Threat actor abuses Cloudflare tunnels to deliver remote access trojans

That's mildly valid. We can have some expectations for Cloudfare, but not that they outright police everybody that uses their service.

At the same time, this is exactly some variation of the "random people have put malware on random internet locations" scare the GP was talking about. If "malware somewhere on the internet" is a problem, we have to fix what turns it into a problem, because we just won't fix this one.

How is that different from…any website, storage service or hosting provider on the internet?

and any security stack their corporation may have in place

I mean if the security stack misses that (forgivable) but then allows this:

When executed, it establishes a connection to an external file share, typically via WebDAV, to download an LNK or VBS file. When executed, the LNK/VBS executes a BAT or CMD file

It fucking sucks.

Only technical users recognize the name Cloudflare, and they know it’s a hosting service. This concern seems ridiculous to me.

oh no a tunneling service is used for tunneling /s

user sees they're connecting to cloud flare

I see am connecting to Comcast, it says so right on my modem.

DNS filtering, WAFs and curated naughty lists were never more than duct tape at best. I'm sure they are effective, but they don't approach the problem of vulnerable software or end users who download and execute untrusted software. At worst, they created an incentive for alarmist companies to scare users into using their half measures rather than comprehensively addressing the problem.

I don't think it's unreasonable for people to expect cloudflare to be policing their own service for malware when they're trying to pitch themselves as a security product.

But you're not the customer, you're the consumer.

Are they pitching themselves as safer for the consumer?

The end-destination is completely hidden from the end-user

a proxy server is a server application that acts as an intermediary between a client requesting a resource and the server providing that resource.

https://en.wikipedia.org/wiki/Proxy_server

I don't think it's unreasonable for people to expect cloudflare to be policing their own service

On the contrary. The tendency of those expectations turning into assumptions is the wider issue.

No one was insane enough to blame the CD-RW and flash drive manufacturers.

cloudflare isn't acting like a CD-RW or a flash drive. They're acting like a storefront that sells fraudulent flash drives that say they're 1TB when they're actually 200MB, or don't work at all when you plug it in, or worse catch fire. A storefront that refuses to take the faulty products off the shelves when customers complain, refuses to stop selling merchandise they sourced from criminals, and refuses to do even basic due diligence to make sure the products they sell are legitimate.

People who operate stores have a responsibility to make sure that merchandise they sell to consumers isn't fraudulent and harmful. Companies offering their services online also have a responsibility to make sure that those services aren't being used to push fraudulent and harmful content onto consumers and that they aren't acting as safe-havens for criminals.

Well, hyperlinks, SMTP, browser scripting (less so): these things come from a time when the internet was a community, not a venue for crime. The first viruses were from clever under-socialised children. It was a playground and everyone was safe.

Now we regret our naivety, but it's too late to take a systemic approach. It's all grandfathered in.

I don't think I've ever seen an abuse report to anyone have a direct consequence. Phishing URLs I've reported never get added to any phishing lists, malware reports seem to go to /dev/null, and reporting spammers to their hosting services/registrars only seems to increase the amount of spam received.

Cloudflare should do better, but so should the entire industry. I get why companies selling security software report on this stuff, but this stuff is just a consequence of the internet allowing inbound connections sometimes.

The takeaway from this isn't "Cloudflare bad", but "block trycloudflare.com in your DNS server unless your devs use it for some reason". Same with Ngrok and any other dev tool like that.

If history is any indication you can probably keep having the nice thing, because CF tends to look the other way when bad actors abuse their infrastructure.

Counter argument and hear me out please.

Just because a few bad actors cause harm shouldn't mean everyone should be losing rights and giving up bits of their freedom because someone ruined it for everyone else.

Didn't matter what it is: weapons, or fireworks, or even the right to code. Sacrifice of everyone's rights and freedom to choose all in the name of reducing the odds of something happening seems odd. The very regulation of what someone can and can not do, while it might theoretically reduce risk (an argument for correlation not causation exists here) can't possibly oughtweigh the fact your restricting people free will and autonomy. The constant regulation and restriction of thing is our life only stifle innovation, act as barriers to entry, and force the creativity out of peoples lives.

Rodent-over-IP would be a fascinating read.

Original title has “RATs”, but that seemed to have gotten edited/autocorrected away when it got to HN. Because, damn, that’s a hack I want to read about.

His last source is a word for word excerpt from a BBC article about Cloudflare, with the information coming directly from their reporter talking to the founder of Cloudflare. As far as I can tell the only thing the site he linked to added was they underlined some phrases.

When you say it is conspiracy theory shit (CTS) do you mean that what the text says is CTS, or do you mean that whatever inference the site that copied the text from the BBC is trying to get you to infer from their underlining is CTS?

And what do you reckon the chance is that Azure and AWS and GCP are extracting ephemeral TLS session keys for every inbound HTTPS traffic stream bound for their customers, and decrypting every single stream?

The chance that cloudflare is getting access to all incoming traffic in plaintext is 100%.

The difference is, legitimate non-criminal providers don't flagrantly ignore abuse reports, but thanks for leading with a petty criticism of my citations rather than refuting the core of my argument, which you can't do.

Nah, the ambiguity is exhilarating! :^)

Prodigy, haven't thought about that in a lot of years, thanks for the memory tickle. Even with the painted-with-bricks interface.

GEnie was another that was kind of fun. And I still can remember my CompuServe number!