Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

201–210 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#201

Post by travem »

rdl wrote: post #31
tyingq wrote: post #27

Earlier quoted context omitted.

Sounds bad to me... "We've discovered (and purged) cached pages that contain private messages from well-known services, PII from major sites that use cloudflare, and even plaintext API requests from a popular password manager that were sent over https (!!)." The trouble is you have no way to know if someone discovered this earlier, and harvested info for a long time. Or, how much harvested info from your site might b…

Does 1Password really send anything meaningful in their API queries, or is it encrypted separately and then just sent over HTTPS?

According to their blog post about this issue they use multiple levels of encryption to guard against compromise at the SSL/TLS layer - https://blog.agilebits.com/2017/02/23/three-layers-of-encryp...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#202

Post by tptacek »

jgrahamc wrote: post #113
tptacek wrote: post #108

Earlier quoted context omitted.

How many different sites? Your team sent a list to Tavis's team. How many entries were on the list?

We identified 3,438 unique domains. I'm not sure if those were all sent to Tavis because we were only sending him things that we wanted purged.

Here's a question your blog post doesn't answer but should, right now:

Exactly which search engines and cache providers did you work with to scrub leaked data?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#203

Post by arestor »

eridius wrote: post #140
arestor wrote: post #104

Earlier quoted context omitted.

It's C. If you have an array, you may only compare to one element behind the last. Everything else is undefined behavior. So a compiler may just "optimize" your >= to ==.

No it won't. It's using pointers, not array indices. The compiler has no possible way of knowing that `pe` is the one-past-the-end address.

It's still UB. The array could potentially be at the end of the address space...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#205

Post by neuland »

sparkling wrote: post #96
bubblethink wrote: post #83

Earlier quoted context omitted.

How do you check if a website uses cloudflare ? Any scripts that do that ?

$ dig example.com to get the A Record, then $ whois 1.2.3.4|grep Cloudflare Not 100% reliable, but should do the Job.

    whois $(dig +short yoursitehere.com) | grep -i 'Cloudflare' 1>/dev/null; if [[ $? -eq 1 ]]; then echo 'Didnt find CloudFlare'; else echo 'Found CloudFlare'; fi
Not at a terminal now, but this long one-liner should work.

Like you said, not 100% reliable though. For example, I'm pretty sure Reddit uses CloudFlare, but their whois mentions Fastly, which is a competitor.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#206

Post by jgrahamc »

sfeng wrote: post #194
Retr0spectrum wrote: post #190

Earlier quoted context omitted.

https://webcache.googleusercontent.com/search?q=cache:lw4K9G... Internal Upstream Server Certificate ... /C=US/ST=California/L=San Francisco/O=Cloudflare Inc./OU=Cloudflare Services - nginx-cache/CN=Internal Upstream Server Certificate That really doesn't look good.

Just to point out, this is apparently a cert used for communicating between Cloudflare's services which has (presumably) been replaced. Cloudflare customer's certs weren't exposed.

Correct. That's that cert.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#207

Post by WillyOnWheels »

sparkling wrote: post #109
joepie91_ wrote: post #54

This is probably a good moment to recall the article I published a while ago about how CloudFlare is actively putting the web at risk: http://cryto.net/~joepie91/blog/2016/07/14/cloudflare-we-hav... This is precisely why. The only thing that surprises me about this, is that it was an accidental disclosure rather than a breach. Other than that, this was completely to be expected . EDIT: Also, this can't be repeated en…

Related: http://crimeflare.com/

Just looking at that site... what's so bad about Wikipedia? There's a lot to criticize about Wikipedia, but I've never heard of them violating someone's privacy.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#208

Post by jamwt »

cperciva wrote: post #171
Scaevolus wrote: post #138

Earlier quoted context omitted.

Some assert() macros are disabled on release builds, so that's not exactly safe either.

True, but I'd hope that NDEBUG is now widely recognized as being a horrible misfeature.

Yes, hate, hate NDEBUG. Such a terrible idea to disable assertions.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#209

Post by Pils »

jeremygeros wrote: post #90
davb wrote: post #61

Earlier quoted context omitted.

Thankfully it looks like it's not 1Password, who seem to use AWS CloudFront.

According to Tavis Ormandy's twitter post it was 1Password, https://twitter.com/taviso/status/834900838837411840

1Password's blog post responding to this incident: https://blog.agilebits.com/2017/02/23/three-layers-of-encryp...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#210

Post by eridius »

mattbee wrote: post #148

Cloudflare isn't just a security hole in the middle of the internet, they're a protection racket. If you wanted to pay to DDoS a site, search for "booter" and you'll get a list of sites that will take another site off the internet for money with a flood of traffic. quezstresser.com webstresser.co topbooter.co instabooter.com booter.xyz critical-boot.com top10booters.com betabooter.com databooter.com etc. etc. - from…

In what way is this a protection racket? That's sort of like complaining that mob-owned businesses enjoy the same police & fire protection that all other businesses have.
Post reply on HN