Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

31–40 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#31

Post by rdl »

tyingq wrote: post #27
rdl wrote: post #22

Earlier quoted context omitted.

I don't think he had to, but he got an answer in minutes. I don't think that's the part to be worried about. As for what you should do: it sounds like the impact is relatively low. I'd personally change easily-changed secrets which go over the session, and potentially externally facing customer passwords (yes in enterprise, maybe not in consumer). (I don't have any insider info on this breach, though, but I read both…

Sounds bad to me... "We've discovered (and purged) cached pages that contain private messages from well-known services, PII from major sites that use cloudflare, and even plaintext API requests from a popular password manager that were sent over https (!!)." The trouble is you have no way to know if someone discovered this earlier, and harvested info for a long time. Or, how much harvested info from your site might b…

Does 1Password really send anything meaningful in their API queries, or is it encrypted separately and then just sent over HTTPS?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#32

Post by eridius »

jgrahamc wrote: post #25
hendzen wrote: post #24

I think this bug is kind of an indictment of Ragel. It has some great ideas, but since the generated code is so low level - and allows arbitrary blocks of code to be executed in the guts of the parser, bugs like these can result in this horrible memory issues - particularly since the generated code is often used to parse untrusted user input.

I don't blame Ragel.

Ragel shares part of the blame. Why did it use a strict equality check when it could have trivially done a >=?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#34

Post by chm »

Some important parts:

    The examples we're finding are so bad, I cancelled some
    weekend plans to go into the office on Sunday to help
    build some tools to cleanup. I've informed cloudflare
    what I'm working on. I'm finding private messages from
    major dating sites, full messages from a well-known
    chat service, online password manager data, frames from
    adult video sites, hotel bookings. We're talking full
    https requests, client IP addresses, full responses,
    cookies, passwords, keys, data, everything.

    Cloudflare pointed out their bug bounty program, but I
    noticed it has a top-tier reward of a t-shirt.

    Cloudflare did finally send me a draft. It contains an  
    excellent postmortem, but severely downplays the risk
    to customers.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#35

Post by STRML »

gkop wrote: post #23
revelation wrote: post #18

Earlier quoted context omitted.

Step "What does secure mean anyway") SSL terminate even sites that are not sending data to Cloudflare securely

Yup, this made it crystal clear, years ago, that Cloudflare's business incentives were and are at odds with a secure web.

To my sibling: the issue is that people can and do consider Flexible SSL "good enough", when it really isn't. It gets you the green lock and the warm fuzzies, but the page just isn't secure. A false sense of security is worse than no security, because no security at least is glaringly obvious.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#39

Post by Tiksi »

jgrahamc wrote: post #21
Tiksi wrote: post #20

> Many of the logged urls contained query strings from https requests that I don't think they intended to share. I guess this confirms a few things. - The complete query strings are logged, - They don't appear to be too concerned with who accesses the logs internally or have a process that limits the access, and - They're willing to send those logs out to a random person.

This has nothing to do with logging.

The quoted part that specifically mentions logged urls containing query strings has nothing to do with logging?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#40

Post by summarity »

CapacitorSet wrote: post #5

>Cloudflare pointed out their bug bounty program, but I noticed it has a top-tier reward of a t-shirt. Considering the amount and sensitivity of the data they handle, I'm not sure a t-shirt is an appropriate top-tier reward.

Not only that, but the "reward" in the program is laughable and frankly insulting to any serious researcher considering the scope of CF. Bug bounty platforms are already becoming the fiverr of ITSEC (that's not a good thing), CF just made an extra effort do diminish the value for researchers.

Management: "Why do we offer $5k for a small bug again? Look at CF, they don't offer any money!"

Post reply on HN