3 ms·
Yes. This is some very basic malware, but real ones will use HTTPS on port 443.
by goodpoint 3y ago
Yes. This is some very basic malware, but real ones will use HTTPS on port 443.
- BLKNSLVR 3y agoOnly allow HTTPS out to FAANG (whatever it is now) + Cloudflare IP address ranges
- Kubuxu 3y agoNothing prevents C&C from being fronted by cloudflare.
- viraptor 3y agoAnd CloudFlare will be extremely happy to let them hide there. They don't care about malware abusing their workers infra. But also "Only allow HTTPS out to FAANG" - ok, so now you're allowing encrypted connections to 2 largest cloud providers. At that point what's the benefit at all?
- jay-barronville 3y ago> They [Cloudflare] don't care about malware abusing their workers infra. This is a serious allegation to make. Do you happen to have some supporting evidence?
- fullspectrumdev 3y agoIt’s widely known and talked about in the infosec community - getting CF to do anything about malicious content on their services is an absolute nightmare. I do understand they don’t want to set any bad precedents internally, but their abuse reporting is abysmal.
- jay-barronville 3y agoDo you have some supporting evidence?
- deleted 3y ago[deleted]
- averageRoyalty 3y agoIs it needed? Most hosting companies and CDNs are difficult to get to remove malicious content, this is pretty well known. I don't know why we'd require some form of irrefutable evidence to believe Cloudflare isn't the same.
- viraptor 3y agoJust search for CloudFlare worker abuse. There's lots of stories like this https://news.ycombinator.com/item?id=37064311 https://news.ycombinator.com/item?id=37064311 , larger campaigns like https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ https://www.bleepingcomputer.com/news/security/blackwater-ma... , DDoS campaigns originating from workers https://news.ycombinator.com/item?id=38496499 https://news.ycombinator.com/item?id=38496499 It's kinda hard to point to someone saying how big the problem is, because most posts are just "sigh, here's yet another example, anyway...". I wouldn't go as far as saying they're doing this as an intended strategy, but it's definitely a case of it being hard for CloudFlare to care about an issue when they're in business of selling protection from that issue.
- jay-barronville 3y agoThank you for providing links instead of giving me a “just believe me, bro” type of response. I’m about to take a look at them. As a side note, I’m actually amused that I got downvoted for simply asking for evidence. I think it’s a pretty reasonable to ask folks to substantiate serious allegations made against a company like Cloudflare (a company, I might add, I’m not even a fan of for my own personal/philosophical reasons). I find this behavior very cult-like, but anyway, I digress…
- sambull 3y agoOne mans C&C server is anothers RMM.
- llamaInSouth 3y agoIm pretty sure he was joking anyways... Either way, I thought it was funny.
- pyinstallwoes 3y agoBetter to limit per process
- mort96 3y agoCreate a bunch of burner Google accounts and use Google Drive or Docs or Calendar as C&C?
- franga2000 3y agoI've used Google App Script for C&C in a demo before. It's HTTPS traffic going to a Google IP and the domain is script.google.com - what looks more legit than that?
- fullspectrumdev 3y agoHiding your C&C behind clownflare is basically the default mode for a lot of actors. CF are terribly slow to respond to abuse, their ranges are allowlisted everywhere, and it’s not terribly hard to hide your backend infrastructure (origin) even from cloudflare itself. Sure you have to deal with the eventual takedown of your domain, by CF or more likely the domain registrar, but it’s trivial to work around that (backup domains, frequently rotating them, etc). What’s funny is how Namecheap are now absolutely god tier at doing takedowns on malicious domains - they used to have a very poor reputation and now will process a takedown (provided evidence) within the hour usually.
- zelphirkalt 3y agoWondering if typo, auto-correct, or intentional ... anyway, I like :D
- averageRoyalty 3y agoGiven the critical tone, I'd say probably intentional.
- miloudi 3y agowhat's C&C? sorry for hijacking the thread.
- e63f67dd-065b 3y agoCommand and Control. The server that issues instructions to the malware.
- deleted 3y ago[deleted]
- goodpoint 3y agoYes, and with domain fronting and doing traffic patterns that look legitimate. A good solution is to block all outgoing traffic on production servers.