(Context: part of my job is breaking into stuff all day)<p>This is a technique commonly referred to as "living off the land" where an attacker makes use of a tool like cloudflared to conduct an action that would otherwise be blocked by security tools. It makes the defenders job so much harder because you now need to differentiate between your devops team being cool and a legitimate threat inside your network by looking at the exact same indicators generated by the two. Looking for things like unsigned applications making outbound network connections are removed from the defenders toolbox.<p>Yes, cloudflared does the same thing as ngrok. You'll also find that ngrok is blocked in most corporate environments as well for posing an equal risk. As an attacker, you have a good chance of setting off alarms that (should) specifically detect ngrok.<p>I think the point of this post it to highlight that cloudflare tunnels need to be block by default as well and only allowed when there are specific approved use cases.
I feel like this is just another case of "It rather involved being on the other side of this airtight hatchway" [0]<p>If an attacker is capable of installing apps on your server... you've already lost.<p>0. <a href="https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283" rel="nofollow noreferrer">https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...</a>
I find that more and more CloudFlare is so ubiquitous that we have to use CloudFlare tools to protect ourselves from other people attacking us via CloudFlare. Here's an example of a rule we had to put in place to block people using CloudFlare workers to scrape pages and bypass security. CloudFlare doesn't seem to care about this kind of abuse (or maybe they do but aren't talking about it publicly).<p>(!cf.bot_management.verified_bot)
and (cf.bot_management.score lt 10 )
and len(cf.worker.upstream_zone) gt 0 and not cf.worker.upstream_zone in {"<zone>"}
and (not ip.geoip.asnum eq <exception as>)
As an enterprise cloudflare customer, we were interested in using this product for legitimate purposes but also block internal non-legitimate access and asked them for advice how to do this.. Support wasn't able to offer any guidance.<p>EDIT: Toned down the language.
Hmm, risking sounding like the dropbox-is-only-ftp-and-svn guy but shouldn't any threat actor worth their salt be able to use any array of open source tools to do this? Especially if you already have access on the machine and the possibility to place binaries there?<p>The biggest risk I see is if the target is already using this for legit use cases, since I guess it would be really difficult to discern between the two.
If an attacker is capable of installing apps on your server... than anything is possible. Don't know why mention Cloudflared other than clickbait. O
Overall I'm huge fan of CF Zero Trust and tunnels. I wish documenation and examples were clear, but form a security stand point CF is one of the best security solutions we use.
I'd like to just say that I (the blog author) am not saying Cloudflared is bad. In fact my research on it makes me really want to test out its usefulness for some of my personal projects.<p>But it is important to demonstrate the ways in which this seemingly benign tool can be (and has been) used to conduct nefarious activity if not properly detected and defended against.