Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

121–130 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#121

Post by sparkling »

kalmi10 wrote: post #112
sparkling wrote: post #86

Earlier quoted context omitted.

I don't get it. How is this info leaked? From the blog posts, it seems that "only" the HTTP Headers are being leaked and somehow being crawled by Google? But since when does Google store HTTP request info? Can someone explain?

Headers (among other sensitive stuff) were being leaked inside document bodies.

So just to clarify: some bug makes Cloudflare leak the HTTP Headers into the HTML being served and those HTML pages containing sensitive Info got cached by Google (and others)?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#122

Post by Trundle »

davb wrote: post #61
loeg wrote: post #46

Anyone know which password manager uses Cloudflare? Just trying to figure out if I'm affected.

Thankfully it looks like it's not 1Password, who seem to use AWS CloudFront.

Tavis specifically named 1Password, was that wrong?

https://twitter.com/taviso/status/834900838837411840

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#123

Post by geofft »

jgrahamc wrote: post #48
Tiksi wrote: post #39

Earlier quoted context omitted.

The quoted part that specifically mentions logged urls containing query strings has nothing to do with logging?

That's Google logging stuff

That's not how Google tells it, if I'm reading this right:

Cloudflare explained that they pushed a change to production that logged malformed pages that were requested, and then sent me the list of URLs to double check.

Many of the logged urls contained query strings from https requests that I don't think they intended to share.

(I'm reading that as "intended to share with Google".)

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#124

Post by chatmasta »

jgrahamc wrote: post #98
tptacek wrote: post #79

Earlier quoted context omitted.

In case you're wondering how this could be worse than Heartbleed: Yes, apparently the allocation patterns inside Cloudflare mean TLS keys aren't exposed to this vulnerability. But Heartbleed happened at the TLS layer. To get secrets from Heartbleed, you had to make a particular TLS request that nobody normally makes. Cloudbleed is a bug in Cloudflare's HTML parser, and the secrets it discloses are mixed in with, appa…

You really want to see Cloudflare spend more time discussing how they've quantified the leak here. What would you like to see? The SAFE_CHAR logging allowed us to get data on the rate which is how I got the % of requests figure.

Perhaps as a follow up to this bug, you can write a temporary rule to log the domain of any http responses with malformed HTML that would have triggered a memory leak. That way you can patch the bug immediately, and observe future traffic to find the domains that were most likely affected by the bug when it was running.

Or is the problem that one domain can trigger the memory leak, and another (unpredictable) domain is the "victim" that has its data dumped from memory?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#125

Post by espadrine »

tptacek wrote: post #4

Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…

It is far from over, too! Google Cache still has loads of sensitive information, a link away!

Look at this, click on the downward arrow, "Cached": https://www.google.com/search?q="CF-Host-Origin-IP:"+"author...

(And then, in Google Cache, "view source", search for "authorization".)

(Various combinations of HTTP headers to search for yield more results.)

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#127

Post by gkop »

problems wrote: post #107
eridius wrote: post #29

Earlier quoted context omitted.

I don't buy this argument. A site using Flexible SSL is no less secure than one using http:// , and in fact is more secure, because nobody can MitM the connection between CloudFlare and the end user. The only thing vulnerable is the connection between the website and CloudFlare (~~and only to MitM, not to passive sniffing~~ EDIT: this isn't true, see [1]), but that's a much smaller and much better-protected surface a…

Yeah, if you're capable of MITMing traffic between CloudFlare and the server, you're most likely capable of stealing emails or HTTP requests to the server anyways and generating your own certificate for them anyways. It's a security loss, but probably a minor one. The reality is, you're much more likely to get sniffed on public wifi or even your school or workplace network than someone running the server in a datacen…

> Would you be more comfortable if they offered another way to represent this to the browser? An X-Endpoint-Insecure header or something like that?

Yes, definitely, _Cloudflare_ should own this and push it through. You know they won't though because that would inconvenience their customers.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#128

Post by retox »

bigiain wrote: post #88
_wmd wrote: post #11

Step 1) MITM the entire Internet, undermining its SSL infrastructure, build a business around it Step 2) leak cleartext from said MITM'd connections to the entire Internet I recently noted that in some ways Cloudflare are probably the only entity to have ever managed to cause more damage to popular cryptography since the 2008 Debian OpenSSL bug (thanks to their "flexible" ""SSL"" """feature"""), but now I'm certain o…

Step 0) Obtain black funding from NSA budget to start and "VC invest" in a global CDN company... (Now I'm trawling Crunchbase to see if I can work out which investors are NSA front companies, then I'm gonna look to see what _else_ them and their partners have invested in...)

Long been rumoured in the more paranoid corners of the web they are intelligence front/partners.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#129

Post by tptacek »

jgrahamc wrote: post #113
tptacek wrote: post #108

Earlier quoted context omitted.

How many different sites? Your team sent a list to Tavis's team. How many entries were on the list?

We identified 3,438 unique domains. I'm not sure if those were all sent to Tavis because we were only sending him things that we wanted purged.

What anomalies would be apparent in your logs if someone malicious had discovered this flaw and used it to generate a large corpus of leaked HTTP content?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#130

Post by nicoburns »

AznHisoka wrote: post #111
tptacek wrote: post #4

Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…

Can someone tell me the implications of this in laymen terms? For instance what does it mean "sprayed into caches"? what cache? dns cache? browser cache? if the latter, does it mean you are safe if the person who owns that cache is an innocent non technical iser?

Far worse than this. Yes, browser caches, but also web crawlers (like google)'s caches. This means that anyone who requested certain public content could have instead received secret content from completely unrelated websites.
Post reply on HN