecurity researcher Paul Moore sought to sue over this as well:

https://www.cbronline.com/news/halifax-port-scans

https://www.theregister.co.uk/2018/08/07/halifax_bank_ports_scans/

So, what's really going on? Why are they doing this? Can there be security or privacy risks involved? (Perhaps, is this even legal as well?)

Edit: this answer suggests they may be doing it for some kind of threat detection or anti-fraud process perhaps, but all of this still seems somewhat fishy to me, not to mention possibly even from a legal standpoint as well!

Are there any security risks associated with client-side port scanning? Or, more specifically, a "trusted" site (e.g., banking website) loading javascript trying to connect to various localhost ports?

This looks suspicious to me, but seems to be an emerging (or standard?) practice, as referenced in earlier questions here:

Strange Payment Gateway

Also, some Redditors noticed Facebook and banking sites doing this as well:

https://www.reddit.com/r/AskNetsec/comments/4j0nas/why_is_facebook_checking_my_open_ports/

https://www.reddit.com/r/AskNetsec/comments/6825ki/why_is_my_internet_banking_is_scanning_for_vncrdp/

And even cybersecurity researcher Paul Moore sought to sue over this as well:

https://www.cbronline.com/news/halifax-port-scans

https://www.theregister.co.uk/2018/08/07/halifax_bank_ports_scans/

So, what's really going on? Why are they doing this? Can there be security or privacy risks involved?

This answer suggests they may be doing it for some kind of threat detection or anti-fraud process perhaps, but all of this still seems somewhat fishy to me.

1
source | link

Is there a danger to client port scanning?

Are there any security risks associated with client-side port scanning? Or, more specifically, a "trusted" site (e.g., banking website) loading javascript trying to connect to various localhost ports?

This looks suspicious to me, but seems to be an emerging (or standard?) practice, as referenced in earlier questions here:

Strange Payment Gateway

Port scanning legal or not?

Also, some redditors noticed Facebook and banking sites doing this as well:

https://www.reddit.com/r/AskNetsec/comments/4j0nas/why_is_facebook_checking_my_open_ports/

https://www.reddit.com/r/AskNetsec/comments/6825ki/why_is_my_internet_banking_is_scanning_for_vncrdp/

And even cybersecurity researcher Paul Moore sought to sue over this as well:

https://www.cbronline.com/news/halifax-port-scans

https://www.theregister.co.uk/2018/08/07/halifax_bank_ports_scans/

So, what's really going on? Why are they doing this? Can there be security or privacy risks involved? (Perhaps, is this even legal as well?)

Edit: this answer suggests they may be doing it for some kind of threat detection or anti-fraud process perhaps, but all of this still seems somewhat fishy to me, not to mention possibly even from a legal standpoint as well!