Nothing prevents C&C from being fronted by cloudflare.

And CloudFlare will be extremely happy to let them hide there. They don't care about malware abusing their workers infra.

But also "Only allow HTTPS out to FAANG" - ok, so now you're allowing encrypted connections to 2 largest cloud providers. At that point what's the benefit at all?

> They [Cloudflare] don't care about malware abusing their workers infra.

This is a serious allegation to make. Do you happen to have some supporting evidence?

It’s widely known and talked about in the infosec community - getting CF to do anything about malicious content on their services is an absolute nightmare.

I do understand they don’t want to set any bad precedents internally, but their abuse reporting is abysmal.

Do you have some supporting evidence?

Is it needed? Most hosting companies and CDNs are difficult to get to remove malicious content, this is pretty well known. I don't know why we'd require some form of irrefutable evidence to believe Cloudflare isn't the same.

Just search for CloudFlare worker abuse. There's lots of stories like this https://news.ycombinator.com/item?id=37064311 , larger campaigns like https://www.bleepingcomputer.com/news/security/blackwater-ma... , DDoS campaigns originating from workers https://news.ycombinator.com/item?id=38496499

It's kinda hard to point to someone saying how big the problem is, because most posts are just "sigh, here's yet another example, anyway...". I wouldn't go as far as saying they're doing this as an intended strategy, but it's definitely a case of it being hard for CloudFlare to care about an issue when they're in business of selling protection from that issue.

Thank you for providing links instead of giving me a “just believe me, bro” type of response. I’m about to take a look at them.

As a side note, I’m actually amused that I got downvoted for simply asking for evidence. I think it’s a pretty reasonable to ask folks to substantiate serious allegations made against a company like Cloudflare (a company, I might add, I’m not even a fan of for my own personal/philosophical reasons). I find this behavior very cult-like, but anyway, I digress…

One mans C&C server is anothers RMM.

Im pretty sure he was joking anyways... Either way, I thought it was funny.

Better to limit per process

Create a bunch of burner Google accounts and use Google Drive or Docs or Calendar as C&C?

I've used Google App Script for C&C in a demo before. It's HTTPS traffic going to a Google IP and the domain is script.google.com - what looks more legit than that?

Hiding your C&C behind clownflare is basically the default mode for a lot of actors.

CF are terribly slow to respond to abuse, their ranges are allowlisted everywhere, and it’s not terribly hard to hide your backend infrastructure (origin) even from cloudflare itself.

Sure you have to deal with the eventual takedown of your domain, by CF or more likely the domain registrar, but it’s trivial to work around that (backup domains, frequently rotating them, etc).

What’s funny is how Namecheap are now absolutely god tier at doing takedowns on malicious domains - they used to have a very poor reputation and now will process a takedown (provided evidence) within the hour usually.

Wondering if typo, auto-correct, or intentional ... anyway, I like :D

Given the critical tone, I'd say probably intentional.

what's C&C? sorry for hijacking the thread.

Command and Control. The server that issues instructions to the malware.

Yes, and with domain fronting and doing traffic patterns that look legitimate.

A good solution is to block all outgoing traffic on production servers.