Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

131–140 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#131

Post by eridius »

lmm wrote: post #81
eridius wrote: post #29

Earlier quoted context omitted.

I don't buy this argument. A site using Flexible SSL is no less secure than one using http:// , and in fact is more secure, because nobody can MitM the connection between CloudFlare and the end user. The only thing vulnerable is the connection between the website and CloudFlare (~~and only to MitM, not to passive sniffing~~ EDIT: this isn't true, see [1]), but that's a much smaller and much better-protected surface a…

The only thing the end user has is the difference between http:// and https:// . Cloudflare undermines that entirely. How can a user possibly ever know whether it's safe to enter their credit card number or medical information in a web form, in a world where CloudFlare "Flexible SSL" exists?

If a user thinks the presence of "https" means it's safe to enter credit card details or medical information, that's already a huge problem. Yes, "https" should be a prerequisite to entering sensitive information, but that's only part of it; the other part is whether you actually trust the server you're sending that information to. The server could be using ironclad encryption across the whole connection, but that doesn't mean they'll still handle your data safely. Any site that wants sensitive information like this has to do many things to ensure it's secure, and making sure they have a secure connection is only one of those things. If you trust that the server operator has done everything else necessary to keep your credit card details safe, then you should also trust that they're not using Flexible SSL.

Edit: Dear downvoters, can you please explain why you disagree? What I wrote really shouldn't be controversial in the least, so I don't understand the drive-by downvotes.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#132

Post by jgrahamc »

geofft wrote: post #123
jgrahamc wrote: post #48

Earlier quoted context omitted.

That's Google logging stuff

That's not how Google tells it, if I'm reading this right: Cloudflare explained that they pushed a change to production that logged malformed pages that were requested, and then sent me the list of URLs to double check. Many of the logged urls contained query strings from https requests that I don't think they intended to share. (I'm reading that as "intended to share with Google".)

Ah. I see what you mean. Apologies, kind of tired.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#133

Post by eridius »

cdelsolar wrote: post #76
eridius wrote: post #29

Earlier quoted context omitted.

I don't buy this argument. A site using Flexible SSL is no less secure than one using http:// , and in fact is more secure, because nobody can MitM the connection between CloudFlare and the end user. The only thing vulnerable is the connection between the website and CloudFlare (~~and only to MitM, not to passive sniffing~~ EDIT: this isn't true, see [1]), but that's a much smaller and much better-protected surface a…

Disagree. The point is that when people see that lock that tells you your connection is secure, when it's actually not, that causes more damage than if your connection was actually not secure (because then presumably you wouldn't be typing in credit card numbers and other sensitive info if you saw http:// in your address bar).

See https://news.ycombinator.com/item?id=13719468.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#134

Post by hannob »

AznHisoka wrote: post #111
tptacek wrote: post #4

Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…

Can someone tell me the implications of this in laymen terms? For instance what does it mean "sprayed into caches"? what cache? dns cache? browser cache? if the latter, does it mean you are safe if the person who owns that cache is an innocent non technical iser?

There are all kinds of places were things are cached, both on- and offline. Your data may end up in:

* Browser caches.

* Sites like wayback machine or search engines that make copies of webpages and save them.

* Tools that store data downloaded from the web, e.g. RSS readers.

* Caching proxies.

* the list goes on and on.

I think what tptacek wanted to say: It's just so common that people download things from the web and store them without even thinking much about it. And all those places where this happens now potentially can contain sensitive data.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#135

Post by rdl »

jgrahamc wrote: post #113
tptacek wrote: post #108

Earlier quoted context omitted.

How many different sites? Your team sent a list to Tavis's team. How many entries were on the list?

We identified 3,438 unique domains. I'm not sure if those were all sent to Tavis because we were only sending him things that we wanted purged.

3438 domains which someone could have queried, but potentially data from any site which had "recently" passed through Cloudflare would be exposed in response, right? Purging those results helps with search engines, but a hypothetical malicious secret crawler would still potentially have any data from any site.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#136

Post by benchaney »

eridius wrote: post #67
STRML wrote: post #35

Earlier quoted context omitted.

To my sibling: the issue is that people can and do consider Flexible SSL "good enough", when it really isn't. It gets you the green lock and the warm fuzzies, but the page just isn't secure. A false sense of security is worse than no security, because no security at least is glaringly obvious.

But it is secure. It's secure against the user being on an untrustworthy connection, it's secure against their ISP deciding to MitM their traffic, and it's also ~~secure against anyone passively sniffing the traffic between the website server and CloudFlare~~ (EDIT: No it's not, see [1]). The only thing it's not secure against is someone in a privileged network position who can MitM the connection between the website…

Actually, it is worse than just using plain HTTP because it tricks people into believing their connections are secure. There is a significant and growing group of lay people who have been trained not to input sensitive data into nonTLS web pages. "Flexible SSL" effectively screws them.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#138

Post by Scaevolus »

cperciva wrote: post #87
eridius wrote: post #32

Earlier quoted context omitted.

Ragel shares part of the blame. Why did it use a strict equality check when it could have trivially done a >=?

Even a >= check would have been suboptimal. Rather than /* generated code */ if ( ++p == pe ) goto _test_eof; or /* generated code */ if ( ++p >= pe ) goto _test_eof; they should have had /* generated code */ if ( ++p == pe ) goto _test_eof; assert(p since having servers core dumping would have drawn attention to the bug in a way that counting one byte too many and then hitting _test_eof would not.

Some assert() macros are disabled on release builds, so that's not exactly safe either.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#139

Post by tptacek »

AznHisoka wrote: post #111
tptacek wrote: post #4

Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…

Can someone tell me the implications of this in laymen terms? For instance what does it mean "sprayed into caches"? what cache? dns cache? browser cache? if the latter, does it mean you are safe if the person who owns that cache is an innocent non technical iser?

There are caches all over the Internet; Google and Microsoft run some of them, but so do virtually every Fortune 500 company, most universities, and governments all over the world.

The best way to understand the bug is this: if a particular HTTP response happened to be generated in response to a request, the response would be intermingled with random memory contents from Cloudflare's proxies. If that request/response happened through someone else's HTTP proxy --- for instance, because it was initiated by someone at a big company that routes all its traffic through a Bluecoat appliance --- then that appliance might still have that improperly disclosed memory saved.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#140

Post by eridius »

arestor wrote: post #104
eridius wrote: post #32

Earlier quoted context omitted.

Ragel shares part of the blame. Why did it use a strict equality check when it could have trivially done a >=?

It's C. If you have an array, you may only compare to one element behind the last. Everything else is undefined behavior. So a compiler may just "optimize" your >= to ==.

No it won't. It's using pointers, not array indices. The compiler has no possible way of knowing that `pe` is the one-past-the-end address.
Post reply on HN