Hackers increasingly abuse Cloudflare Tunnels for stealthy connections

bleepingcomputer.com

21 points·momirlan··6 comments

> Furthermore, as Cloudflare Tunnel requires the installation of the 'cloudflared' client, defenders can detect its use by monitoring file hashes associated with client releases.

Is this effective? Presumably attackers could `go build` their own binaries to get equivalent clients with different hashes, or even combine the open-source `cloudflared` internals with a larger payload.

That's definitely true. What we saw in the instances we've observed were the legit binaries from Cloudflared directly. It's definitely possible for them to build their own varients to avoid basic hash detection, or to implement alternative connectivity instead of routing to Cloudflared infrastructure over 7844.

Comments from a similar article posted yesterday: https://news.ycombinator.com/item?id=37023806

I'm the author of the source blog. Happy to answer any questions about the research I conducted on this! Was a fun project to run through and discover additional attack vectors!

Is Cloudflare Tunnel just another overlay network like Tor?

“Cloudflare Tunnel” is not a network onto itself but an ngrok-like product of Cloudflare, using the Cloudflare network — which yes, is just a GRE overlay and not a _real network_ per se.

Reply on news.ycombinator.com