Hacker News Reader

Comment by xur17 | Hacker News Reader

Is there a way to block this at the browser level? Ex: block access to localhost for all domains (except from localhost itself)?

View on HN

Ublock allows you to block websocket requests. eg.

    *$websocket

will block all websocket connections. You probably want to operate on a whitelist on a site by site basis. Blocking localhost or 127.0.0.1 isn't reliable because sites can use dns rebinding attacks to bypass your filters.

Thanks for this. Adding the string to uBlock Origin's "My Filters" tab worked perfect.

    *$websocket

Tested with https://websocketstest.com/

Ublock origin says it supports ABP filter rules which allow for whitelisting sites which seems like it should allow something approximating:

  ~site.com$websocket
  *,~site.com$websocket

However this seems like it's invalid syntax because switching your example to this opens all websocket use back up tested via https://websocketstest.com/

That is not valid ABP filter syntax. This is what you want:

    *$websocket,domain=~site1.com

For more than a single site:

    *$websocket,domain=~site1.com|site2.com|...

I would personally suggest people to just enable advanced user mode and create rules such as:

    * 127.0.0.1 * blocked

To block all request attempts to 127.0.0.1.

Thanks for the information and all that you do. I had found the linked section from UBO to https://help.eyeo.com/en/adblockplus/how-to-write-filters#el... and assumed that *$websocket was <all_domains><separator><rule> similar to how other filters seem to work but I haven't delved too deeply in the rule syntax. Appreciate the correction.

Correction:

    *$websocket,domain=~site1.com|~site2.com|~...

That helps one of the vectors, but you can scan with pure JS too: https://portswigger.net/research/exposing-intranets-with-rel...

This helps, but can't you also do this sort of scanning without websockets?

How? This appears to bypass NATs Network Address Translation) & Firewalls.

Was thinking the same, maybe creating a service account for the browsers, I believe they do need some level of elevation but then using the firewall rules disabling everything expect http/s ports.. Websockets and others might be an issue, might need to be updated on an adhoc basis though and shouldnt be the reposonsibilty of the users.

This is kinda gross practice overall.

I do this by running my browser in its own network namespace, with NAT to the outside world. A couple more firewall rules explicitly add forwarding for specific localhost ports.

Use uMatrix and set a global block.

specifically, websockets are blocked by the "XHR" component on the popup panel, which also blocks XmlRPC and the Fetch API. as a rule, you could block all XHR requests everywhere with:

    * * xhr block

What I actually do is block everything but first-party requests, apart from CSS and images:

    * * * block
    * * cookie block
    * * css allow
    * * frame block
    * * image allow
    * 1st-party * allow
    * 1st-party css allow
    * 1st-party frame allow
    * 1st-party image allow

i actually allow xhr on third-party requests once i enabled third-party requests, which makes it possible to "enable" a bunch of site with two clicks (popup panel then click on "all").

Whitelist sites that you allow WS features.

I wonder though if it was just a websocket that could do this, surely some client side JS can just itterate the same when loaded.

Could you expand upon how to do this? And what does WS mean?

WS is WebSockets, its a protocol so you could disable it at that level.

Reply on news.ycombinator.com