Outgoing, which I believe this would be, is generally far less restrictive than incoming.

I'm playing around with IP address level detecting and blocking using incoming ports as indicators. I'm going to set aside some time to think more about restrictions on outgoing ports as a result of this and your comment.

Do some logging of frequently used remote ports over a couple of weeks and create a baseline set of allowed ports, block everything else and see what breaks.

I already use the limited Feodo Tracker[0] lists to flag in my firewall logs whether any device on the network has attempted to contact a known C&C IP address.

Thanks for push.

[0]:https://feodotracker.abuse.ch

First things first, found I've got a bunch of devices doing "internet check" pings to Google's DNS servers once per second! I feel dirty that that's been going on so long.

Devices reconfigured to NOT do that at all.

Now that's cleared, the log won't be quite so cluttered.

Edited to add: Also redirected a whole load of regular NTP queries to remain internal.

Also: time of day restrictions.

There's sweet FA traffic that should be going out to the 'net when everyone's asleep. But make sure these rules can be switched on and off in case of emergencies.

I had to take my daughter to emergency late one night a few months ago (didn't end up being anything worthy of a story), but got home at 2:30am. My garage door opener gets smart-home-switched-off at 1:00am-ish. At 2:30am, just wanting to go to bed after the stress of an emergnecy room, waiting for that thing to boot up felt like 15 minutes.

Log4shell would have been a much smaller problem if so

Outgoing? You bet. Have you been out there?

Yes. This is some very basic malware, but real ones will use HTTPS on port 443.

Only allow HTTPS out to FAANG (whatever it is now) + Cloudflare IP address ranges

Nothing prevents C&C from being fronted by cloudflare.

And CloudFlare will be extremely happy to let them hide there. They don't care about malware abusing their workers infra.

But also "Only allow HTTPS out to FAANG" - ok, so now you're allowing encrypted connections to 2 largest cloud providers. At that point what's the benefit at all?

> They [Cloudflare] don't care about malware abusing their workers infra.

This is a serious allegation to make. Do you happen to have some supporting evidence?

It’s widely known and talked about in the infosec community - getting CF to do anything about malicious content on their services is an absolute nightmare.

I do understand they don’t want to set any bad precedents internally, but their abuse reporting is abysmal.

Do you have some supporting evidence?

Is it needed? Most hosting companies and CDNs are difficult to get to remove malicious content, this is pretty well known. I don't know why we'd require some form of irrefutable evidence to believe Cloudflare isn't the same.

Just search for CloudFlare worker abuse. There's lots of stories like this https://news.ycombinator.com/item?id=37064311 , larger campaigns like https://www.bleepingcomputer.com/news/security/blackwater-ma... , DDoS campaigns originating from workers https://news.ycombinator.com/item?id=38496499

It's kinda hard to point to someone saying how big the problem is, because most posts are just "sigh, here's yet another example, anyway...". I wouldn't go as far as saying they're doing this as an intended strategy, but it's definitely a case of it being hard for CloudFlare to care about an issue when they're in business of selling protection from that issue.

Thank you for providing links instead of giving me a “just believe me, bro” type of response. I’m about to take a look at them.

As a side note, I’m actually amused that I got downvoted for simply asking for evidence. I think it’s a pretty reasonable to ask folks to substantiate serious allegations made against a company like Cloudflare (a company, I might add, I’m not even a fan of for my own personal/philosophical reasons). I find this behavior very cult-like, but anyway, I digress…

One mans C&C server is anothers RMM.

Im pretty sure he was joking anyways... Either way, I thought it was funny.

Better to limit per process

Create a bunch of burner Google accounts and use Google Drive or Docs or Calendar as C&C?

I've used Google App Script for C&C in a demo before. It's HTTPS traffic going to a Google IP and the domain is script.google.com - what looks more legit than that?

Hiding your C&C behind clownflare is basically the default mode for a lot of actors.

CF are terribly slow to respond to abuse, their ranges are allowlisted everywhere, and it’s not terribly hard to hide your backend infrastructure (origin) even from cloudflare itself.

Sure you have to deal with the eventual takedown of your domain, by CF or more likely the domain registrar, but it’s trivial to work around that (backup domains, frequently rotating them, etc).

What’s funny is how Namecheap are now absolutely god tier at doing takedowns on malicious domains - they used to have a very poor reputation and now will process a takedown (provided evidence) within the hour usually.

Wondering if typo, auto-correct, or intentional ... anyway, I like :D

Given the critical tone, I'd say probably intentional.

what's C&C? sorry for hijacking the thread.

Command and Control. The server that issues instructions to the malware.

Yes, and with domain fronting and doing traffic patterns that look legitimate.

A good solution is to block all outgoing traffic on production servers.

> Or are those ports for control inside the firewall only?

It seems so. This traffic likely will not even traverse a firewall -- the article lists the IP addresses used with port 52699, which are all RFC1918 space (172.16.0.0/12).