5 ms·

Cloudflare recently hijacked the domain of one of their customers (RaidForums), then cloned the RaidForums login page, and ran a phishing campaign at the behest

by px43 4y ago

Cloudflare recently hijacked the domain of one of their customers (RaidForums), then cloned the RaidForums login page, and ran a phishing campaign at the behest of the FBI for two weeks. I understand that you have to comply with law enforcement, but actively attacking the users of one of your customer's websites is super rude.

xyzzy_plugh 4y ago
This is a pretty wild mischaracterization. "I can't believe they let the FBI tell them what to do" is an incredibly bad take.
- marginalia_nu 4y ago
  It is a problem when you centralize the Internet like this though. The more of the Internet you've got running through your service, the more appealing a target you are for not only domestic government pressure, but attempts from foreign state actors to compromise the service (through not only hacking, but espionage and blackmail as well). It's not great.
  - xyzzy_plugh 4y ago
    I'm no fan of centralization but if you think that it makes any difference to the FBI, you're mistaken. The tiniest providers are obligated to do the exact same thing. This has nothing to do with domestic pressure.
- px43 4y ago
  When the FBI asked Apple to build tools to attack customers, Apple said no. Cloudflare could have just dropped RaidForums as a customer, but they went the extra mile and built tools to facilitate an attack of RF users.
Snawoot 4y ago
Please, where can I read about that? I need it to back my point why putting too much trust into CF is not good.
- px43 4y ago
  It's all this: https://www.bleepingcomputer.com/news/security/raidforums-hacking-forum-seized-by-police-owner-arrested/ https://www.bleepingcomputer.com/news/security/raidforums-ha... Also I feel like Raid Forums is a bit mis-characterized in the article. It was largely a forum for people who collect OSINT about breached websites, not really a market place, and in the years that I spent there, I never saw people selling actually carding details, like they claim in the article. I used it regularly for my day job.
  - Snawoot 4y ago
    Thanks!
Handytinge 4y ago
I did a bit of reading on this, and it looks like the main admin was arrested weeks before the phishing campaign went up. It seems therefore entirely plausable that the admin handed they keys to the castle to the FBI anyway, or at least gave Cloudflare the okay to go ahead. I can't find a shred of evidence that Cloudflare were involved directly in making the phishing page or even complying with the FBI.

by px43 4y ago

xyzzy_plugh 4y ago

This is a pretty wild mischaracterization. "I can't believe they let the FBI tell them what to do" is an incredibly bad take.

marginalia_nu 4y ago
It is a problem when you centralize the Internet like this though. The more of the Internet you've got running through your service, the more appealing a target you are for not only domestic government pressure, but attempts from foreign state actors to compromise the service (through not only hacking, but espionage and blackmail as well). It's not great.
- xyzzy_plugh 4y ago
  I'm no fan of centralization but if you think that it makes any difference to the FBI, you're mistaken. The tiniest providers are obligated to do the exact same thing. This has nothing to do with domestic pressure.
px43 4y ago
When the FBI asked Apple to build tools to attack customers, Apple said no. Cloudflare could have just dropped RaidForums as a customer, but they went the extra mile and built tools to facilitate an attack of RF users.

Snawoot 4y ago

Please, where can I read about that? I need it to back my point why putting too much trust into CF is not good.

px43 4y ago
It's all this: https://www.bleepingcomputer.com/news/security/raidforums-hacking-forum-seized-by-police-owner-arrested/ https://www.bleepingcomputer.com/news/security/raidforums-ha... Also I feel like Raid Forums is a bit mis-characterized in the article. It was largely a forum for people who collect OSINT about breached websites, not really a market place, and in the years that I spent there, I never saw people selling actually carding details, like they claim in the article. I used it regularly for my day job.
- Snawoot 4y ago
  Thanks!

Handytinge 4y ago

I did a bit of reading on this, and it looks like the main admin was arrested weeks before the phishing campaign went up. It seems therefore entirely plausable that the admin handed they keys to the castle to the FBI anyway, or at least gave Cloudflare the okay to go ahead. I can't find a shred of evidence that Cloudflare were involved directly in making the phishing page or even complying with the FBI.