Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Phishers are hijacking legitimate cloud infrastructure

securelist.com

Post reply on HN
Print view View original

11–20 of 21 posts

Re: Phishers are hijacking legitimate cloud infrastructure

#11

Post by KennyBlanken »

crote wrote: post #8

"Hijacking"? No, those clouds providers are happily hosting phishers. They simply believe doing the bare minimum of half-hearted anti-abuse is more profitable than doing proper KYC and risking missing out on a legitimate customer or two.

I like how you got downvoted for pointing out the truth: behind all this abusive and criminal network activity are a whole slew of service providers happy to not look too closely.

Craigslist's revenue, and his wealth, heavily came from pimps and human traffickers. If anyone thinks they weren't aware of what was going on, they're fooling themselves.

When CL shut those sections down, it only did so because state AGs were starting to make a lot of noise about prosecuting them. Now Craig Newmark makes a lot of noise about all the good things he's doing, and it's primarily for SEO because the only other thing he and the other guy were getting in the news for was running a site that was profiting off human trafficking and prostitution.

All those ads went to Backpages, which most people had never heard of until state DAs start going after them. And how strange that Backpages never did anything on its own about the huge influx of sexual solicitation content...

Re: Phishers are hijacking legitimate cloud infrastructure

#12

Post by GolfPopper »

crote wrote: post #8

"Hijacking"? No, those clouds providers are happily hosting phishers. They simply believe doing the bare minimum of half-hearted anti-abuse is more profitable than doing proper KYC and risking missing out on a legitimate customer or two.

And they are, at present, correct.

Re: Phishers are hijacking legitimate cloud infrastructure

#13

Post by crote »

ronsor wrote: post #10
crote wrote: post #8

"Hijacking"? No, those clouds providers are happily hosting phishers. They simply believe doing the bare minimum of half-hearted anti-abuse is more profitable than doing proper KYC and risking missing out on a legitimate customer or two.

I'd take the phishers over more KYC invading everything, quite honestly.

I don't disagree with you, but I think there's a bit of a difference between setting up an entire cloud infra to the point that you can phish people with it, and making a basic account on a random website to post some comments. Requiring KYC on a site like Reddit is obviously nonsense as at worst someone could make some mean anonymous comments, but we're now seeing Cloudflare being used as an end-to-end platform for sophisticated crime.

You've got to remember that those "free" cloud services are primarily intended as a way to do marketing. You try it out for free because the barrier to entry is so low, then you pay for it when you deploy it to prod. Alternatively: you start with it for free, then are tied to it when your site suddenly gets popular and they start extorting you.

For legitimate use KYC on something like Cloudflare really isn't that big of a deal, in my opinion. I already had to submit my real name and address for my domain registration, and the credit card used to pay for my hosting isn't exactly anonymous either. Heck, when I tried to switch to Hetzner they even asked for a copy of my ID card! We can pretend Cloudflare can't already figure out who I am, but we all know that isn't true.

And of course KYC isn't the only way to solve this. Cloudflare could've also chosen to give new (unpaying / unverified) users a restricted account, which would for example display a Cloudflare ad around it (like .tk domains back in the day), or restrict it to a certain IP range, or only display content after logging in, or after a click-through page. For the attack described in the article they could also force the potential user to supply a subdomain for the service to live on, so it isn't hidden behind Cloudflare's ".workers.dev" and ".pages.dev".

Cloudflare chooses not to do any of this - which in turn makes them the perfect platform for criminals. If that's what they want to, then that's totally fine - but then they should be treated like all the other "bulletproof hosting" organisations out there.

Re: Phishers are hijacking legitimate cloud infrastructure

#14

Post by ronsor »

crote wrote: post #13
ronsor wrote: post #10

Earlier quoted context omitted.

I'd take the phishers over more KYC invading everything, quite honestly.

I don't disagree with you, but I think there's a bit of a difference between setting up an entire cloud infra to the point that you can phish people with it, and making a basic account on a random website to post some comments. Requiring KYC on a site like Reddit is obviously nonsense as at worst someone could make some mean anonymous comments, but we're now seeing Cloudflare being used as an end-to-end platform for…

Hetzner asking for ID is an outlier, probably inspired by German bureaucracy. I've never sent ID to a hosting provider personally. Many domain registrars accept payment in means that don't require ID, and offer WHOIS privacy for free.

I probably would not use Cloudflare if it had KYC simply because I do not want to be interrogated every time I try to do something meaningful online. It is a waste of time because criminals will integrate "verify with stolen identity" into their pipeline tomorrow, while legitimate users are stuck with the headaches.

An interstitial warning page is probably the happy medium, and what ngrok already uses now.

Re: Phishers are hijacking legitimate cloud infrastructure

#15

Post by cutty_wise »

Bender wrote: post #2

Their pie chart almost looks like part of my local DNS configuration. I have not yet blocked github.io or azure however. I built this Unbound DNS configuration file from all the AI submissions in the event I accidentally click on one before noticing the domain. local-zone: "workers.dev." always_null local-zone: "pages.dev." always_null local-zone: "vercel.app." always_null local-zone: "netlify.app." always_null local…

[dead]

Re: Phishers are hijacking legitimate cloud infrastructure

#16

Post by crote »

ronsor wrote: post #14
crote wrote: post #13

Earlier quoted context omitted.

I don't disagree with you, but I think there's a bit of a difference between setting up an entire cloud infra to the point that you can phish people with it, and making a basic account on a random website to post some comments. Requiring KYC on a site like Reddit is obviously nonsense as at worst someone could make some mean anonymous comments, but we're now seeing Cloudflare being used as an end-to-end platform for…

Hetzner asking for ID is an outlier, probably inspired by German bureaucracy. I've never sent ID to a hosting provider personally. Many domain registrars accept payment in means that don't require ID, and offer WHOIS privacy for free. I probably would not use Cloudflare if it had KYC simply because I do not want to be interrogated every time I try to do something meaningful online. It is a waste of time because crimi…

> Hetzner asking for ID is an outlier, probably inspired by German bureaucracy.

No, it was 100% their own fraud prevention. They blocked my account almost immediately after registration, and they refused to unblock it even after I sent them my ID. My best guess is that they really didn't like that I signed up with a Protonmail address.

Re: Phishers are hijacking legitimate cloud infrastructure

#17

Post by MyMemoryfails »

crote wrote: post #13
ronsor wrote: post #10

Earlier quoted context omitted.

I'd take the phishers over more KYC invading everything, quite honestly.

I don't disagree with you, but I think there's a bit of a difference between setting up an entire cloud infra to the point that you can phish people with it, and making a basic account on a random website to post some comments. Requiring KYC on a site like Reddit is obviously nonsense as at worst someone could make some mean anonymous comments, but we're now seeing Cloudflare being used as an end-to-end platform for…

Your argument about reddit doesn't really hold up, they can post data embedded into images or illegal materials in photos or videos.

Malware can extract data from embedded metadata from media, there's even video by benn jordan about it.

Re: Phishers are hijacking legitimate cloud infrastructure

#18

Post by psd1 »

ronsor wrote: post #9
Bender wrote: post #2

Their pie chart almost looks like part of my local DNS configuration. I have not yet blocked github.io or azure however. I built this Unbound DNS configuration file from all the AI submissions in the event I accidentally click on one before noticing the domain. local-zone: "workers.dev." always_null local-zone: "pages.dev." always_null local-zone: "vercel.app." always_null local-zone: "netlify.app." always_null local…

If you block github.io, you may as well stop using half this site.

You think? I don't believe i have seen a single submission here using the github.io domain.

It's possible some submissions are hosted there on a user's domain and heavily themed, but i suspect it's just not a host for many submissions. I'm not verifying that; of course i may be wrong.

Re: Phishers are hijacking legitimate cloud infrastructure

#19

Post by psd1 »

MyMemoryfails wrote: post #17
crote wrote: post #13

Earlier quoted context omitted.

I don't disagree with you, but I think there's a bit of a difference between setting up an entire cloud infra to the point that you can phish people with it, and making a basic account on a random website to post some comments. Requiring KYC on a site like Reddit is obviously nonsense as at worst someone could make some mean anonymous comments, but we're now seeing Cloudflare being used as an end-to-end platform for…

Your argument about reddit doesn't really hold up, they can post data embedded into images or illegal materials in photos or videos. Malware can extract data from embedded metadata from media, there's even video by benn jordan about it.

> at worst someone could make some mean anonymous comments

No, at worst they could conduct an astroturf campaign and manipulate the overton window. I suspect that Noam Chomsky attains correctness by volume and by forgetting the times he was wrong, but the whole "manufactured consent" concept looks prescient.

Re: Phishers are hijacking legitimate cloud infrastructure

#20

Post by psd1 »

KennyBlanken wrote: post #11
crote wrote: post #8

"Hijacking"? No, those clouds providers are happily hosting phishers. They simply believe doing the bare minimum of half-hearted anti-abuse is more profitable than doing proper KYC and risking missing out on a legitimate customer or two.

I like how you got downvoted for pointing out the truth: behind all this abusive and criminal network activity are a whole slew of service providers happy to not look too closely. Craigslist's revenue, and his wealth, heavily came from pimps and human traffickers. If anyone thinks they weren't aware of what was going on, they're fooling themselves. When CL shut those sections down, it only did so because state AGs we…

I also observe the phenomenon. In the case of craigslist, which is news to me, could you approximately quantify "heavily"? Are we talking about a few percentage points, or a visible chunk of a pie chart? Did the site depend totally on it for a while to keep the lights on?

Is Craig driving a slightly nicer car from it, or is it more of a megayacht thing?

Post reply on HN