4 ms·

Nothing prevents C&C from being fronted by cloudflare.

by Kubuxu 3y ago

viraptor 3y ago
And CloudFlare will be extremely happy to let them hide there. They don't care about malware abusing their workers infra. But also "Only allow HTTPS out to FAANG" - ok, so now you're allowing encrypted connections to 2 largest cloud providers. At that point what's the benefit at all?
- jay-barronville 3y ago
  > They [Cloudflare] don't care about malware abusing their workers infra. This is a serious allegation to make. Do you happen to have some supporting evidence?
  - fullspectrumdev 3y ago
    It’s widely known and talked about in the infosec community - getting CF to do anything about malicious content on their services is an absolute nightmare. I do understand they don’t want to set any bad precedents internally, but their abuse reporting is abysmal.
    - jay-barronville 3y ago
      Do you have some supporting evidence?
      - deleted 3y ago
        [deleted]
      - averageRoyalty 3y ago
        Is it needed? Most hosting companies and CDNs are difficult to get to remove malicious content, this is pretty well known. I don't know why we'd require some form of irrefutable evidence to believe Cloudflare isn't the same.
  - viraptor 3y ago
    Just search for CloudFlare worker abuse. There's lots of stories like this https://news.ycombinator.com/item?id=37064311 https://news.ycombinator.com/item?id=37064311 , larger campaigns like https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ https://www.bleepingcomputer.com/news/security/blackwater-ma... , DDoS campaigns originating from workers https://news.ycombinator.com/item?id=38496499 https://news.ycombinator.com/item?id=38496499 It's kinda hard to point to someone saying how big the problem is, because most posts are just "sigh, here's yet another example, anyway...". I wouldn't go as far as saying they're doing this as an intended strategy, but it's definitely a case of it being hard for CloudFlare to care about an issue when they're in business of selling protection from that issue.
    - jay-barronville 3y ago
      Thank you for providing links instead of giving me a “just believe me, bro” type of response. I’m about to take a look at them. As a side note, I’m actually amused that I got downvoted for simply asking for evidence. I think it’s a pretty reasonable to ask folks to substantiate serious allegations made against a company like Cloudflare (a company, I might add, I’m not even a fan of for my own personal/philosophical reasons). I find this behavior very cult-like, but anyway, I digress…
- sambull 3y ago
  One mans C&C server is anothers RMM.
- llamaInSouth 3y ago
  Im pretty sure he was joking anyways... Either way, I thought it was funny.

Nothing prevents C&C from being fronted by cloudflare.

by Kubuxu 3y ago

Nothing prevents C&C from being fronted by cloudflare.

And CloudFlare will be extremely happy to let them hide there. They don't care about malware abusing their workers infra. But also "Only allow HTTPS out to FAANG" - ok, so now you're allowing encrypted connections to 2 largest cloud providers. At that point what's the benefit at all?

jay-barronville 3y ago
> They [Cloudflare] don't care about malware abusing their workers infra. This is a serious allegation to make. Do you happen to have some supporting evidence?
- fullspectrumdev 3y ago
  It’s widely known and talked about in the infosec community - getting CF to do anything about malicious content on their services is an absolute nightmare. I do understand they don’t want to set any bad precedents internally, but their abuse reporting is abysmal.
  - jay-barronville 3y ago
    Do you have some supporting evidence?
    - deleted 3y ago
      [deleted]
    - averageRoyalty 3y ago
      Is it needed? Most hosting companies and CDNs are difficult to get to remove malicious content, this is pretty well known. I don't know why we'd require some form of irrefutable evidence to believe Cloudflare isn't the same.
- viraptor 3y ago
  Just search for CloudFlare worker abuse. There's lots of stories like this https://news.ycombinator.com/item?id=37064311 https://news.ycombinator.com/item?id=37064311 , larger campaigns like https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/ https://www.bleepingcomputer.com/news/security/blackwater-ma... , DDoS campaigns originating from workers https://news.ycombinator.com/item?id=38496499 https://news.ycombinator.com/item?id=38496499 It's kinda hard to point to someone saying how big the problem is, because most posts are just "sigh, here's yet another example, anyway...". I wouldn't go as far as saying they're doing this as an intended strategy, but it's definitely a case of it being hard for CloudFlare to care about an issue when they're in business of selling protection from that issue.
  - jay-barronville 3y ago
    Thank you for providing links instead of giving me a “just believe me, bro” type of response. I’m about to take a look at them. As a side note, I’m actually amused that I got downvoted for simply asking for evidence. I think it’s a pretty reasonable to ask folks to substantiate serious allegations made against a company like Cloudflare (a company, I might add, I’m not even a fan of for my own personal/philosophical reasons). I find this behavior very cult-like, but anyway, I digress…
sambull 3y ago
One mans C&C server is anothers RMM.
llamaInSouth 3y ago
Im pretty sure he was joking anyways... Either way, I thought it was funny.