Hacker News Reader

Comment by tyingq | Hacker News Reader

Makes me curious how they track abuse. Since it's distributed pretty widely, it seems like it could make a pretty good free portscanner, command-and-control network, DDOS amplifier, etc, with a group of free-level accounts.

View on HN

Nearly 90% of HTTP attacks on our website come from Cloudflare Workers. We've chosen to block huge subnets of their IPs because of it.

This new raw TCP connection feature will undoubtedly be used to attack other services in similar ways.

That's concerning. Could you elaborate on how you identified the traffic as cloudflare workers? Also, what sorts of HTTP attacks? wp-admin probes? Plain DDoS?

Cloudflare has (had?) a murky history with not taking down DDoS for hire services ironically hosted behind cloudflare. But while you could argue they had an incentive to do that (sell protection), I can't think of any incentive to let Workers be abused.

> Could you elaborate on how you identified the traffic as cloudflare workers?

Trivial based on the fact that HTTP requests coming from CloudFlare Workers has a cf-worker header. Also, any traffic coming from cloudflare-owned IP blocks clearly belongs to cloudflare and can be safely blocked.

On the second point, with the introduction of Cloudflare WARP VPN, that's not quite true. Additionally, I believe Safari Private Relay may end up looking like it originates from CF as well.

> Additionally, I believe Safari Private Relay may end up looking like it originates from CF as well.

Cloudflare reserves IP ranges just for Private Relay: https://developer.apple.com/support/prepare-your-network-for...

> and can be safely blocked.

Well no, not if you yourself are also using Cloudflare

You mean like server<>server communication? Hopefully that communication stays within the network rather than going from server<>internet<>server

I mean if you are using Cloudflare with their proxy, so origin<>cloudflare<>client

Yeah, then you'd just block based on the client IP which is in a header, rather than the IP on the connection.

You can block third party Workers with a CF WAF rule. Here's an example:

cf.worker.upstream_zone ne "" and not cf.worker.upstream_zone in {"aimoda.workers.dev" "ai.moda"}

If you can afford to block at L7, all outgoing http requests from Cloudflare workers have a HTTP header identifying them as such.

Link: https://developers.cloudflare.com/fundamentals/get-started/r...

cf-worker: example.com

Reply on news.ycombinator.com