12 ms·

Threat actor abuses Cloudflare tunnels to deliver remote access trojans

320 points by luu 2y ago

wiradikusuma 2y ago
I guess this is why we can't have nice things on the internet (in this context, nice things from Cloudflare). Did you know you could send emails for free from Cloudflare (https://blog.cloudflare.com/sending-email-from-workers-with-mailchannels https://blog.cloudflare.com/sending-email-from-workers-with-...)? Well, now you couldn't. The sunsetting probably was not Clouldflare's fault, but it's more or less similar: nice service, abused.
peanut-walrus 2y ago
The times where malicious software was served from a sketchy .ru domain or a naked IP address located at some bullet-proof hosting provider are long gone. The threat actors use the same infra as everyone else - GCP, AWS, Azure, Cloudflare, etc. They also use the same VPNs for connecting to your machines as your grandparents do for watching Netflix. The internet as a whole is slowly but steadily moving towards a model where IP addresses and domain names are not useful indicators for security. You can not block your users from visiting Cloudflare or AWS IP ranges and you can not block visitors to your site from major commercial VPN providers. In addition, all the traffic is encrypted, name lookups are encrypted, so a network operator can not tell anything about what you are doing on the internet. This is a good thing for multiple reasons. First, it improves privacy and anonymity for the internet users. Second, reducing the effectiveness of network security solutions will make us be able to phase out their usage, which makes the network dumb again and prevents ossification. And third, it forces us to tackle the underlying security issues, rather than supporting a whole industry of ineffective whack-a-mole.
- deleted 2y ago
  [deleted]
- entropie 2y ago
  > You can not block your users from visiting Cloudflare or AWS IP ranges Iam pretty sure reddit does. I recently needed to rewrite/patch my tumblog backend software that uses yt-dlp to download reddit videos because reddit blocked the ip ranges of hetzners dedicated servers. I circumvented this by downloading the videos on the client via javascript and upload it to my server.
- skeaker 2y ago
  The potential downside in my eyes is that regulators won't want to wait for the underlying issues to be solved and will instead opt for more aggressive identification. The worst case scenario is if the whole internet became like Facebook, requiring an account that's inextricably linked to your real identity just to view anything.
- archerx 2y ago
  > you can not block visitors to your site from major commercial VPN providers. You can if you can figure out their IP ranges. Some websites already do it and it is something I am looking into. Another thing worth doing is blocking TOR by getting the exit node ip address list. Blocking TOR has saved me a lot of grief from bad actors.
- Nextgrid 2y ago
  > The times where malicious software was served from a sketchy .ru domain or a naked IP address located at some bullet-proof hosting provider are long gone. The threat actors use the same infra as everyone else - GCP, AWS, Azure, Cloudflare, etc. I guess that's a consequence of law enforcement being completely unable or unwilling to actually tackle online crime (as long as it's not inconveniencing a large corporation in very specific domains such as copyright). Why bother with bulletproof/etc hosts or sketchy domain registrars when you can use a mainstream one and get away with it?
- halJordan 2y ago
  This is a great summation of why KYC is coming to cloud hosting.
edm0nd 2y ago
Crimeflare strikes again.
lacoolj 2y ago
My immediate internal spam/scam alarm goes off the moment I see "I hope this message finds you well"
jasongill 2y ago
For a long time, Cloudflare had a feature where you could "preview" custom CSS and HTML intended for use with their custom error pages. Basically, the preview feature just took CSS and HTML in a query string and then displayed it on cloudflarepreview.com/.... I reported it and showed how you could trivially create a page that said "Sign in to your Cloudflare account to get access to the Cloudflare beta preview!" and capture Cloudflare login credentials. The bug bounty was closed as they said it was "accepted as the nature of the cloudflarepreview playground". Then they fixed it by adding a JWT token to the URL (and no bounty paid). I've been a Cloudflare customer for a long time but it seems that there are many dark corners of their products that just don't get a lot of attention until they are abused, and I suspect this TryCloudflare thing is one of them.
dang 2y ago
[stub for offtopicness. title casing software begs forgiveness.]
- LoganDark 2y ago
  I thought this was a terrible pun about using tunnels to deliver rodents, not delivering remote access trojans. I don't know which I would have liked better
  - barryrandall 2y ago
    Rodent-over-IP would be a fascinating read.
    - CamelCaseName 2y ago
      Now everyone knows my YC 25 idea
      - cedws 2y ago
        It would never receive funding, viruses spread too quickly.
    - chatmasta 2y ago
      There’s actually a (really superb) Rust library/program for creating reverse tunnels over TCP, that’s called Rathole [0]. We used it [1] at my last startup and were mildly worried that one day we’d need to explain to a security auditor why we had a dependency called “rathole…” [0] https://github.com/rapiz1/rathole https://github.com/rapiz1/rathole [1] https://www.splitgraph.com/jumpstart/tunnel https://www.splitgraph.com/jumpstart/tunnel
    - deleted 2y ago
      [deleted]
- teddyh 2y ago
  Remote Access Trojans, not rodents.
rolph 2y ago
this reminds me of when those AOL free trial account disks were all over the place. in many circles an AOL subdomain would get instabanned
- mrinfinitiesx 2y ago
  Even the *.ipt.aol.com ban was needed because one AOLer would use the HOST.ipt.aol.com rdns to ban evade and ruin it for everybody. Prodigy / CompuServe / Blue Light gang checking in
  - julesallen 2y ago
    Prodigy, haven't thought about that in a lot of years, thanks for the memory tickle. Even with the painted-with-bricks interface. GEnie was another that was kind of fun. And I still can remember my CompuServe number!
PhilipRoman 2y ago
Getting a bit tired of these headlines about malware "delivery" via link shorteners or similar. Yeah, guess what - people can host files on the internet in various ways, what a shocker.
- __MatrixMan__ 2y ago
  I find it bonkers that we have settled on a design for browsers under which merely clicking a link is enough to expose you to a malware threat. It's like we received the good advice: > don't eat things you can't identify but somewhere along the way we got our wires crossed so now it's > don't look at things you can't identify But we're still acting like only an idiot would ever fail to adhere to this perfectly reasonable advice, when actually it's a recipe for having users with no idea what a real threat actually looks like. Much better would be if you can safely click all links (just don't, you know, run it or whatever the dangerous action is) so that you can annotate what you find there as either threatening or trustworthy--the better to help out your peers.
  - psd1 2y ago
    Well, hyperlinks, SMTP, browser scripting (less so): these things come from a time when the internet was a community, not a venue for crime. The first viruses were from clever under-socialised children. It was a playground and everyone was safe. Now we regret our naivety, but it's too late to take a systemic approach. It's all grandfathered in.
    - __MatrixMan__ 2y ago
      I think that sooner or later, the threats will become sophisticated enough to ungrandfather it.
- tw04 2y ago
  This isn't a link shortener - this is a tunnel so that a user sees they're connecting to cloud flare, even though on the back-end they are landing somewhere nefarious. The end-destination is completely hidden from the end-user (and any security stack their corporation may have in place). I don't think it's unreasonable for people to expect cloudflare to be policing their own service for malware when they're trying to pitch themselves as a security product.
xyst 2y ago
I wonder if those dreaded endpoint security programs (ie, ClownStrike) would have picked up on this type of attack. I guess this type of traffic would only get flagged if attackers were skids (ie, re-using known RATs)
- aio2 2y ago
  Clownstrike goes crazy
- fragmede 2y ago
  Picked up? You'd configure Crowdstrike to stop any random exe from running at all. Doesn't matter if the attacker's using a known bad exe or not.
lemax 2y ago
Isn't this what happens to every free quick tunnel product? Was kinda just waiting for this to play out. ngrok had nice zero friction tunneling when it came out but then they had to put everything behind a sign-up flow due to the same sort of abuse.
- ocdtrekkie 2y ago
  I would be disappointed in the attackers if it didn't. Free end-to-end encryption without any accountability tying it to a user? It's begging for abuse.
neodymiumphish 2y ago
I actually wrote about malicious use of this very tool a year ago[0] (almost to the day). The only thing new here seems to be what they’re doing through the tunnels, and the apparent success they’re having with this method for it to increase as a proportion of their overall attack techniques. TryCloudflare, IMO, is the real problem here. It doesn’t require an account at all, so attribution becomes nearly impossible. 0: https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/ https://www.guidepointsecurity.com/blog/tunnel-vision-cloudf...
anonym29 2y ago
Cloudflare has been infamous among sysadmins and threat hunters for over a decade [1,2] now for having an almost-nonexistent moderation program. Their services have been routinely abused by malicious actors for years [3,4,5,6,7] They've arguably been the single largest commercial provider for criminals globally over that time period, including non-tech criminals like drug traffickers and actual terrorists [8,9], to say nothing of aiding and abetting war criminals [10]. In fact, Cloudflare is actually the second largest DNS provider in the world by number of domains served. [11] They are in a position to log and analyze all of the traffic they decrypt, including all of the plaintext POST data, all of the cookies, all of the origin IPs, L7 payload sizes, and traffic timestamps for over 35 million websites. Their extensive history of indiscriminately offering "free" services to evildoers likely ties back to their true purpose, which Matthew Prince has admitted to [12], which is to sell all of those passwords, all of that PII, all of your privacy, not only to the US government, but also to other bidders. It is no exaggeration to say that anyone opposed to spam, phishing, malware, cybercrime, terrorism, war crimes, government surveillance dragnets, and infringements upon one's own digital privacy should have nothing but utter contempt for the soulless monsters responsible for this corporate atrocity. If you are as passionate about the subject as I am after reading some of these citations, I'd encourage you to boycott any websites using CF that you don't need to visit, and make plenty of phone calls to California senators, representatives, and the governor demanding that the state of California revoke Cloudflare's corporate charter and right to conduct business in the state. [1] https://www.malwarebytes.com/blog/news/2014/12/free-ssl-certificate-from-cloudflare-abused-in-phishing-scam https://www.malwarebytes.com/blog/news/2014/12/free-ssl-cert... [2] https://forum.spamcop.net/topic/14194-cloudflare-bulletproof-spammer-hosting/ https://forum.spamcop.net/topic/14194-cloudflare-bulletproof... [3] https://thehackernews.com/2023/08/cybercriminals-abusing-cloudflare-r2.html https://thehackernews.com/2023/08/cybercriminals-abusing-clo... [4] https://www.threatdown.com/blog/cloudflare-tunnel-increasingly-abused-by-cybercriminals/ https://www.threatdown.com/blog/cloudflare-tunnel-increasing... [5] https://any.run/cybersecurity-blog/clouflare-phishing-campaign/ https://any.run/cybersecurity-blog/clouflare-phishing-campai... [6] https://venturebeat.com/security/rogue-ad-network-site-likely-infected-thousands-of-users-still-operational/ https://venturebeat.com/security/rogue-ad-network-site-likel... [7] https://portswigger.net/daily-swig/cybercriminals-use-reverse-tunneling-and-url-shorteners-to-launch-virtually-undetectable-phishing-campaigns https://portswigger.net/daily-swig/cybercriminals-use-revers... [8] https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/overlapping-technologies-cybercriminals-and-terrorist-organizations https://www.trendmicro.com/vinfo/us/security/news/cybercrime... [9] https://cyberscoop.com/cloudflare-ipo-terrorism-narcotics/ https://cyberscoop.com/cloudflare-ipo-terrorism-narcotics/ [10] https://www.timesofisrael.com/us-firm-helps-hamas-netanyahu-keep-hackers-at-bay/ https://www.timesofisrael.com/us-firm-helps-hamas-netanyahu-... [11] https://bgp.he.net/report/tophosts https://bgp.he.net/report/tophosts [12] https://0xacab.org/blockedbyriseup/deCloudflare/-/raw/master/image/federalinterest.jpg https://0xacab.org/blockedbyriseup/deCloudflare/-/raw/master...
sebstefan 2y ago
If it isn's Cloudflare tunnels, it's gonna be asking google to translate some webpage you host with a payload in the URL or something This isn't news worthy
Terr_ 2y ago
When it comes to "nobody wants to spend enough money to do moderation and anti-abuse well", it makes me wonder: Whatever happened to early PGP-era ideas that we'd somehow establish new webs of distributed trust and distrust of online identities? I guess we sorta kinda have a little of that in the form of social-media accounts that get "trusted" based on the number of followers and their followers' followers and bots all the way down, etc. Or PageRank and SEO exploitation.
- tommek4077 2y ago
  Everyone who is capable of your suggestion is not dumb enough to install a trojan in the first place.
- stingraycharles 2y ago
  Society better figure something out soon, because with all these ultra realistic deepfakes coming up, we better have a way for people to establish whether the source is authentic or not.
  - rustcleaner 2y ago
    Nah, the ambiguity is exhilarating! :^)
deleted 2y ago
[deleted]

320 points by luu 2y ago

I guess this is why we can't have nice things on the internet (in this context, nice things from Cloudflare). Did you know you could send emails for free from Cloudflare (https://blog.cloudflare.com/sending-email-from-workers-with-mailchannels https://blog.cloudflare.com/sending-email-from-workers-with-...)? Well, now you couldn't. The sunsetting probably was not Clouldflare's fault, but it's more or less similar: nice service, abused.

peanut-walrus 2y ago

The times where malicious software was served from a sketchy .ru domain or a naked IP address located at some bullet-proof hosting provider are long gone. The threat actors use the same infra as everyone else - GCP, AWS, Azure, Cloudflare, etc. They also use the same VPNs for connecting to your machines as your grandparents do for watching Netflix. The internet as a whole is slowly but steadily moving towards a model where IP addresses and domain names are not useful indicators for security. You can not block your users from visiting Cloudflare or AWS IP ranges and you can not block visitors to your site from major commercial VPN providers. In addition, all the traffic is encrypted, name lookups are encrypted, so a network operator can not tell anything about what you are doing on the internet. This is a good thing for multiple reasons. First, it improves privacy and anonymity for the internet users. Second, reducing the effectiveness of network security solutions will make us be able to phase out their usage, which makes the network dumb again and prevents ossification. And third, it forces us to tackle the underlying security issues, rather than supporting a whole industry of ineffective whack-a-mole.

deleted 2y ago
[deleted]
entropie 2y ago
> You can not block your users from visiting Cloudflare or AWS IP ranges Iam pretty sure reddit does. I recently needed to rewrite/patch my tumblog backend software that uses yt-dlp to download reddit videos because reddit blocked the ip ranges of hetzners dedicated servers. I circumvented this by downloading the videos on the client via javascript and upload it to my server.
skeaker 2y ago
The potential downside in my eyes is that regulators won't want to wait for the underlying issues to be solved and will instead opt for more aggressive identification. The worst case scenario is if the whole internet became like Facebook, requiring an account that's inextricably linked to your real identity just to view anything.
archerx 2y ago
> you can not block visitors to your site from major commercial VPN providers. You can if you can figure out their IP ranges. Some websites already do it and it is something I am looking into. Another thing worth doing is blocking TOR by getting the exit node ip address list. Blocking TOR has saved me a lot of grief from bad actors.
Nextgrid 2y ago
> The times where malicious software was served from a sketchy .ru domain or a naked IP address located at some bullet-proof hosting provider are long gone. The threat actors use the same infra as everyone else - GCP, AWS, Azure, Cloudflare, etc. I guess that's a consequence of law enforcement being completely unable or unwilling to actually tackle online crime (as long as it's not inconveniencing a large corporation in very specific domains such as copyright). Why bother with bulletproof/etc hosts or sketchy domain registrars when you can use a mainstream one and get away with it?
halJordan 2y ago
This is a great summation of why KYC is coming to cloud hosting.

edm0nd 2y ago

Crimeflare strikes again.

lacoolj 2y ago

My immediate internal spam/scam alarm goes off the moment I see "I hope this message finds you well"

jasongill 2y ago

For a long time, Cloudflare had a feature where you could "preview" custom CSS and HTML intended for use with their custom error pages. Basically, the preview feature just took CSS and HTML in a query string and then displayed it on cloudflarepreview.com/.... I reported it and showed how you could trivially create a page that said "Sign in to your Cloudflare account to get access to the Cloudflare beta preview!" and capture Cloudflare login credentials. The bug bounty was closed as they said it was "accepted as the nature of the cloudflarepreview playground". Then they fixed it by adding a JWT token to the URL (and no bounty paid). I've been a Cloudflare customer for a long time but it seems that there are many dark corners of their products that just don't get a lot of attention until they are abused, and I suspect this TryCloudflare thing is one of them.

dang 2y ago

[stub for offtopicness. title casing software begs forgiveness.]

LoganDark 2y ago
I thought this was a terrible pun about using tunnels to deliver rodents, not delivering remote access trojans. I don't know which I would have liked better
- barryrandall 2y ago
  Rodent-over-IP would be a fascinating read.
  - CamelCaseName 2y ago
    Now everyone knows my YC 25 idea
    - cedws 2y ago
      It would never receive funding, viruses spread too quickly.
  - chatmasta 2y ago
    There’s actually a (really superb) Rust library/program for creating reverse tunnels over TCP, that’s called Rathole [0]. We used it [1] at my last startup and were mildly worried that one day we’d need to explain to a security auditor why we had a dependency called “rathole…” [0] https://github.com/rapiz1/rathole https://github.com/rapiz1/rathole [1] https://www.splitgraph.com/jumpstart/tunnel https://www.splitgraph.com/jumpstart/tunnel
  - deleted 2y ago
    [deleted]
teddyh 2y ago
Remote Access Trojans, not rodents.

rolph 2y ago

this reminds me of when those AOL free trial account disks were all over the place. in many circles an AOL subdomain would get instabanned

mrinfinitiesx 2y ago
Even the *.ipt.aol.com ban was needed because one AOLer would use the HOST.ipt.aol.com rdns to ban evade and ruin it for everybody. Prodigy / CompuServe / Blue Light gang checking in
- julesallen 2y ago
  Prodigy, haven't thought about that in a lot of years, thanks for the memory tickle. Even with the painted-with-bricks interface. GEnie was another that was kind of fun. And I still can remember my CompuServe number!

PhilipRoman 2y ago

Getting a bit tired of these headlines about malware "delivery" via link shorteners or similar. Yeah, guess what - people can host files on the internet in various ways, what a shocker.

__MatrixMan__ 2y ago
I find it bonkers that we have settled on a design for browsers under which merely clicking a link is enough to expose you to a malware threat. It's like we received the good advice: > don't eat things you can't identify but somewhere along the way we got our wires crossed so now it's > don't look at things you can't identify But we're still acting like only an idiot would ever fail to adhere to this perfectly reasonable advice, when actually it's a recipe for having users with no idea what a real threat actually looks like. Much better would be if you can safely click all links (just don't, you know, run it or whatever the dangerous action is) so that you can annotate what you find there as either threatening or trustworthy--the better to help out your peers.
- psd1 2y ago
  Well, hyperlinks, SMTP, browser scripting (less so): these things come from a time when the internet was a community, not a venue for crime. The first viruses were from clever under-socialised children. It was a playground and everyone was safe. Now we regret our naivety, but it's too late to take a systemic approach. It's all grandfathered in.
  - __MatrixMan__ 2y ago
    I think that sooner or later, the threats will become sophisticated enough to ungrandfather it.
tw04 2y ago
This isn't a link shortener - this is a tunnel so that a user sees they're connecting to cloud flare, even though on the back-end they are landing somewhere nefarious. The end-destination is completely hidden from the end-user (and any security stack their corporation may have in place). I don't think it's unreasonable for people to expect cloudflare to be policing their own service for malware when they're trying to pitch themselves as a security product.

xyst 2y ago

I wonder if those dreaded endpoint security programs (ie, ClownStrike) would have picked up on this type of attack. I guess this type of traffic would only get flagged if attackers were skids (ie, re-using known RATs)

aio2 2y ago
Clownstrike goes crazy
fragmede 2y ago
Picked up? You'd configure Crowdstrike to stop any random exe from running at all. Doesn't matter if the attacker's using a known bad exe or not.

lemax 2y ago

Isn't this what happens to every free quick tunnel product? Was kinda just waiting for this to play out. ngrok had nice zero friction tunneling when it came out but then they had to put everything behind a sign-up flow due to the same sort of abuse.

ocdtrekkie 2y ago
I would be disappointed in the attackers if it didn't. Free end-to-end encryption without any accountability tying it to a user? It's begging for abuse.

neodymiumphish 2y ago

I actually wrote about malicious use of this very tool a year ago[0] (almost to the day). The only thing new here seems to be what they’re doing through the tunnels, and the apparent success they’re having with this method for it to increase as a proportion of their overall attack techniques. TryCloudflare, IMO, is the real problem here. It doesn’t require an account at all, so attribution becomes nearly impossible. 0: https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/ https://www.guidepointsecurity.com/blog/tunnel-vision-cloudf...

anonym29 2y ago

Cloudflare has been infamous among sysadmins and threat hunters for over a decade [1,2] now for having an almost-nonexistent moderation program. Their services have been routinely abused by malicious actors for years [3,4,5,6,7] They've arguably been the single largest commercial provider for criminals globally over that time period, including non-tech criminals like drug traffickers and actual terrorists [8,9], to say nothing of aiding and abetting war criminals [10]. In fact, Cloudflare is actually the second largest DNS provider in the world by number of domains served. [11] They are in a position to log and analyze all of the traffic they decrypt, including all of the plaintext POST data, all of the cookies, all of the origin IPs, L7 payload sizes, and traffic timestamps for over 35 million websites. Their extensive history of indiscriminately offering "free" services to evildoers likely ties back to their true purpose, which Matthew Prince has admitted to [12], which is to sell all of those passwords, all of that PII, all of your privacy, not only to the US government, but also to other bidders. It is no exaggeration to say that anyone opposed to spam, phishing, malware, cybercrime, terrorism, war crimes, government surveillance dragnets, and infringements upon one's own digital privacy should have nothing but utter contempt for the soulless monsters responsible for this corporate atrocity. If you are as passionate about the subject as I am after reading some of these citations, I'd encourage you to boycott any websites using CF that you don't need to visit, and make plenty of phone calls to California senators, representatives, and the governor demanding that the state of California revoke Cloudflare's corporate charter and right to conduct business in the state. [1] https://www.malwarebytes.com/blog/news/2014/12/free-ssl-certificate-from-cloudflare-abused-in-phishing-scam https://www.malwarebytes.com/blog/news/2014/12/free-ssl-cert... [2] https://forum.spamcop.net/topic/14194-cloudflare-bulletproof-spammer-hosting/ https://forum.spamcop.net/topic/14194-cloudflare-bulletproof... [3] https://thehackernews.com/2023/08/cybercriminals-abusing-cloudflare-r2.html https://thehackernews.com/2023/08/cybercriminals-abusing-clo... [4] https://www.threatdown.com/blog/cloudflare-tunnel-increasingly-abused-by-cybercriminals/ https://www.threatdown.com/blog/cloudflare-tunnel-increasing... [5] https://any.run/cybersecurity-blog/clouflare-phishing-campaign/ https://any.run/cybersecurity-blog/clouflare-phishing-campai... [6] https://venturebeat.com/security/rogue-ad-network-site-likely-infected-thousands-of-users-still-operational/ https://venturebeat.com/security/rogue-ad-network-site-likel... [7] https://portswigger.net/daily-swig/cybercriminals-use-reverse-tunneling-and-url-shorteners-to-launch-virtually-undetectable-phishing-campaigns https://portswigger.net/daily-swig/cybercriminals-use-revers... [8] https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/overlapping-technologies-cybercriminals-and-terrorist-organizations https://www.trendmicro.com/vinfo/us/security/news/cybercrime... [9] https://cyberscoop.com/cloudflare-ipo-terrorism-narcotics/ https://cyberscoop.com/cloudflare-ipo-terrorism-narcotics/ [10] https://www.timesofisrael.com/us-firm-helps-hamas-netanyahu-keep-hackers-at-bay/ https://www.timesofisrael.com/us-firm-helps-hamas-netanyahu-... [11] https://bgp.he.net/report/tophosts https://bgp.he.net/report/tophosts [12] https://0xacab.org/blockedbyriseup/deCloudflare/-/raw/master/image/federalinterest.jpg https://0xacab.org/blockedbyriseup/deCloudflare/-/raw/master...

sebstefan 2y ago

If it isn's Cloudflare tunnels, it's gonna be asking google to translate some webpage you host with a payload in the URL or something This isn't news worthy

Terr_ 2y ago

When it comes to "nobody wants to spend enough money to do moderation and anti-abuse well", it makes me wonder: Whatever happened to early PGP-era ideas that we'd somehow establish new webs of distributed trust and distrust of online identities? I guess we sorta kinda have a little of that in the form of social-media accounts that get "trusted" based on the number of followers and their followers' followers and bots all the way down, etc. Or PageRank and SEO exploitation.

tommek4077 2y ago
Everyone who is capable of your suggestion is not dumb enough to install a trojan in the first place.
stingraycharles 2y ago
Society better figure something out soon, because with all these ultra realistic deepfakes coming up, we better have a way for people to establish whether the source is authentic or not.
- rustcleaner 2y ago
  Nah, the ambiguity is exhilarating! :^)

deleted 2y ago

[deleted]