57

In helping a corporate user log on to eBay, I noticed that when on the login page, a stream of errors were coming up in the Firefox JS Console about not being able to connect to wss://localhost. This is a bit concerning, obviously. Why would a web site need to connect to a web server running locally.

ebay

In looking further, I found that this request comes from check.js at this URL:

https://src.ebay-us.com/fp/check.js?org_id=usllpic0&session_id=586308251720aad9263fb1e7fffd7373

Is this some malicious script injected into eBay or do they have a legitimate reason for doing that? Anybody knows?

Improve this question
5

3 Answers 3

Reset to default
62

This is ebay running a local port scan over websockets. It has been reported recently:

I don't think it's malicious, but it is bad practice, it's sneaky and erodes user trust. They do it before you accept any T&Cs of any kind allowing probing into your own computer.

Similar tactics are used by banks in more or less open ways (it varies).

Improve this answer
5
  • 4
    It's interesting that they are able to get around same-origin policy, and have the results of the connection attempts to localhost sent back to the origin (ebay.com). I suppose same-origin policy doesn't apply in this case, because they are only making a connection attempt to localhost, and not actually reading any data from localhost.
    – mti2935
    Commented May 28, 2020 at 21:52
  • 1
    I suppose (without having investigated further) that websockets operate under a slightly different set of rules to HTTP traffic. And as well browsers will have their own variations of implementation and security controls.
    – Pedro
    Commented May 28, 2020 at 21:55
  • 10
    You're right. See blog.securityevaluators.com/… for an interesting write-up about this. I agree with what you wrote in your answer. It feels like there is something very insidious about this.
    – mti2935
    Commented May 28, 2020 at 22:02
  • 1
    Websockets don't have a same-origin policy
    – Layne B
    Commented May 29, 2020 at 23:27
  • 1
    It is malicious, inherently.
    – R.. GitHub STOP HELPING ICE
    Commented May 31, 2020 at 21:46
18

There's been some discussion of this recently, e.g. here and here.

Suggested reasons for port scanning include: a) fingerprinting to uniquely identify your machine for future reference, or b) attempting to determine whether your machine is part of a botnet, since botnets often use VNC services over various standard ports to control their bots.

Improve this answer
5
  • If I remember right, eBay only runs these port scans if the browser is on Windows, so fingerprinting is likely out...
    – Fire Quacker
    Commented May 28, 2020 at 15:33
  • 3
    Yes, someone has reported this, it could be because the code isn't as robust as it needs to be or because it's deliberately selective?
    – Pedro
    Commented May 28, 2020 at 21:56
  • I think this would be useless for fingerprinting (likely, almost all machines would have all ports closed).
    – the default.
    Commented May 29, 2020 at 12:59
  • @mypronounismonicareinstate No, it's not as likely as you think that most machines would have those ports closed. Ignoring Linux (where VNC is relatively common for it's originally intended purpose of remote management), VNC, RDP, and the various known third-party services they check for are not all that uncommon in office settings.
    – Austin Hemmelgarn
    Commented May 29, 2020 at 13:34
  • @AustinHemmelgarn most visitors to eBay are unlikely to be from an office setting
    – Tim
    Commented May 29, 2020 at 19:41
12

A German computer magazine was writing about this observation last week and asked eBay for a statement.

eBay's answer was:

There is some widely spread software that is either Malware or legit software which can be miss-used to steal the eBay password. This software is listening on certain TCP ports.

By trying to establish a connection to these TCP ports, the (JavaScripts of the) eBay web site tries to find out if such software is currently running.

Improve this answer
3
  • Do you know which magazine it was?
    – Clockwork
    Commented May 29, 2020 at 18:00
  • 2
    @Clockwork It was the online magazine of the publisher "Heise" who also publishes the "iX" and "c't" magazines.
    – Martin Rosenau
    Commented May 29, 2020 at 18:59
  • 3
    @Clockwork Heise has been THE authority publisher on IT in Germany for 30 years
    – jdog
    Commented May 29, 2020 at 22:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .