3 ms·

> Brute-forcing the SSH password for root? Not in this context. Cloudflare-protected pages don't need to worry that. > I'm guessing credential stuffing of adm

> Brute-forcing the SSH password for root? Not in this context. Cloudflare-protected pages don't need to worry that. > I'm guessing credential stuffing of admin pages? More complex than that, but you've got the point. Funnily, there is silence on Fastly's filter - sure, it's not active until you toggle it, but even without explicit Tor block you get the same result.

prophesi 5y ago
Can it not be defined beyond "it's complicated"?
- zinekeller 5y ago
  It's quite hard, because it's not just "use known vulnerabilities on this specific address" - you can block it easily, and there are projects (such as CRS: https://github.com/coreruleset/coreruleset https://github.com/coreruleset/coreruleset) that tries to emulate this. It's more of combined specific attacks, which is amplified because if CloudFlare detected an attempt on a single high-profile site, then that IP address can be propagate to all of Cloudflare-protected "properties" (as they called it). Combine that with how random is an address allocated in Tor (and frequent rotations), and you've got blocks without using an explicit Tor list.
  - prophesi 5y ago
    > it's not just "use known vulnerabilities on this specific address" Ok, so they're not blocking complicated attacks. Just automation of attempts to exploit known vulnerabilities. And then their IP is marked as high risk. Rinse and repeat until the majority of TOR nodes are blocked. Definitely can't see that causing issues for TOR (or VPN) users. Edit: And to comment on this: > Funnily, there is silence on Fastly's filter > Cloudflare is used by 80.6% of all the websites whose reverse proxy service we know. This is 17.4% of all websites. https://w3techs.com/technologies/details/cn-cloudflare https://w3techs.com/technologies/details/cn-cloudflare > Fastly is used by 5.7% of all the websites whose reverse proxy service we know. This is 1.2% of all websites. https://w3techs.com/technologies/details/cn-fastly https://w3techs.com/technologies/details/cn-fastly

prophesi 5y ago

Can it not be defined beyond "it's complicated"?

zinekeller 5y ago
It's quite hard, because it's not just "use known vulnerabilities on this specific address" - you can block it easily, and there are projects (such as CRS: https://github.com/coreruleset/coreruleset https://github.com/coreruleset/coreruleset) that tries to emulate this. It's more of combined specific attacks, which is amplified because if CloudFlare detected an attempt on a single high-profile site, then that IP address can be propagate to all of Cloudflare-protected "properties" (as they called it). Combine that with how random is an address allocated in Tor (and frequent rotations), and you've got blocks without using an explicit Tor list.
- prophesi 5y ago
  > it's not just "use known vulnerabilities on this specific address" Ok, so they're not blocking complicated attacks. Just automation of attempts to exploit known vulnerabilities. And then their IP is marked as high risk. Rinse and repeat until the majority of TOR nodes are blocked. Definitely can't see that causing issues for TOR (or VPN) users. Edit: And to comment on this: > Funnily, there is silence on Fastly's filter > Cloudflare is used by 80.6% of all the websites whose reverse proxy service we know. This is 17.4% of all websites. https://w3techs.com/technologies/details/cn-cloudflare https://w3techs.com/technologies/details/cn-cloudflare > Fastly is used by 5.7% of all the websites whose reverse proxy service we know. This is 1.2% of all websites. https://w3techs.com/technologies/details/cn-fastly https://w3techs.com/technologies/details/cn-fastly