Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

Post by lmm » Fri, Feb 24, 2017, 12:08 AM UTC

eridius wrote: post #29

gkop wrote: post #23

Earlier quoted context omitted.

Yup, this made it crystal clear, years ago, that Cloudflare's business incentives were and are at odds with a secure web.

I don't buy this argument. A site using Flexible SSL is no less secure than one using http:// , and in fact is more secure, because nobody can MitM the connection between CloudFlare and the end user. The only thing vulnerable is the connection between the website and CloudFlare (~~and only to MitM, not to passive sniffing~~ EDIT: this isn't true, see [1]), but that's a much smaller and much better-protected surface a…

Post by bubblethink » Fri, Feb 24, 2017, 12:08 AM UTC

joepie91_ wrote: post #52

jkells wrote: post #44

My first thought was relief, thank god I'm not using Cloudflare. Where would you even start to address this? Everything you've been serving is potentially compromised, API keys, sessions, personal information, user passwords, the works. You've got no idea what has been leaked. Should you reset all your user passwords, cycle all or your keys, notify all your customers that there data may have been stolen? My second th…

> My second thought after relief was the realization that even as a consumer I'm affected by this, my password manager has > 100 entries what percentage of them are using CloudFlare? Should I change all my passwords? Yes. Right now. Don't wait for the vendor to notify you. > What an epic mess. This is the problem with centralization, the system is broken. Yep.

Post by hoorayimhelping » Fri, Feb 24, 2017, 12:09 AM UTC

_wmd wrote: post #11

Step 1) MITM the entire Internet, undermining its SSL infrastructure, build a business around it Step 2) leak cleartext from said MITM'd connections to the entire Internet I recently noted that in some ways Cloudflare are probably the only entity to have ever managed to cause more damage to popular cryptography since the 2008 Debian OpenSSL bug (thanks to their "flexible" ""SSL"" """feature"""), but now I'm certain o…

Post by cperciva » Fri, Feb 24, 2017, 12:10 AM UTC

eridius wrote: post #32

jgrahamc wrote: post #25

Earlier quoted context omitted.

I don't blame Ragel.

Ragel shares part of the blame. Why did it use a strict equality check when it could have trivially done a >=?

    /* generated code */
    if ( ++p == pe )
        goto _test_eof;

    /* generated code */
    if ( ++p >= pe )
        goto _test_eof;

    /* generated code */
    if ( ++p == pe )
        goto _test_eof;
    assert(p