3 ms·
Hmm, risking sounding like the dropbox-is-only-ftp-and-svn guy but shouldn't any threat actor worth their salt be able to use any array of open source tools to
by filleokus 3y ago
Hmm, risking sounding like the dropbox-is-only-ftp-and-svn guy but shouldn't any threat actor worth their salt be able to use any array of open source tools to do this? Especially if you already have access on the machine and the possibility to place binaries there?
The biggest risk I see is if the target is already using this for legit use cases, since I guess it would be really difficult to discern between the two.
- j16sdiz 3y ago> I guess it would be really difficult to discern between the two I guess renaming the malware binary to chrome .exe would have the same risk?
- filleokus 3y agoThe article mentions other signals, like port numbers and DNS lookups for outgoing connections to Cloudflare when setting up the tunnel. If you use this Cloudflare feature for other stuff, you obviously can’t use those as high SNR indicators.