Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What's the actual fallout been from the Cloudflare bug?

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 80 posts

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#71

Post by _pmf_ »

> "this is the end" and "this is so bad, we're f*cked"

End of what? It will just give rise to slightly more secure, improved services (maybe be the same providers, maybe by competitors, but definitely financed and implemented by the same people).

> And I haven't seen any huge leaks or items in the press about some terrible hack or theft that has brought someone or a corporate "down".

Look at the Sony/PSN breach; there has been zero accountability, and it has not hurt the PS4 launch at all. Consumers just don't give a shit.

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#72

Post by m348e912 »

dylz wrote: post #22
simplehuman wrote: post #11

Does anyone here (startup) use ddos protection ?

I run a few medium sized side projects (x-xxx million pv/month). I can never use a per-GB-cost CDN solution, and all of my sites require protection up to L7.

Your response doesn't make much sense to me, sorry. Why can you never use a per-GB-cost CDN solution? Is it because you deliver your content via SSL and don't want to share your SSL keys? Is it because you can't afford the potential CDN delivery costs? Is it because your projects don't benefit from CDN caching? Also, I am not sure what point you are trying to make about layer 7 protection. If you need layer 7 protection, get a WAF.

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#73

Post by simias »

rlpb wrote: post #63
icebraining wrote: post #15

Earlier quoted context omitted.

I think the implication is that the isolation should be per customer , each being allocated their own parsing process, isolated from the other customers. That's roughly what we do, though we run an hosted version of an open source webapp, not a CDN. It's more expensive resource-wise (particularly RAM), but it has meant that we were immune to 90%+ of the security bugs discovered in the platform.

> each being allocated their own parsing process That just punts the vulnerable code elsewhere. A kernel bug could leak memory across processes. And the kernel is also written in C, so you aren't getting protection from a "better" language either.

That's assuming that the likelihood of such a bug in the kernel code is the same as a bug in an HTML parser. And also that this bug would go unnoticed for months. The fact that both are written in C doesn't make them equal.

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#74

Post by tgragnato »

simias wrote: post #73
rlpb wrote: post #63

Earlier quoted context omitted.

> each being allocated their own parsing process That just punts the vulnerable code elsewhere. A kernel bug could leak memory across processes. And the kernel is also written in C, so you aren't getting protection from a "better" language either.

That's assuming that the likelihood of such a bug in the kernel code is the same as a bug in an HTML parser. And also that this bug would go unnoticed for months. The fact that both are written in C doesn't make them equal.

absolutely true

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#75

Post by tyingq »

m348e912 wrote: post #70

Aside from being a black eye on Cloudflare, I don't see this issue being of much consequence. I have yet to see one real-world example of a screenshot or link to a cache of data of leaked data (sensitive or not). If anyone has an example, please share. As others have mentioned, the real fear is of what could have leaked, not what did leak.

There were a couple of examples of leaked data. Session stuff, API keys, cookies, oauth tokens, and so forth.

Uber: http://securityaffairs.co/wordpress/wp-content/uploads/2017/...

Fitbit: http://cdn.iphoneincanada.ca/wp-content/uploads/2017/02/clou...

OkCupid: https://trtpost-wpengine.netdna-ssl.com/files/2017/02/cloudb...

Oauth data: https://pbs.twimg.com/media/C5ZCRtMVMAEs0ca.png

Or were you asking about some consolidated treasure trove?

The real risk, to me, is that someone noticed this before Tavis did. They could have created a site with the right parameters and then scraped it for weeks. Cloudflare only had logs for 10 days of the multi-month exposure window, so they have no idea if someone did this or not.

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#76

Post by pg_is_a_butt »

mseebach wrote: post #67
perlgeek wrote: post #2

The trouble with this sort of bug is that we'll likely never know. Some people's accounts will be compromised, and nobody will know if it's been due to fishing, insecure passwords, or an information leak such as the Cloudflare bug, or an undisclosed or undiscovered breach somewhere. The more responsible Cloudflare customers have invalidated existing sessions; that's much less hassle than forcing a password reset, and…

> nobody will know if it's been due to fishing, insecure passwords, or an information leak such as the Cloudflare bug, or an undisclosed or undiscovered breach somewhere "Not measurable over the background noise" is a pretty workable definition of "no fallout".

it's also a pretty workable definition of "ALL of the background noise was caused by this, and we're just now realising that, but don't have any way to prove it."

you're all idiots.

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#77

Post by stouset »

mseebach wrote: post #67
perlgeek wrote: post #2

The trouble with this sort of bug is that we'll likely never know. Some people's accounts will be compromised, and nobody will know if it's been due to fishing, insecure passwords, or an information leak such as the Cloudflare bug, or an undisclosed or undiscovered breach somewhere. The more responsible Cloudflare customers have invalidated existing sessions; that's much less hassle than forcing a password reset, and…

> nobody will know if it's been due to fishing, insecure passwords, or an information leak such as the Cloudflare bug, or an undisclosed or undiscovered breach somewhere "Not measurable over the background noise" is a pretty workable definition of "no fallout".

The problem is that you can't magically measure it separately from the background noise. It becomes part of the background noise.

Lacking tools to measure an effect doesn't mean it has no effect.

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#78

Post by akiselev »

bboreham wrote: post #59
akiselev wrote: post #37

Earlier quoted context omitted.

Linux namespaces/containers create a memory page table completely separate from the host's so barring vulnerabilities in the container implementation that allow mapping host physical memory to guest virtual, isolation is strictly enforced by the memory controller in the hardware. Without an exploit, the worst case scenario is leaking shared library read-only sections across containers (since the physical memory might…

> Linux namespaces/containers create a memory page table completely separate from the host's Each _process_ has its own memory page table. Containers are built out of processes, so they inherit this attribute. Namespaces have nothing to do with it.

Sorry, I should have elaborated: with namespaces, each container instance gets its own process table with separate non-shareable pages (without KSM or other dedup feature) and then each container process gets its own page tables, like they normally do. The point is that there's an extra level of isolation beyond just processes, although there is still the kernel attack surface.

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#79

Post by jgrahamc »

predakanga wrote: post #69
tgragnato wrote: post #7

An information leak is an information leak : we still fail to realise that it's something that's happening daily. There's no drama in it. Criminals are taking advantage of opportunities like this every day, still no one cares too much about it (HN bubble & friends excluded). Things like this may have a strong impact or not in the press/popularity circus, but in this particular case it seems they promptly monitored th…

It's not much to go on, but it seems they are looking into better isolation going forward: https://disqus.com/home/discussion/cloudflare/incident_repor...

We'll be sure to write up details of things we have changed. It's ongoing.

Re: Ask HN: What's the actual fallout been from the Cloudflare bug?

#80

Post by dylz »

m348e912 wrote: post #72
dylz wrote: post #22

Earlier quoted context omitted.

I run a few medium sized side projects (x-xxx million pv/month). I can never use a per-GB-cost CDN solution, and all of my sites require protection up to L7.

Your response doesn't make much sense to me, sorry. Why can you never use a per-GB-cost CDN solution? Is it because you deliver your content via SSL and don't want to share your SSL keys? Is it because you can't afford the potential CDN delivery costs? Is it because your projects don't benefit from CDN caching? Also, I am not sure what point you are trying to make about layer 7 protection. If you need layer 7 protect…

I need DDoS protection because they get hit nearly daily (esports/gaming related; this is par for the course in this vertical).

I can't pay per GB because of the DDoS protection portion - the last time I used AWS/Cloudfront the skids just wget looped on a hundred thousand threads in the most expensive per-GB region. Cloudflare is basically the only "CDN" that I can feasibly use for even just images. I'm happy to pay, but unmetered only.

I deliver via SSL but there is close to no PII, I don't mind that much about the MITM factor.

Lower layer protection against volumetric floods is needed (standard attacks, all UDP needs to be dropped as high up as possible), but also L7 protection is needed - not vulns/XSS/SQLi/etc, but we're talking bursts of 10m-20m+ req/s to whatever the most expensive endpoint is (usually search), registration attempts, if any third party APIs are used, the intent is to exhaust as many calls as possible or deny service in the end.

I have a stupid amount of nginx and custom lua rules + redis trying to clean up whatever gets passed through, things like "if IP has shown over 40 different user agents in the last 2 minutes, drop it as high up as possible, ideally before it enters my network" and "if this user agent contains Chrome but the request headers don't accept sdch then this is an flood".

The commercial/for-profit larger sites in this group are behind Akamai and Distil. Both of these cost $comedy.

This level of bullshit is fairly normal for video games.

Post reply on HN