6 ms·

Care to fill in the details for me? Do you mean to say the most prolific DDoS attackers work for Cloudflare? Or that their network somehow (?) shelters them? Wh

by zx2c4 10y ago

Care to fill in the details for me? Do you mean to say the most prolific DDoS attackers work for Cloudflare? Or that their network somehow (?) shelters them? What do you mean exactly? This sounds interesting.

Jweb_Guru 10y ago
There's another comment that links to one of his posts about it (http://webcache.googleusercontent.com/search?q=cache:0uf9RIu0ZswJ:krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/&num=1&hl=en&gl=us&strip=1&vwsrc=0 http://webcache.googleusercontent.com/search?q=cache:0uf9RIu...).
invokestatic 10y ago
Cloudflare hilariously acts as a reverse proxy for booters and does not respond to abuse reports against them.
- kyledrake 10y ago
  I can confirm that this is true. "Hilarious" is not the word I would use to describe it, "potentially criminal" I think is closer to correct.
  - fleitz 10y ago
    I'd call it business savvy.
  - Dylan16807 10y ago
    They seem to think they have firm legal ground. Keep in mind that most reverse proxies will do the same thing. The only difference with Cloudflare is that you don't know the destination IP.
  - deleted 10y ago
    [deleted]
  - driverdan 10y ago
    > potentially criminal Not even remotely. If the government steps in with a subpoena for the origin host IP or an injunction to stop protecting the site they'd stop. Someone on the internet asking them has no legal power to do so.
    - kyledrake 10y ago
      https://news.ycombinator.com/item?id=12568256 https://news.ycombinator.com/item?id=12568256
- belorn 10y ago
  Why send cloudflare the abuse report rather than the police who are paid by the government to investigate crimes. I have little understanding for this current trend of letting suspected criminals go un-investigated while all focus is on private third-parties that is held up to act police, judge and jury.
  - yoo1I 10y ago
    Because one would think that it would be in CloudFlare's interest not to harbour criminals on their network. This logic seems to work almost everywhere else on the internet, including privacy friendly hosters in iceland. It's mostly just CloudFlare who replies to every abuse report with the same "WE R A REVERSE PROXY", no matter what the actual issue that was raised with them was. If they were any smaller, their IP ranges would just go into the rogue-isp-blocklist, and that would be the end of that. But because they're mixing in the criminals with their normal customers, that's not really possible. And since I am unlikely to be in any jurisdiction that CloudFlare is in, nor do I have any chance of finding out who these criminals are because CloudFlare is protecting them, going to the police here wouldn't really achieve much.
    - dec0dedab0de 10y ago
      Because one would think that it would be in CloudFlare's interest not to harbour criminals on their network. It's also not in their best interest to take on the burden of deciding who the criminals are.
QuantumYeti 10y ago
He might be referring to vDOS using Cloudflare: http://webcache.googleusercontent.com/search?q=cache:kaymYsbcGc8J:krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/+&cd=1&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:kaymYsb...
yolesaber 10y ago
>The DDoS-for-hire service is hidden behind DDoS protection firm Cloudflare, but its actual Internet address is 82.118.233.144. https://webcache.googleusercontent.com/search?q=cache:kaymYsbcGc8J:krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/+&cd=1&hl=en&ct=clnk&gl=us https://webcache.googleusercontent.com/search?q=cache:kaymYs...
npiazza83 10y ago
I have personally witnessed Akamai use strongarm tactics to "prove" you need their, "protection" in such a ridiculously high profile instance I am sure they have no shame. If this is a CloudFlare Vs Akamai attack Krebs isn't saying, but I would put dollars to doughnuts it is.
- nolok 10y ago
  While I'm open to believe you if true, you need proof, links to affected people giving details, etc... Not your personal anecdote that may or may not have happened the way you describe it. Otherwise your post is merely an unsubstantiated personal attack against akamai.
  - npiazza83 10y ago
    I've talked about it before in lots of contexts and no one believes me anyway. Why bother?
    - nolok 10y ago
      well if you've never offered factual proof to back your "I've seen things" statement, that's not a surprise. If you've ever given proof to back it up, I would love the corresponding link.
      - npiazza83 10y ago
        Do you check your email?
shunhai 10y ago
Cloudflare protects everybody who signs up, including control panels for "booter sites", which are web pages where you can allegedly buy a DDoS attack for an hourly rate. Kind of like the police protects gangsters from getting shot by other gangsters, but you would really like them not to do that, so that the gangsters can just shoot each other. In this case, Brian Krebs tried to convince Cloudflare to kick off the booter sites, so they are unprotected, and can DDoS each other. Cloudflare didn't put any effort into that idea, and now he's apparently angry that he didn't get through to them.
- kyledrake 10y ago
  That's not called being "angry". That's called being principled. Other things that are considered principled include posting your opinions with your name on them instead of cowardly resorting to a throwaway account like you just did. Cloudflare is not the police. They're a private organization that makes a profit from offering "protection" for people getting DDoS attacked. They enable the people doing the DDoS attacks by protecting their booter sites (https://www.google.com/search?q=ddos+booter https://www.google.com/search?q=ddos+booter). That's called a racketeering operation (https://en.wikipedia.org/wiki/Racket_(crime) https://en.wikipedia.org/wiki/Racket_(crime)), and that's illegal. There are laws against it. Just because our crappy government is too incompetent to file charges doesn't mean it isn't illegal. If Cloudflare thinks they can foster criminal activity through their network because they're running a juiced up nginx proxy, they're wrong. The "slippery slope" argument is absolute nonsense. As Krebs himself pointed out, they already remove sites that are hosting phishing attacks and malware. Cloudflare, it's time to do the right thing here and stop protecting DDoS booters. Your policies are helping to damage the internet and censor people, whether they're illegal (they are) or not.
  - MichaelGG 10y ago
    They enable the booter's free speech; they aren't enabling their actual attacks. If comparison to police doesn't suit you since they're special, think of doctors.
    - 10y ago
elmin 10y ago
Cloudflare has a pretty simple policy. They only censor content when they legally have to, or when it's child porn. That actually opens them up to a lot of heat from people who aren't big fans of the KKK, the Westboro Baptist Church, or botnets. BUT they don't specifically allow botnets as a weird method of promoting them, it's a widely applied policy. I would bet things would be a fair bit easier for them if they agreed to take things down which most people don't like, but from my position they are taking a very principaled stand for free speech. Are people on hn actually arguing we want more censorship on more places on the web?
- kyledrake 10y ago
  Nobody in here is proposing that Cloudflare censor unpopular speech. We are asking that they stop protecting for-profit DDoS attack sites that are destroying the internet and using violence to censor people's ability to speak. That isn't a freedom of speech debate, it's a debate on the ethics and legality of defending and protecting criminal activity that financially benefits them, a timely topic now that this activity is actively threatening the ability of the internet to function for any kind of speech http://www.webhostingtalk.com/showthread.php?t=1599694 http://www.webhostingtalk.com/showthread.php?t=1599694 http://webcache.googleusercontent.com/search?q=cache:0uf9RIu0ZswJ:krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/&num=1&hl=en&gl=us&strip=1&vwsrc=0 http://webcache.googleusercontent.com/search?q=cache:0uf9RIu...
  - pooper 10y ago
    I mostly agree with you but let's not take it too far. > We are asking that they stop protecting for-profit DDoS attack sites that are destroying the internet and using violence to censor people's ability to speak. A DoS is not a violent act. I am mostly ignorant of these things but I think attacks if this kind are a service that test our capabilities. My fear is that there might be calls for legislative actions against "DoS attacks" which would then apply to people sitting at home pressing F5.
    - ryanlol 10y ago
elmin 10y ago
Cloudflare has a pretty simple policy. They only censor content when they legally have to, or when it's child porn. That actually opens them up to a lot of heat from people who aren't big fans of the KKK, the Westboro Baptist Church, or botnets. BUT they don't specifically allow botnets as a weird method of promoting them, it's a widely applied policy. I would bet things would be a fair bit easier for them if they agreed to take things down which most people don't like, but from my position they are taking a very principaled stand for free speech. Are people on hn actually arguing we want more censorship on more places on the web?

by zx2c4 10y ago

Jweb_Guru 10y ago

There's another comment that links to one of his posts about it (http://webcache.googleusercontent.com/search?q=cache:0uf9RIu0ZswJ:krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/&num=1&hl=en&gl=us&strip=1&vwsrc=0 http://webcache.googleusercontent.com/search?q=cache:0uf9RIu...).

invokestatic 10y ago

Cloudflare hilariously acts as a reverse proxy for booters and does not respond to abuse reports against them.

kyledrake 10y ago
I can confirm that this is true. "Hilarious" is not the word I would use to describe it, "potentially criminal" I think is closer to correct.
- fleitz 10y ago
  I'd call it business savvy.
- Dylan16807 10y ago
  They seem to think they have firm legal ground. Keep in mind that most reverse proxies will do the same thing. The only difference with Cloudflare is that you don't know the destination IP.
- deleted 10y ago
  [deleted]
- driverdan 10y ago
  > potentially criminal Not even remotely. If the government steps in with a subpoena for the origin host IP or an injunction to stop protecting the site they'd stop. Someone on the internet asking them has no legal power to do so.
  - kyledrake 10y ago
    https://news.ycombinator.com/item?id=12568256 https://news.ycombinator.com/item?id=12568256
belorn 10y ago
Why send cloudflare the abuse report rather than the police who are paid by the government to investigate crimes. I have little understanding for this current trend of letting suspected criminals go un-investigated while all focus is on private third-parties that is held up to act police, judge and jury.
- yoo1I 10y ago
  Because one would think that it would be in CloudFlare's interest not to harbour criminals on their network. This logic seems to work almost everywhere else on the internet, including privacy friendly hosters in iceland. It's mostly just CloudFlare who replies to every abuse report with the same "WE R A REVERSE PROXY", no matter what the actual issue that was raised with them was. If they were any smaller, their IP ranges would just go into the rogue-isp-blocklist, and that would be the end of that. But because they're mixing in the criminals with their normal customers, that's not really possible. And since I am unlikely to be in any jurisdiction that CloudFlare is in, nor do I have any chance of finding out who these criminals are because CloudFlare is protecting them, going to the police here wouldn't really achieve much.
  - dec0dedab0de 10y ago
    Because one would think that it would be in CloudFlare's interest not to harbour criminals on their network. It's also not in their best interest to take on the burden of deciding who the criminals are.

QuantumYeti 10y ago

He might be referring to vDOS using Cloudflare: http://webcache.googleusercontent.com/search?q=cache:kaymYsbcGc8J:krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/+&cd=1&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:kaymYsb...

yolesaber 10y ago

>The DDoS-for-hire service is hidden behind DDoS protection firm Cloudflare, but its actual Internet address is 82.118.233.144. https://webcache.googleusercontent.com/search?q=cache:kaymYsbcGc8J:krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/+&cd=1&hl=en&ct=clnk&gl=us https://webcache.googleusercontent.com/search?q=cache:kaymYs...

npiazza83 10y ago

I have personally witnessed Akamai use strongarm tactics to "prove" you need their, "protection" in such a ridiculously high profile instance I am sure they have no shame. If this is a CloudFlare Vs Akamai attack Krebs isn't saying, but I would put dollars to doughnuts it is.

nolok 10y ago
While I'm open to believe you if true, you need proof, links to affected people giving details, etc... Not your personal anecdote that may or may not have happened the way you describe it. Otherwise your post is merely an unsubstantiated personal attack against akamai.
- npiazza83 10y ago
  I've talked about it before in lots of contexts and no one believes me anyway. Why bother?
  - nolok 10y ago
    well if you've never offered factual proof to back your "I've seen things" statement, that's not a surprise. If you've ever given proof to back it up, I would love the corresponding link.
    - npiazza83 10y ago
      Do you check your email?

shunhai 10y ago

Cloudflare protects everybody who signs up, including control panels for "booter sites", which are web pages where you can allegedly buy a DDoS attack for an hourly rate. Kind of like the police protects gangsters from getting shot by other gangsters, but you would really like them not to do that, so that the gangsters can just shoot each other. In this case, Brian Krebs tried to convince Cloudflare to kick off the booter sites, so they are unprotected, and can DDoS each other. Cloudflare didn't put any effort into that idea, and now he's apparently angry that he didn't get through to them.

kyledrake 10y ago
That's not called being "angry". That's called being principled. Other things that are considered principled include posting your opinions with your name on them instead of cowardly resorting to a throwaway account like you just did. Cloudflare is not the police. They're a private organization that makes a profit from offering "protection" for people getting DDoS attacked. They enable the people doing the DDoS attacks by protecting their booter sites (https://www.google.com/search?q=ddos+booter https://www.google.com/search?q=ddos+booter). That's called a racketeering operation (https://en.wikipedia.org/wiki/Racket_(crime) https://en.wikipedia.org/wiki/Racket_(crime)), and that's illegal. There are laws against it. Just because our crappy government is too incompetent to file charges doesn't mean it isn't illegal. If Cloudflare thinks they can foster criminal activity through their network because they're running a juiced up nginx proxy, they're wrong. The "slippery slope" argument is absolute nonsense. As Krebs himself pointed out, they already remove sites that are hosting phishing attacks and malware. Cloudflare, it's time to do the right thing here and stop protecting DDoS booters. Your policies are helping to damage the internet and censor people, whether they're illegal (they are) or not.
- MichaelGG 10y ago
  They enable the booter's free speech; they aren't enabling their actual attacks. If comparison to police doesn't suit you since they're special, think of doctors.
  - 10y ago

elmin 10y ago

Cloudflare has a pretty simple policy. They only censor content when they legally have to, or when it's child porn. That actually opens them up to a lot of heat from people who aren't big fans of the KKK, the Westboro Baptist Church, or botnets. BUT they don't specifically allow botnets as a weird method of promoting them, it's a widely applied policy. I would bet things would be a fair bit easier for them if they agreed to take things down which most people don't like, but from my position they are taking a very principaled stand for free speech. Are people on hn actually arguing we want more censorship on more places on the web?

kyledrake 10y ago
Nobody in here is proposing that Cloudflare censor unpopular speech. We are asking that they stop protecting for-profit DDoS attack sites that are destroying the internet and using violence to censor people's ability to speak. That isn't a freedom of speech debate, it's a debate on the ethics and legality of defending and protecting criminal activity that financially benefits them, a timely topic now that this activity is actively threatening the ability of the internet to function for any kind of speech http://www.webhostingtalk.com/showthread.php?t=1599694 http://www.webhostingtalk.com/showthread.php?t=1599694 http://webcache.googleusercontent.com/search?q=cache:0uf9RIu0ZswJ:krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/&num=1&hl=en&gl=us&strip=1&vwsrc=0 http://webcache.googleusercontent.com/search?q=cache:0uf9RIu...
- pooper 10y ago
  I mostly agree with you but let's not take it too far. > We are asking that they stop protecting for-profit DDoS attack sites that are destroying the internet and using violence to censor people's ability to speak. A DoS is not a violent act. I am mostly ignorant of these things but I think attacks if this kind are a service that test our capabilities. My fear is that there might be calls for legislative actions against "DoS attacks" which would then apply to people sitting at home pressing F5.
  - ryanlol 10y ago

elmin 10y ago