Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 61 posts

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#41

Post by 5ESS »

zinekeller wrote: post #36
5ESS wrote: post #35

Earlier quoted context omitted.

What % of Cloudflare customers actually have their server set to only accept traffic from cloudflare IPs? Probably not the majority. If this is coming as a surprise to people then maybe Cloudflare isn’t doing enough to help people secure themselves against it.

As someone else ( https://news.ycombinator.com/item?id=31096321 ) pointed out, everyone does that already, with Shodan ( https://www.shodan.io/ ) being one of the most popular ones.

I don’t trust Shodan (a Corporation) not to hide / omit certain results or certain ranges. A self hosted scanner that could be deployed on a cheap VPS would be a better solution. having the ability to scan the entire internet is pretty fascinating honestly. Who knows what kind of sick and bizarre content dredging the entire internet with no filters might dig up.

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#42

Post by jffry »

eli wrote: post #32
mmcgaha wrote: post #23

If folks are really concerned about getting exposed they can firewall off everyone except cloudflare. https://www.cloudflare.com/ips/

Or better yet: use Cloudflare Tunnel to connect your origin to Cloudflare without exposing any inbound ports. I think you can also have Cloudflare present a client certificate that you can verify before responding.

Authenticated origin pulls are mutually exclusive with their tunnel. If you configure your firewall so that only the cloudflared tunnel process can access your origin server, then you can already be assured the request is coming from Cloudflare.

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#43

Post by jffry »

ushakov wrote: post #7

as far as i remember when the backend times out, CloudFlare shows a screen where you can see the actual IP of the server

I have seen the screen where Cloudflare cannot contact the origin and it absolutely does not include the IP address or other details about the origin.

You might be thinking of the "Ray ID" that Cloudflare displays on that page, which is just a random request ID that has nothing to do with the origin server.

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#44

Post by crtasm »

ushakov wrote: post #12
spacemanmatt wrote: post #3

https://github.com/zidansec/CrimeFlare-1

that’s just the client though it only makes request to https://api.xploit.my.id/v1/crimeflare.php and logs the output

It appears zidansec runs xploit.my.id. The api subdomain is not currently responding.

https://www.xploit.my.id/2021/07/crimeflare-bypass-tools-clo...

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#45

Post by jffry »

Liquid_Fire wrote: post #11
5ESS wrote: post #6

Earlier quoted context omitted.

A valid use case for wanting to know the “real” IP of a site hiding behind CloudFlare is being able to access the website from a Tor IP address (which they categorically block). For users in a country with censored internet, such a service would be essential.

If your website is behind CloudFlare, why even allow direct connections from anyone that's not CloudFlare?

With Cloudflare's tunnels, there's no longer even a need to allow direct connections from the outside world.

In my own testing it wasn't too terrible to setup firewall rules and mutual TLS-based authentication of origin pulls, but it is certainly something where you have to do everything right to be as secure as you think you are. Versus just closing off inbound connections entirely and running cloudflared

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#46

Post by zinekeller »

5ESS wrote: post #41
zinekeller wrote: post #36

Earlier quoted context omitted.

As someone else ( https://news.ycombinator.com/item?id=31096321 ) pointed out, everyone does that already, with Shodan ( https://www.shodan.io/ ) being one of the most popular ones.

I don’t trust Shodan (a Corporation) not to hide / omit certain results or certain ranges. A self hosted scanner that could be deployed on a cheap VPS would be a better solution. having the ability to scan the entire internet is pretty fascinating honestly. Who knows what kind of sick and bizarre content dredging the entire internet with no filters might dig up.

I genuinely don't get your point to be honest.

First, you allege that Cloudflare took down a repository that you claim might harm their interests. It could be indeed Cloudflare or it could instead be just GitHub noticing this repository by the "crime" in the repository name.

Second, you have said that one legitimate reason is because "they categorically block" Tor (https://news.ycombinator.com/item?id=31095920). I asked you if you can give a website that is fronted by Cloudflare and has blocked Tor users and is otherwise not something that would usually block Tor users and VPNs in any situation like banks (https://news.ycombinator.com/item?id=31095982). I haven't received any reply from you or even someone else to substantiate this.

Then, you said that you will build a similar too to scan the IPv4 internet space. Guess what: automated nefarious scanners are pounding on every IPv4 address to find unprotected systems, either because it's Windows and it's SMB feature is so bug-ridden that exploits are patched nearly every Patch Tuesday. Or old Wordpress installations where fully-automatic worms will hijack the site for spam links. Or even directly hacking routers and servers for botnets. It already exists to be honest, so I don't get why are you pretending that this is a new vulnerability or something.

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#47

Post by jgrahamc »

> CloudFlare had it taken down.

I'm not sure where the idea that we took this down came from, but I checked with legal and we didn't. Such tools, services, etc. have existed forever. Just one reason why we encourage people to protect their public IP (https://developers.cloudflare.com/fundamentals/get-started/s...) and have Cloudflare Tunnel (https://developers.cloudflare.com/cloudflare-one/connections...).

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#48

Post by 5ESS »

zinekeller wrote: post #46
5ESS wrote: post #41

Earlier quoted context omitted.

I don’t trust Shodan (a Corporation) not to hide / omit certain results or certain ranges. A self hosted scanner that could be deployed on a cheap VPS would be a better solution. having the ability to scan the entire internet is pretty fascinating honestly. Who knows what kind of sick and bizarre content dredging the entire internet with no filters might dig up.

I genuinely don't get your point to be honest. First, you allege that Cloudflare took down a repository that you claim might harm their interests. It could be indeed Cloudflare or it could instead be just GitHub noticing this repository by the "crime" in the repository name. Second, you have said that one legitimate reason is because "they categorically block" Tor ( https://news.ycombinator.com/item?id=31095920 ). I…

It’s a story in itself that a simple script which locates a site’s real IP was taken down for TOS violations. Cloudflare doesn’t own the real IPs or something so it’s really unclear why they (or GitHub) were entitled to take down this repository. Just because it threatens their million dollar buisness model they think they can take it down? That’s wrong my friend. And people need to know. Cloudflare or GitHub overstepped it’s boundaries to help a corporation enforce security by obscurity. Since this method is proven to be preventable, why take it down? Instead of taking it down from public knowledge (which does nothing to stop cybercriminals with private forks) why don’t they help their customers mitigate the impact instead?

Also, they stopped blocking the Tor IPs now but this wasn’t always the case. Many people remember a few years ago the IPs were blocked.

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#49

Post by jgrahamc »

5ESS wrote: post #48
zinekeller wrote: post #46

Earlier quoted context omitted.

I genuinely don't get your point to be honest. First, you allege that Cloudflare took down a repository that you claim might harm their interests. It could be indeed Cloudflare or it could instead be just GitHub noticing this repository by the "crime" in the repository name. Second, you have said that one legitimate reason is because "they categorically block" Tor ( https://news.ycombinator.com/item?id=31095920 ). I…

It’s a story in itself that a simple script which locates a site’s real IP was taken down for TOS violations. Cloudflare doesn’t own the real IPs or something so it’s really unclear why they (or GitHub) were entitled to take down this repository. Just because it threatens their million dollar buisness model they think they can take it down? That’s wrong my friend. And people need to know. Cloudflare or GitHub overste…

As I stated above (https://news.ycombinator.com/item?id=31097086), we did not take this down. Please stop claiming that.

Re: Ask HN: What gives Cloudflare the right to takedown apps revealing site real IP?

#50

Post by zinekeller »

5ESS wrote: post #48
zinekeller wrote: post #46

Earlier quoted context omitted.

I genuinely don't get your point to be honest. First, you allege that Cloudflare took down a repository that you claim might harm their interests. It could be indeed Cloudflare or it could instead be just GitHub noticing this repository by the "crime" in the repository name. Second, you have said that one legitimate reason is because "they categorically block" Tor ( https://news.ycombinator.com/item?id=31095920 ). I…

It’s a story in itself that a simple script which locates a site’s real IP was taken down for TOS violations. Cloudflare doesn’t own the real IPs or something so it’s really unclear why they (or GitHub) were entitled to take down this repository. Just because it threatens their million dollar buisness model they think they can take it down? That’s wrong my friend. And people need to know. Cloudflare or GitHub overste…

Apparently you will not believe anything, but the CEO responded here: https://news.ycombinator.com/item?id=31097086
Post reply on HN