Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

191–200 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#191

Post by cperciva »

eli wrote: post #178
manigandham wrote: post #97

Earlier quoted context omitted.

Why? Many can help find problems without having to be full-time, that's the point of crowd-sourcing with payouts.

Because you'll make much more working for people who specifically hire you instead of doing a bunch of risky work on spec.

The point of bug bounties isn't to attract the interest of people who are working to find bugs. It's to make sure that if someone is finding bugs for fun or stumbles over bugs by accident, it's worth their time to report the bugs.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#192

Post by r1ch »

zzzcpan wrote: post #144
lmm wrote: post #81

Earlier quoted context omitted.

The only thing the end user has is the difference between http:// and https:// . Cloudflare undermines that entirely. How can a user possibly ever know whether it's safe to enter their credit card number or medical information in a web form, in a world where CloudFlare "Flexible SSL" exists?

"Cloudflare undermines that entirely. " In their defense, this is a flaw of the whole SSL/TLS security model. I think even Google did that before Snowden, presented you with https:// urls but proxied everything in clear text (they claim they don't do it now). Still, you can be pretty sure that many https websites might pass traffic in clear text to their backends and not necessary take security even a little bit seri…

Google at least proxied everything over their own private fiber. Cloudflare proxies it over the public internet on a long route (since they terminate SSL as close to the client as possible).

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#193

Post by beachstartup »

tptacek wrote: post #129
jgrahamc wrote: post #113

Earlier quoted context omitted.

We identified 3,438 unique domains. I'm not sure if those were all sent to Tavis because we were only sending him things that we wanted purged.

What anomalies would be apparent in your logs if someone malicious had discovered this flaw and used it to generate a large corpus of leaked HTTP content?

it seems to me you'd have to know at a minimum:

1. every tag pattern that triggers the bug(s)

2. which broken pages with that pattern were requested at an abnormally high frequency or had an unusually short TTL (or some other useful heuristic)

3. on which servers, and at what time, in order to tell

4. who's data lived on the same servers at the same time as those broken pages

to even begin to estimate the scope of the leak. and that doesn't even help you find who planted the bad seeds.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#194

Post by sfeng »

Retr0spectrum wrote: post #190
espadrine wrote: post #125

Earlier quoted context omitted.

It is far from over, too! Google Cache still has loads of sensitive information, a link away! Look at this, click on the downward arrow, "Cached": https://www.google.com/search?q="CF-Host-Origin-IP:"+"author... (And then, in Google Cache, "view source", search for "authorization".) (Various combinations of HTTP headers to search for yield more results.)

https://webcache.googleusercontent.com/search?q=cache:lw4K9G... Internal Upstream Server Certificate ... /C=US/ST=California/L=San Francisco/O=Cloudflare Inc./OU=Cloudflare Services - nginx-cache/CN=Internal Upstream Server Certificate That really doesn't look good.

Just to point out, this is apparently a cert used for communicating between Cloudflare's services which has (presumably) been replaced. Cloudflare customer's certs weren't exposed.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#195

Post by WillyOnWheels »

eridius wrote: post #131
lmm wrote: post #81

Earlier quoted context omitted.

The only thing the end user has is the difference between http:// and https:// . Cloudflare undermines that entirely. How can a user possibly ever know whether it's safe to enter their credit card number or medical information in a web form, in a world where CloudFlare "Flexible SSL" exists?

If a user thinks the presence of "https" means it's safe to enter credit card details or medical information, that's already a huge problem. Yes, "https" should be a prerequisite to entering sensitive information, but that's only part of it; the other part is whether you actually trust the server you're sending that information to. The server could be using ironclad encryption across the whole connection, but that do…

Can you think of an existing system (let's go with websites) that meets your standards?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#196

Post by chrisper »

sparkling wrote: post #121
kalmi10 wrote: post #112

Earlier quoted context omitted.

Headers (among other sensitive stuff) were being leaked inside document bodies.

So just to clarify: some bug makes Cloudflare leak the HTTP Headers into the HTML being served and those HTML pages containing sensitive Info got cached by Google (and others)?

Yes. Think of it this way.

You have a function that strips all colons from your input. For some reason - in certain cases - your code misbehaves and when you are replacing the colons with an empty character you accidentally replace that colon with other data you have in the memory. So now all the colons in your input have been replaced with data that you shouldn't have touched. So now whoever sent you an input, gets back that input + more data they shouldn't be able to see.

And Google in this case caches those output strings.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#197

Post by zaatar »

fjarlq wrote: post #114
rdl wrote: post #31

Earlier quoted context omitted.

Does 1Password really send anything meaningful in their API queries, or is it encrypted separately and then just sent over HTTPS?

For what it's worth, I've posted this question in 1Password's support forum, which is frequented by 1Password staff: https://discussions.agilebits.com/discussion/75711/cloudblee...

1Password has said via their blog that nothing was compromised whatsoever: https://blog.agilebits.com/2017/02/23/three-layers-of-encryp...

More details are promised in the coming days.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#198

Post by foodstances »

dsp1234 wrote: post #167
rdl wrote: post #135

Earlier quoted context omitted.

3438 domains which someone could have queried, but potentially data from any site which had "recently" passed through Cloudflare would be exposed in response, right? Purging those results helps with search engines, but a hypothetical malicious secret crawler would still potentially have any data from any site.

It doesn't have to be a secret crawler. Just one that wasn't contacted by cloudflare (I didn't see any non-US search providers mentioned).

I wonder if archive.org or archive.is have anything cached...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#199

Post by pepve »

eridius wrote: post #32
jgrahamc wrote: post #25

Earlier quoted context omitted.

I don't blame Ragel.

Ragel shares part of the blame. Why did it use a strict equality check when it could have trivially done a >=?

That's a great defensive technique. But even when you do that, the underlying bug should still be fixed. I don't think the equality operator is the underlying bug.

Consecutive pointer increments without a bounds check in between sounds like a bug to me. But I don't really know Ragel, and perhaps the compiler doesn't have enough information to determine this is what's happening.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#200

Post by georgemcbay »

rdl wrote: post #156
taviso wrote: post #154

Earlier quoted context omitted.

correct

fuck :(

It may seem like a nightmare Internet data security scenario, but it looks like Tavis is going to get a free t-shirt out of the deal, so let's just call it a wash.
Post reply on HN