Except without the sharktank, and just with an online store offering various service levels. Maybe this is what Moriarty's 'crime as a service' model looks like in the real world...

Why is CloudFlare protecting these sites, anyway?

First, here's their CEO's explanation of their stance: http://blog.cloudflare.com/58611873/

Cloudflare is closer to a router than a host. They just happen to be a router which masks that which they're routing to.

If you file an abuse complaint to them about a specific domain, they won't take any actions themselves. However, they will tell the reporter the server's real hosting provider, and will forward the complaint to the hosting provider with information allowing the provider to determine what server the domain corresponds to.

There are some pros and cons to this approach, but considering their role as a completely neutral "transit station" of traffic, I think it makes the most sense legally and practically. Ethically I have a few qualms with it (if a site is very, very blatantly advertising illegal material, ethically I think they should either disable Cloudflare cloaking for the domain, stop resolving the domain at all, or just cancel the customer's account entirely; legally they don't necessarily need to, though, and I can understand why they don't), but they still make it very easy for a hosting provider to take action when there is an abuse complaint.

They literally run Varnish, mod_security, mod_evasive, etc. They literally host content. They are a host, not a "router."

I'm undecided.

They have some hosting capabilities but I think that would be better described as a "mirror" rather than a host. Most of their infrastructure is routing and some is mirroring/caching.

The reasoning is very similar, "we don't care what our users do, we're infrastructure". I wonder how well that will hold up in court, once tested. I have a nagging suspicion they will have to change their stance, but I'm happy to be proven wrong.

1. Perhaps their logic is, if they protect LS's site, perhaps LS is less likely to attack services behind CloudFlare in fear of taking out their own site in the processes. I am not saying that CloudFlare does this out of fear of LS, perhaps they just think it's a sound business practice.

2. CloudFlare directly and significantly benefits from the illegal activity of LS and other DDoS organizations. DDoSers are the boogyman, and CloudFlare protects people from the boogyman, for money. The more boogyman attacks are there, the more people flee to the protecting arms of CloudFlare.

3. CloudFlare has the attitude that they are simple an ISP, or a router of traffic, and they are not responsible for any of the content on the sites they "distribute." This is a good position legally to take. As my friend, a prosecutor, jokingly points out, "everything is illegal." So, some country or another would be able to find something objectionable about almost every single site on the internet, and CloudFlare want's to be treated like an ISP, not responsible at all for any of that stuff.

But let's say the content in question wasn't a DDoS site, but a child porn site, would CloudFlare be so adamant in their stance, I don't think so. Even ISPs quickly disconnect their customers from the internet when clear and easily verifiable allegation of child porn, piracy, fraud, or bonnet operations are presented to them.

Basically, CloudFlare is not responsible for LS, but they should be a good Net citizen, and drop them voluntarily. That being said, they are not going to for reasons # 1 and 2.

Funny how the solution to being DDOS'd by their own customers is, "Buy our product." In the sane world we call this racketeering or protection money.

As an example, ISP's don't drop spammers because they morally hate spam, they drop spammers because their mail servers will get blacklisted and make their customers hate them.

A fine distinction, but an important one.

As long as their core botnet infrastructure stays afloat, it doesn't really matter to them what's discovered about the stresser or even their real identities in some cases. They're very brazen, to say the least.

I imagine their botnet won't be up for too much longer though.

And as for the gcloud servers, yeah we connected a few of them to the public IRC... So what? It's not like as if they we're ever going to survive beyond few hours. Also, Krebs seemed to imply that we used the Google bots for DDoS attacks... That's pretty ridiculous considering Google will automatically suspend you if they detect traffic anomalies.

I think it's within the realm of possibility for consumers to install routers/gateways that are competently engineered. It's flat out impossible to ensure every IOT device a consumer owns has even the most basic security principles covered.

Is openDNS a sponsor for Krebs? This seems like a great way to break CDN geo-ip, get served ads, and get non-standard "typo domain" messages. Ironically, it opens people up to DDOS as a attack against openDNS means Kreb's readers now don't have dns.

A lot of ISPs do (or try to, before backpedaling quickly) the same things. I've settled for using Google's DNS servers.

the OpenDNS 'guide' is meant to be removed.

I closely benchmarked it and they turned out to be right, though 8.8.8.8 had only a little bit more latency. And it makes sense; your ISP will always (theoretically) be able to provide lower latency than Google can when they put the effort into it. Unless Google is your ISP. :)

https://code.google.com/p/namebench/

At least the password was somewhat strong. I'm not sure having it printed on the same label as the serial number is a good idea though.

http://www.devttys0.com/2014/10/reversing-d-links-wps-pin-al...

I'd still generally agree with your suggestion, it's just funny to see how some of our assumptions no longer hold, over time.

This is just the tip of the iceberg from 10 minutes of Googling. I also recall there was some technique where an attacker could reflect attack traffic through a browser and back into the router, so if you knew the router IP and user/pass you could compromise it by getting the user to visit a malicious or drive-by-hacked site.... but I couldn't find a link for that one.

[1] - https://securityevaluators.com/knowledge/case_studies/router...

[2] - https://www.eff.org/deeplinks/2014/08/def-con-router-hacking...

[3] - http://www.computerworld.com/article/2491042/malware-vulnera...

Obviously these should be locked to only respond to designated control IP's that originate from the ISP, and default user/passwords should be changed...far too often I've seen corps use a non-default user/pass but instead switched to something different... but only that every single device they deploy has the same exact user/pass on it.

I can think of lots of reasons to have it on; one would be a second home.