Hacker News Reader

Comment by dang | Hacker News Reader

[stub for offtopicness. title casing software begs forgiveness.]

Original title was "Threat Actor Abuses Cloudflare Tunnels to Deliver Rats", and even if I knew about malware through Cloudflare tunnels, it got my hopes too high.

I thought this was a terrible pun about using tunnels to deliver rodents, not delivering remote access trojans. I don't know which I would have liked better

Rodent-over-IP would be a fascinating read.

Now everyone knows my YC 25 idea

It would never receive funding, viruses spread too quickly.

There’s actually a (really superb) Rust library/program for creating reverse tunnels over TCP, that’s called Rathole [0]. We used it [1] at my last startup and were mildly worried that one day we’d need to explain to a security auditor why we had a dependency called “rathole…”

[0] https://github.com/rapiz1/rathole

[1] https://www.splitgraph.com/jumpstart/tunnel

[flagged]

If history is any indication you can probably keep having the nice thing, because CF tends to look the other way when bad actors abuse their infrastructure.

oh really? according to who? and for what business purpose?

Of the 10 highest ranked "stresser" (DDoS-for-hire) services on DuckDuckGo right now, 9 of them are using Cloudflare.

jetstress.net - Cloudflare

maxstresser.com - Cloudflare

neostress.cc - Cloudflare

quezstresser.ru - Cloudflare

rawstresser.net - Cloudflare

stresse.net - Cloudflare

stresser.su - Cloudflare

stresser.zone - Cloudflare

stresserst.su - DDoSGuard

sunnystresser.com - Cloudflare

I could keep going but you get the point. This has been ongoing for years and they consistently ignore abuse reports.

Given that CFs bread and butter is selling DDoS mitigation this is a blatant conflict of interest.

Is the problem that the stressor services don't have robust KYC?

Legit load testing services like loader.io require you to prove you own the site you are targeting, yes. "Stressers" let you point their orbital laser at whatever you want, they might say it's only meant for use against your own servers but that's just an ass-covering pretense.

Sure. But that's what I'm asking. Why blame Cloudflare rather than the companies themselves?

DDoS providers and other for-profit miscreants are incentivized to DDoS each other into oblivion, and Cloudflare is the only one of the giant mitigation providers who are willing to protect them from their competition. There are bulletproof alternatives like DDoSGuard but their network is absolutely nowhere near as expansive as CFs is, nor is it free to use, nor do they have enough legit customers to rule out blocking their entire ASN in a corporate filewall to stop phishing attacks. CFs share of the blame is for making bad actors lives much easier than it should be.

I feel like the portion of blame for stopping criminals from attacking each other is pretty low.

That would imply that those services have legitimate use cases. Most of them don't, and they're well aware of it.

> Given that CFs bread and butter is selling DDoS mitigation this is a blatant conflict of interest.

There is no conflict when the goal is making money. They'll be glad to look the other way.

https://arstechnica.com/security/2024/07/cloudflare-once-aga...

Search for "stress tester" and almost every ddos-for-hire site you find will be protected by Cloudflare.

so report them? this is like complaining that their domains are registered by GoDaddy, or their packets are delivered through the Internet by hurricane electric, or their local power company keeps their lights on

From what I've heard, if you send an abuse report to Cloudflare they just forward it to the owner of the service you are reporting, without redacting any personal information you provided, opening you up to reprisal. They won't actually do anything unless legally mandated to.

>They won't actually do anything unless legally mandated to.

This is a good thing, and pretty refreshing compared to the kafka-esque scenarios that Google and others offer when shutting down entire businesses based on the whims of some blackbox AI detection system or fraudulent DMCA notice.

The more DDoS there are, the more business CF gets. Take your own conclusions…

Cloudflare has been in front of _every_ phishing site targeting my org for the past year. Their response to reports is always "we're just a pass through, not our problem". The attackers know that CF won't take action against them, and that using CF will slow down any response or takedown request.

Unless CF is actually hosting the site, which is rare, the most they can do is no longer act as pass through. In which case, your problem isn't actually solved, they just move to another provider who offers similar.

You instead want to be talking to browser and search engine providers and reporting there, as well as your government for illegal activities.

They aren't a passthrough, though. That wouldn't be a valuable service. They're providing a service to criminals that assists them in fraud, and refusing to take any action when notified. It adds hours or days to a takedown process. It's like they're standing outside the mall handing the bike thieves branded hacksaws.

We've had better luck getting random Moldovan ISPs to shut down service than we've had in getting CloudFlare to give a damn.

They are quite literally a MITM passthrough. The example you used doesn't make any sense either, it would be more like them handing everyone hacksaws and you getting mad at them over the fact some people are using them for bad things.

Again, get a court order and they'll take action. They are legally required to. Random Moldovan ISPs don't operate at the scale CF does, no wonder they were faster. Probably also easier to bribe as well ;)

The fact that they block some people from accessing the websites behind their service negates their claims to be "just a passthrough"…

Okay, their main service is a passthrough with a sprinkle of blocking on top.

GGP is asking for more blocking, so I don't think they mind that particular reason.

> Unless CF is actually hosting the site, which is rare, the most they can do is no longer act as pass through. In which case, your problem isn't actually solved, they just move to another provider who offers similar.

Well, if at least the Big Five (CF, Akamai, AWS, GCP, Azure) could get their shit together and cooperate against the bad actors, using netblocks against hostile IP ranges (both egress and ingress) could start making sense again.

I find that the domain registrar takes action more often than not (I guess because they're bound to ICANN's regulations), then the moment the domain is stopped Cloudflare sends an automated e-mail saying that they don't host the website because the DNS records stopped resolving.

Good. It should require a court order to take someone offline.

I think we both know that bad actors can spin up new Cloudflare accounts a few order of magnitudes faster than the courts can take action against just one.

It's not much of an ask to at least keep DDoS providers out, even from a free speech absolutist position it's a stretch to say that DDoS should be protected speech.

I think the suggestion in the parent comment leaves room for a court order that bars providing service to certain individuals/organizations.

That would require Cloudflare to have a KYC policy which exposes the individual/organization behind an account, and they don't do that either.

If DDoS4U gets banned they can just rebrand as DDoS4Less and CF is (willingly?) none the wiser that it's the same people behind it.

Malicious actors could spin up new accounts whether or not CF bans malicious accounts without a court order. Requiring a court order would have no bearing on CF's ability to prevent duplicate accounts.

KYC := know your customer

aka get their real id

That sort of court order would end this entire product feature. You can't have accountless tunnels if you have to be able to bar specific individuals or organizations.

DDoS isn't protected by Cloudflare and is already illegal, hence the court orders which get them to act.

What you are asking for is KYC to be implemented.

Is that so unreasonable? If I agree to forward someone's mail you would probably expect me to do some basic sanity checks in order to establish whether I am likely to be forwarding IRS documentation or anthrax. Why does the internet always get a pass on established societal norms?

Depends on if you're ok with the tradeoffs of KYC as they require comprehensive identity verification, and depending on service changes to structure to adhere to a per-person account model.

court order by who?

I have to provide services to anyone with money?

Ironically, Cloudflare removed DDoS protection from KiwiFarms without a court order due to a political pressure campaign.

Just don’t piss off Prince or {current_cf_ceo}, and you will be fine [1]

[1] https://www.businessinsider.com/the-daily-stormer-got-pushed...

Counter argument and hear me out please.

Just because a few bad actors cause harm shouldn't mean everyone should be losing rights and giving up bits of their freedom because someone ruined it for everyone else.

Didn't matter what it is: weapons, or fireworks, or even the right to code. Sacrifice of everyone's rights and freedom to choose all in the name of reducing the odds of something happening seems odd. The very regulation of what someone can and can not do, while it might theoretically reduce risk (an argument for correlation not causation exists here) can't possibly oughtweigh the fact your restricting people free will and autonomy. The constant regulation and restriction of thing is our life only stifle innovation, act as barriers to entry, and force the creativity out of peoples lives.

I call it optimizing for the corner cases.

Remote Access Trojans, not rodents.

Original title has “RATs”, but that seemed to have gotten edited/autocorrected away when it got to HN. Because, damn, that’s a hack I want to read about.

I was really eager to see how they delivered rodents via Cloudflare, but my hopes were dashed.

Reply on news.ycombinator.com