5 ms·

Cloudflare reports almost 7% of internet traffic is malicious

67 points by isaacfrond 2y ago

freedomben 2y ago
It's a shame that the actual report is buried behind the marketing BS "give me your email to get the report" stuff.
deleted 2y ago
[deleted]
jsheard 2y ago
The call is coming from inside the house, the majority of DDoS-for-hire services are hiding behind Cloudflare.
- which 2y ago
  This talking point is tired. They would just pay $100/month for ddos-guard. I don't understand why Cloudflare should be forced to screen customers by default or held to a standard that no other Internet business is. Why not go up the chain and start protesting outside Verisign HQ?
  - tiffanyh 2y ago
    > I don't understand why Cloudflare should be forced to screen customers by default It's very common for reputable hosting company's to KYC/KYB. It's good for them & also good for their legit customers.
    - which 2y ago
      Yes but there's no law requiring this and it raises their bounce rate. I don't see any evidence that if law enforcement asked them to shut down a domain that they wouldn't. DDoS as a service existed long before Cloudflare and in its simplest form just requires messaging someone on a forum with a target.
    - metalcrow 2y ago
      It's not good for their legit customers that are politically unpopular. Porn/Adult hosting services get a lot of trouble for this exact reason.
      - tiffanyh 2y ago
        What you're describing is the modern (digital) version of "sin tax". Where government identified categories like smoking, alcohol, pornography - are defined by governments to be potentially harmful to its citizens. So as a hosting company, you're in a weird spot because it's not clear if you can/cannot do business with those types of companies.
  - jorams 2y ago
    Cloudflare likes using their extensive knowledge of everything on the internet for marketing purposes. When it comes to their customers they suddenly know nothing. I think calling it out until they change either side of that is reasonable.
    - raxxorraxor 2y ago
      While malicious traffic is a threat, so is the internet police going after political content. I think Cloudflare made some mistakes here in the past and indeed it was for content that you hardly can garner sympathy for. But the important thing is that they are not a gatekeeper and that is very fine with me.
bdcravens 2y ago
That's all?
ChrisArchitect 2y ago
Actual article: https://blog.cloudflare.com/application-security-report-2024-update https://blog.cloudflare.com/application-security-report-2024...
eduction 2y ago
Crime is up in your neighborhood, says company that sells burglar alarms.
- robertlagrant 2y ago
  Crime exists, says company that sells burglar alarms.
solardev 2y ago
That seems... really low? I would've expected way, WAY more than that. Even later on in the report, they say: > 31.2% of all application traffic processed by Cloudflare is bot traffic. [...] 93% of bots we identified were unverified bots, and potentially malicious. So I guess there's a wide range there, from 7% verified at the low end, up to maybe 30% at the higher, hypothetical end?
- deleted 2y ago
  [deleted]
- wkat4242 2y ago
  I would personally consider ad tracking networks malicious too so i think that's pretty low yeah :)
- candiddevmike 2y ago
  Now apply that number to MAUs for various applications.
- deleted 2y ago
  [deleted]
- danielspace23 2y ago
  30% is plain ridiculous. Cloudflare is believed to counts as bots even the real users who fail their verification, including: - people with older browsers who fail it automatically due to unsupported features - whoever gets stuck in captcha loops and gives up eventually - whoever has a slow internet connection and gives up during the verification process This happens to be a lot of people, especially the less technical ones with less access to good technology, which is why we rarely hear complaints on HN. This way, the Cloudflare people can tell you some completely made up numbers, like "This month we blocked one gazillion malicious bots and saved you 30 yottabytes of data", which makes it look like they're doing something of value instead of making the internet a more closed, restricted, corporate and centralized place.
  - JohnFen 2y ago
netsharc 2y ago
> In one case, attackers attempted to exploit a JetBrains TeamCity DevOps authentication bypass a mere 22 minutes after the proof-of-concept code was published. Ha, I wonder if an LLM can be told to "code an exploit from this proof-of-concept, find hosts where this app is running and give me admin access"...

67 points by isaacfrond 2y ago

freedomben 2y ago

It's a shame that the actual report is buried behind the marketing BS "give me your email to get the report" stuff.

deleted 2y ago

[deleted]

jsheard 2y ago

The call is coming from inside the house, the majority of DDoS-for-hire services are hiding behind Cloudflare.

which 2y ago
This talking point is tired. They would just pay $100/month for ddos-guard. I don't understand why Cloudflare should be forced to screen customers by default or held to a standard that no other Internet business is. Why not go up the chain and start protesting outside Verisign HQ?
- tiffanyh 2y ago
  > I don't understand why Cloudflare should be forced to screen customers by default It's very common for reputable hosting company's to KYC/KYB. It's good for them & also good for their legit customers.
  - which 2y ago
    Yes but there's no law requiring this and it raises their bounce rate. I don't see any evidence that if law enforcement asked them to shut down a domain that they wouldn't. DDoS as a service existed long before Cloudflare and in its simplest form just requires messaging someone on a forum with a target.
  - metalcrow 2y ago
    It's not good for their legit customers that are politically unpopular. Porn/Adult hosting services get a lot of trouble for this exact reason.
    - tiffanyh 2y ago
      What you're describing is the modern (digital) version of "sin tax". Where government identified categories like smoking, alcohol, pornography - are defined by governments to be potentially harmful to its citizens. So as a hosting company, you're in a weird spot because it's not clear if you can/cannot do business with those types of companies.
- jorams 2y ago
  Cloudflare likes using their extensive knowledge of everything on the internet for marketing purposes. When it comes to their customers they suddenly know nothing. I think calling it out until they change either side of that is reasonable.
  - raxxorraxor 2y ago
    While malicious traffic is a threat, so is the internet police going after political content. I think Cloudflare made some mistakes here in the past and indeed it was for content that you hardly can garner sympathy for. But the important thing is that they are not a gatekeeper and that is very fine with me.

bdcravens 2y ago

That's all?

ChrisArchitect 2y ago

Actual article: https://blog.cloudflare.com/application-security-report-2024-update https://blog.cloudflare.com/application-security-report-2024...

eduction 2y ago

Crime is up in your neighborhood, says company that sells burglar alarms.

robertlagrant 2y ago
Crime exists, says company that sells burglar alarms.

solardev 2y ago

That seems... really low? I would've expected way, WAY more than that. Even later on in the report, they say: > 31.2% of all application traffic processed by Cloudflare is bot traffic. [...] 93% of bots we identified were unverified bots, and potentially malicious. So I guess there's a wide range there, from 7% verified at the low end, up to maybe 30% at the higher, hypothetical end?

deleted 2y ago
[deleted]
wkat4242 2y ago
I would personally consider ad tracking networks malicious too so i think that's pretty low yeah :)
candiddevmike 2y ago
Now apply that number to MAUs for various applications.
deleted 2y ago
[deleted]
danielspace23 2y ago
30% is plain ridiculous. Cloudflare is believed to counts as bots even the real users who fail their verification, including: - people with older browsers who fail it automatically due to unsupported features - whoever gets stuck in captcha loops and gives up eventually - whoever has a slow internet connection and gives up during the verification process This happens to be a lot of people, especially the less technical ones with less access to good technology, which is why we rarely hear complaints on HN. This way, the Cloudflare people can tell you some completely made up numbers, like "This month we blocked one gazillion malicious bots and saved you 30 yottabytes of data", which makes it look like they're doing something of value instead of making the internet a more closed, restricted, corporate and centralized place.
- JohnFen 2y ago

netsharc 2y ago

> In one case, attackers attempted to exploit a JetBrains TeamCity DevOps authentication bypass a mere 22 minutes after the proof-of-concept code was published. Ha, I wonder if an LLM can be told to "code an exploit from this proof-of-concept, find hosts where this app is running and give me admin access"...