Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

221–230 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#221

Post by aidos »

vmarsy wrote: post #186
aidos wrote: post #159

Earlier quoted context omitted.

That's also what I'm interested in. There's a lot of talk about the sites that had the features enabled that allowed the data to escape, but it's the sites that were co-existing with those that were in danger. In terms of the caching, knowing the broken sites tells you where to look in the caches after the fact, but do you have any idea of who's data was leaked? Presumably 2 consecutive requests to the same malformed…

> Presumably 2 consecutive requests to the same malformed page could/would leak different data. Wouldn't the second request be served from the CDN cache? Since for Cloudfare that particular page is a valid cached page, it would send you that same page on the second request.

I don't know enough about the layers in the cloudflare system to say. Does it only apply to cached pages? What about https? They would have the ssl termination first and then these errant servers behind that - none of those pages would be cached, right?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#222

Post by jgrahamc »

dantiberian wrote: post #163

From Twitter: "@taviso their post-mortem indicates this would've been exploitable only 4 days prior to your initial contact. Is that info invalid?" - https://twitter.com/pmoust/status/834916647873961984 "@pmoust Yes, they worded it confusingly. It was exploitable for months, we have the cached data." - https://twitter.com/taviso/status/834918182640996353

From my blog on this:

    The three features implicated were rolled out as follows. 
    The earliest date memory could have leaked is 2016-09-22.

    2016-09-22 Automatic HTTP Rewrites enabled 
    2017-01-30 Server-Side Excludes migrated to new parser 
    2017-02-13 Email Obfuscation partially migrated to new parser 
    2017-02-18 Google reports problem to Cloudflare and leak is stopped

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#223

Post by user5994461 »

nathancahill wrote: post #185
user5994461 wrote: post #149

> The greatest period of impact was from February 13 and February 18 with around 1 in every 3,300,000 HTTP requests through Cloudflare potentially resulting in memory leakage (that’s about 0.00003% of requests). 1) From the metrics I recalled when I interviewed there, and assuming the given probability is correct, that means a potential of 100k-200k paged with private data leaked every day. 2) What's the probably tha…

I think your estimates fell apart at step 2, 1/1000 pages being cached. HTTP is aggressively cached, on many different layers. I'd put it closer to 1/10.

I meant cached by a public service like Google Cache Bing Archive.org that expose the pages.

A browser cache might be 1/10 but that's not open.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#224

Post by tootie »

_wmd wrote: post #11

Step 1) MITM the entire Internet, undermining its SSL infrastructure, build a business around it Step 2) leak cleartext from said MITM'd connections to the entire Internet I recently noted that in some ways Cloudflare are probably the only entity to have ever managed to cause more damage to popular cryptography since the 2008 Debian OpenSSL bug (thanks to their "flexible" ""SSL"" """feature"""), but now I'm certain o…

CloudFlare is neither the first nor the biggest CDN. I can't recall Akamai having a hole this big. They're either more secure or better at keeping things quiet.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#225

Post by biafra »

genericpseudo wrote: post #175
rdl wrote: post #156

Earlier quoted context omitted.

fuck :(

Which means any user who has used any service which uses CloudFlare, right? At least in theory.

How can I find out which services I have accounts with are using cloudflare? Or better have been using cloudflare in recent months? Assume I have a list of domains, where I have accounts.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#226

Post by dsp1234 »

tptacek wrote: post #202
jgrahamc wrote: post #113

Earlier quoted context omitted.

We identified 3,438 unique domains. I'm not sure if those were all sent to Tavis because we were only sending him things that we wanted purged.

Here's a question your blog post doesn't answer but should, right now: Exactly which search engines and cache providers did you work with to scrub leaked data?

Also, have you worked with any search engine to notify affected customers.

ex: Right now there is in an easily found google cached page with OAuth tokens for very popular fitness wearable's android API endpoints

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#227

Post by toyg »

kogir wrote: post #57

I'm not 100% clear: Only three features were affected, and only sites with one or more of those features enabled leaked data into their pages. But was the leaked data similarly limited to only the sites with the features enabled? Or could it have come from any request - even an entirely unrelated site?

> only sites with one or more of those features enabled leaked data

No. From what he says, enabling that feature on a CF proxy basically triggered the bug on any site that happened to go through that proxy, regardless of whether it used the feature or not.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#229

Post by abeyer »

sfeng wrote: post #177
mattbee wrote: post #148

Cloudflare isn't just a security hole in the middle of the internet, they're a protection racket. If you wanted to pay to DDoS a site, search for "booter" and you'll get a list of sites that will take another site off the internet for money with a flood of traffic. quezstresser.com webstresser.co topbooter.co instabooter.com booter.xyz critical-boot.com top10booters.com betabooter.com databooter.com etc. etc. - from…

You are essentially arguing against freedom of speech. Cloudflare will protect any site that doesn't host child porn. Yes that includes things which you don't like, but it also includes all the things you do.

> Cloudflare will protect any site that doesn't host child porn

Doesn't that make it worse? They aren't saying they don't or won't police the content they protect. They are obviously capable and willing to draw a line on ethical or legal grounds, if they have done so in that case. They have just chosen to draw that line on one side of porn but another side of DDoS services.

Ultimately it is their decision to make, but I don't think it's unfair for people to question possible conflicts of interest in how that decision is made.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#230

Post by danielweber »

sparkling wrote: post #121
kalmi10 wrote: post #112

Earlier quoted context omitted.

Headers (among other sensitive stuff) were being leaked inside document bodies.

So just to clarify: some bug makes Cloudflare leak the HTTP Headers into the HTML being served and those HTML pages containing sensitive Info got cached by Google (and others)?

Yeah.

"We leaked information from Customer A to Customer B by accident" is the first order problem.

But the existence of web caches means that all that private information of customer A is potentially fucking everywhere now.

How do you even clean this up? How do you even start?

Post reply on HN