8 ms·

Getting a bit tired of these headlines about malware "delivery" via link shorteners or similar. Yeah, guess what - people can host files on the internet in vari

Getting a bit tired of these headlines about malware "delivery" via link shorteners or similar. Yeah, guess what - people can host files on the internet in various ways, what a shocker.

__MatrixMan__ 2y ago
I find it bonkers that we have settled on a design for browsers under which merely clicking a link is enough to expose you to a malware threat. It's like we received the good advice: > don't eat things you can't identify but somewhere along the way we got our wires crossed so now it's > don't look at things you can't identify But we're still acting like only an idiot would ever fail to adhere to this perfectly reasonable advice, when actually it's a recipe for having users with no idea what a real threat actually looks like. Much better would be if you can safely click all links (just don't, you know, run it or whatever the dangerous action is) so that you can annotate what you find there as either threatening or trustworthy--the better to help out your peers.
- psd1 2y ago
  Well, hyperlinks, SMTP, browser scripting (less so): these things come from a time when the internet was a community, not a venue for crime. The first viruses were from clever under-socialised children. It was a playground and everyone was safe. Now we regret our naivety, but it's too late to take a systemic approach. It's all grandfathered in.
  - __MatrixMan__ 2y ago
    I think that sooner or later, the threats will become sophisticated enough to ungrandfather it.
tw04 2y ago
This isn't a link shortener - this is a tunnel so that a user sees they're connecting to cloud flare, even though on the back-end they are landing somewhere nefarious. The end-destination is completely hidden from the end-user (and any security stack their corporation may have in place). I don't think it's unreasonable for people to expect cloudflare to be policing their own service for malware when they're trying to pitch themselves as a security product.
- adolph 2y ago
  > The end-destination is completely hidden from the end-user a proxy server is a server application that acts as an intermediary between a client requesting a resource and the server providing that resource. https://en.wikipedia.org/wiki/Proxy_server https://en.wikipedia.org/wiki/Proxy_server
- marcosdumay 2y ago
  That's mildly valid. We can have some expectations for Cloudfare, but not that they outright police everybody that uses their service. At the same time, this is exactly some variation of the "random people have put malware on random internet locations" scare the GP was talking about. If "malware somewhere on the internet" is a problem, we have to fix what turns it into a problem, because we just won't fix this one.
  - compootr 2y ago
    > but not that they outright police everybody that uses their service. Same. I think they're getting too big to care, or even to attempt to do so.
    - ThatMedicIsASpy 2y ago
      There must be millions of piracy websites using them. Care was never there.
  - tempest_ 2y ago
    Why should they not be responsible for the things they allow on their service? (note that I don't necessarily agree but that statement is loaded)
    - valand 2y ago
      Must or mustn't they filter customers is a matter of law. However, putting the responsibility to mitigate this problem in its entirety is very inefficient and ineffective. If Cloudflare would have a team dedicated for this effort, bad actors would simply switch providers, beating $200k/year effort by couple clicks. Notice that the malware ultimately takes effect when the user executes the file. This sounds more like an interaction design problem that should be solved in the OS level; the OS interface is one of the logistical bottleneck for the malware delivery path.
valand 2y ago
At this point --- and speaking for non power-user --- this should be an OS interaction design problem. Framing cloudflare as the enabler is missing the bigger picture. I remember back in the day I needed to turn off autoplay on Windows to not get accidentally infected by malicious drives. No one was insane enough to blame the CD-RW and flash drive manufacturers.
- autoexec 2y ago
  > No one was insane enough to blame the CD-RW and flash drive manufacturers. cloudflare isn't acting like a CD-RW or a flash drive. They're acting like a storefront that sells fraudulent flash drives that say they're 1TB when they're actually 200MB, or don't work at all when you plug it in, or worse catch fire. A storefront that refuses to take the faulty products off the shelves when customers complain, refuses to stop selling merchandise they sourced from criminals, and refuses to do even basic due diligence to make sure the products they sell are legitimate. People who operate stores have a responsibility to make sure that merchandise they sell to consumers isn't fraudulent and harmful. Companies offering their services online also have a responsibility to make sure that those services aren't being used to push fraudulent and harmful content onto consumers and that they aren't acting as safe-havens for criminals.
  - valand 2y ago
    Aside from process host and protocol, what makes it different from, let's say publicly available google drive?
    - psd1 2y ago
      I can, as a google admin, block links from outside the org; or, as a non-google admin, block google docs. The business may decide not to block, but if I have good SIEM then I can still do something, possibly inspect the file before it hits the user's desktop. I can't block cloudflare, unless I'm willing to block half the internet. If I try to do additional inspection, I've got huge amounts of noise and I'm going to make the internet unusably slow.
    - 2y ago
RockRobotRock 2y ago
It would be nice if Cloudflare tried a bit harder to respond to abuse reports. I don't think they've ever acted when I've reported obvious phishing and malware hosting to them.
- jeroenhd 2y ago
  I don't think I've ever seen an abuse report to anyone have a direct consequence. Phishing URLs I've reported never get added to any phishing lists, malware reports seem to go to /dev/null, and reporting spammers to their hosting services/registrars only seems to increase the amount of spam received. Cloudflare should do better, but so should the entire industry. I get why companies selling security software report on this stuff, but this stuff is just a consequence of the internet allowing inbound connections sometimes. The takeaway from this isn't "Cloudflare bad", but "block trycloudflare.com in your DNS server unless your devs use it for some reason". Same with Ngrok and any other dev tool like that.

Getting a bit tired of these headlines about malware "delivery" via link shorteners or similar. Yeah, guess what - people can host files on the internet in various ways, what a shocker.

__MatrixMan__ 2y ago

I find it bonkers that we have settled on a design for browsers under which merely clicking a link is enough to expose you to a malware threat. It's like we received the good advice: > don't eat things you can't identify but somewhere along the way we got our wires crossed so now it's > don't look at things you can't identify But we're still acting like only an idiot would ever fail to adhere to this perfectly reasonable advice, when actually it's a recipe for having users with no idea what a real threat actually looks like. Much better would be if you can safely click all links (just don't, you know, run it or whatever the dangerous action is) so that you can annotate what you find there as either threatening or trustworthy--the better to help out your peers.

psd1 2y ago
Well, hyperlinks, SMTP, browser scripting (less so): these things come from a time when the internet was a community, not a venue for crime. The first viruses were from clever under-socialised children. It was a playground and everyone was safe. Now we regret our naivety, but it's too late to take a systemic approach. It's all grandfathered in.
- __MatrixMan__ 2y ago
  I think that sooner or later, the threats will become sophisticated enough to ungrandfather it.

tw04 2y ago

This isn't a link shortener - this is a tunnel so that a user sees they're connecting to cloud flare, even though on the back-end they are landing somewhere nefarious. The end-destination is completely hidden from the end-user (and any security stack their corporation may have in place). I don't think it's unreasonable for people to expect cloudflare to be policing their own service for malware when they're trying to pitch themselves as a security product.

adolph 2y ago
> The end-destination is completely hidden from the end-user a proxy server is a server application that acts as an intermediary between a client requesting a resource and the server providing that resource. https://en.wikipedia.org/wiki/Proxy_server https://en.wikipedia.org/wiki/Proxy_server
marcosdumay 2y ago
That's mildly valid. We can have some expectations for Cloudfare, but not that they outright police everybody that uses their service. At the same time, this is exactly some variation of the "random people have put malware on random internet locations" scare the GP was talking about. If "malware somewhere on the internet" is a problem, we have to fix what turns it into a problem, because we just won't fix this one.
- compootr 2y ago
  > but not that they outright police everybody that uses their service. Same. I think they're getting too big to care, or even to attempt to do so.
  - ThatMedicIsASpy 2y ago
    There must be millions of piracy websites using them. Care was never there.
- tempest_ 2y ago
  Why should they not be responsible for the things they allow on their service? (note that I don't necessarily agree but that statement is loaded)
  - valand 2y ago
    Must or mustn't they filter customers is a matter of law. However, putting the responsibility to mitigate this problem in its entirety is very inefficient and ineffective. If Cloudflare would have a team dedicated for this effort, bad actors would simply switch providers, beating $200k/year effort by couple clicks. Notice that the malware ultimately takes effect when the user executes the file. This sounds more like an interaction design problem that should be solved in the OS level; the OS interface is one of the logistical bottleneck for the malware delivery path.

valand 2y ago

At this point --- and speaking for non power-user --- this should be an OS interaction design problem. Framing cloudflare as the enabler is missing the bigger picture. I remember back in the day I needed to turn off autoplay on Windows to not get accidentally infected by malicious drives. No one was insane enough to blame the CD-RW and flash drive manufacturers.

autoexec 2y ago
> No one was insane enough to blame the CD-RW and flash drive manufacturers. cloudflare isn't acting like a CD-RW or a flash drive. They're acting like a storefront that sells fraudulent flash drives that say they're 1TB when they're actually 200MB, or don't work at all when you plug it in, or worse catch fire. A storefront that refuses to take the faulty products off the shelves when customers complain, refuses to stop selling merchandise they sourced from criminals, and refuses to do even basic due diligence to make sure the products they sell are legitimate. People who operate stores have a responsibility to make sure that merchandise they sell to consumers isn't fraudulent and harmful. Companies offering their services online also have a responsibility to make sure that those services aren't being used to push fraudulent and harmful content onto consumers and that they aren't acting as safe-havens for criminals.
- valand 2y ago
  Aside from process host and protocol, what makes it different from, let's say publicly available google drive?
  - psd1 2y ago
    I can, as a google admin, block links from outside the org; or, as a non-google admin, block google docs. The business may decide not to block, but if I have good SIEM then I can still do something, possibly inspect the file before it hits the user's desktop. I can't block cloudflare, unless I'm willing to block half the internet. If I try to do additional inspection, I've got huge amounts of noise and I'm going to make the internet unusably slow.
  - 2y ago

RockRobotRock 2y ago

It would be nice if Cloudflare tried a bit harder to respond to abuse reports. I don't think they've ever acted when I've reported obvious phishing and malware hosting to them.

jeroenhd 2y ago
I don't think I've ever seen an abuse report to anyone have a direct consequence. Phishing URLs I've reported never get added to any phishing lists, malware reports seem to go to /dev/null, and reporting spammers to their hosting services/registrars only seems to increase the amount of spam received. Cloudflare should do better, but so should the entire industry. I get why companies selling security software report on this stuff, but this stuff is just a consequence of the internet allowing inbound connections sometimes. The takeaway from this isn't "Cloudflare bad", but "block trycloudflare.com in your DNS server unless your devs use it for some reason". Same with Ngrok and any other dev tool like that.