4 ms·

Hackers increasingly abuse Cloudflare Tunnels for stealthy connections

• justinludwig 3y ago
  Comments from a similar article posted yesterday: https://news.ycombinator.com/item?id=37023806 https://news.ycombinator.com/item?id=37023806
• neodymiumphish 3y ago
  I'm the author of the source blog. Happy to answer any questions about the research I conducted on this! Was a fun project to run through and discover additional attack vectors!
  • stevefan1999 3y ago
    Is Cloudflare Tunnel just another overlay network like Tor?
    • redrove 3y ago
      “Cloudflare Tunnel” is not a network onto itself but an ngrok-like product of Cloudflare, using the Cloudflare network — which yes, is just a GRE overlay and not a _real network_ per se.
• willglynn 3y ago
  > Furthermore, as Cloudflare Tunnel requires the installation of the 'cloudflared' client, defenders can detect its use by monitoring file hashes associated with client releases. Is this effective? Presumably attackers could `go build` their own binaries to get equivalent clients with different hashes, or even combine the open-source `cloudflared` internals with a larger payload.
  • neodymiumphish 3y ago
    That's definitely true. What we saw in the instances we've observed were the legit binaries from Cloudflared directly. It's definitely possible for them to build their own varients to avoid basic hash detection, or to implement alternative connectivity instead of routing to Cloudflared infrastructure over 7844.