3 ms·
There’s an assumption that turning on Cloudflare’s “under attack” mode would mitigate the attack. Given how adaptive the rest of the attack was, I would be ver
by fn-mote 1mo ago
There’s an assumption that turning on Cloudflare’s “under attack” mode would mitigate the attack.
Given how adaptive the rest of the attack was, I would be very curious to find out how it would approach that obstacle.
- Symbiote 1mo agoThat has only partially mitigated much smaller attacks (residential proxy scraping etc) on my employer's site. We're currently on the "Business" plan, but I'm coming to the conclusion that we need to upgrade to the "Enterprise Advantage" plan for the JA3/4 fingerprinting and detection ID features. I get put off by "Contact Sales" pricing.
- davidfischer 1mo agoHere's my take: * JA3s are mostly useless. JA4s supersede them entirely. * Using JA4s in rate limits is pretty useful and helps a lot against proxy scraping. It was not very helpful in this attack. * Bot detections are somewhat helpful but they don't solve scrapers/attacks by themselves. They're useful as a 2nd/3rd data point (eg. low bot score + bot detection + something else)
- cute_boi 1mo agoisn't JA4 also useless because it is so easy to spoof tls. For eg. cycletls for nodejs etc..
- davidfischer 1mo agoIt will probably be useless one day. In practice, it is still useful today though not for this attack.
- johneth 1mo agoThere's also the JA4+ suite (https://github.com/FoxIO-LLC/ja4 https://github.com/FoxIO-LLC/ja4), in addition to standard JA4.
- arbol 1mo agoYep curl cffi accurately spoofs JA4 for chrome. You need to detect client side as well.
- davidfischer 1mo agoMy assumption would be that it would drastically reduce the attack to be borderline irrelevant. I've never turned on Under Attack so somebody else may have more insight and the docs[1] don't describe precisely what happens besides a JS interstitial. I know that JS challenges, both interactive and non-interactive, can be solved by bots. I've seen it. However, I suspect that the challenges just get harder and harder until the attack levels drop. [1] https://developers.cloudflare.com/fundamentals/reference/under-attack-mode/ https://developers.cloudflare.com/fundamentals/reference/und...
- gruez 1mo agoIt changes the economics of the attack because it requires the attacker to do compute before they can make requests. Depending on how good the fingerprinting is, it can also get very expensive (eg. requiring you to run a full browser, rather than merely computing a few sha256 hashes)
- LtWorf 1mo agoI see Cloudflare's in the business of selling "protection"
- mitxela 1mo agoCloudflare protects many ddos sites from each other's attacks