Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

231–240 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#231

Post by ing33k »

bubblethink wrote: post #83
joepie91_ wrote: post #52

Earlier quoted context omitted.

> My second thought after relief was the realization that even as a consumer I'm affected by this, my password manager has > 100 entries what percentage of them are using CloudFlare? Should I change all my passwords? Yes. Right now. Don't wait for the vendor to notify you. > What an epic mess. This is the problem with centralization, the system is broken. Yep.

How do you check if a website uses cloudflare ? Any scripts that do that ?

There's this browser addon

https://chrome.google.com/webstore/detail/claire/fgbpcgddpmj...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#232

Post by PuffinBlue »

dsp1234 wrote: post #164
kristianp wrote: post #150

Earlier quoted context omitted.

Wow, I just tried this, the first result with a google cache copy has a bunch of the kind of data described. Although there was only one result with a cache.

PII, OAuth data, etc.

I've so far seen an oAuth key for fitbit (via their android app) and api keys for trakt (though apparently that service doesn't use them?)

I don't know, this just seems catastrophic.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#233

Post by mattbee »

eridius wrote: post #210
mattbee wrote: post #148

Cloudflare isn't just a security hole in the middle of the internet, they're a protection racket. If you wanted to pay to DDoS a site, search for "booter" and you'll get a list of sites that will take another site off the internet for money with a flood of traffic. quezstresser.com webstresser.co topbooter.co instabooter.com booter.xyz critical-boot.com top10booters.com betabooter.com databooter.com etc. etc. - from…

In what way is this a protection racket? That's sort of like complaining that mob-owned businesses enjoy the same police & fire protection that all other businesses have.

Cloudflare sells protection from the internet attacks through its network. The same company and network facilitates the organisation of those same attacks, and helps keep them anonymous.

That's a high-tech protection racket.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#234

Post by Kalium »

jgrahamc wrote: post #132
geofft wrote: post #123

Earlier quoted context omitted.

That's not how Google tells it, if I'm reading this right: Cloudflare explained that they pushed a change to production that logged malformed pages that were requested, and then sent me the list of URLs to double check. Many of the logged urls contained query strings from https requests that I don't think they intended to share. (I'm reading that as "intended to share with Google".)

Ah. I see what you mean. Apologies, kind of tired.

Understandably, I think. I can't imagine you've had much sleep this week.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#235

Post by HappyTypist »

jgrahamc wrote: post #2

Full details from Cloudflare: https://blog.cloudflare.com/incident-report-on-memory-leak-c...

Why is your company severely downplaying it?

Honestly, this is the biggest security incident in a long time, and proper mitigation would probably warrant:

- forcefully terminating all cookies on CloudFlare sites, cloudflare already injects JS onto the page anyway

- MITMing all CloudFlare sites with a warning for users to change their passwords

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#236

Post by tlrobinson »

espadrine wrote: post #125
tptacek wrote: post #4

Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…

It is far from over, too! Google Cache still has loads of sensitive information, a link away! Look at this, click on the downward arrow, "Cached": https://www.google.com/search?q="CF-Host-Origin-IP:"+"author... (And then, in Google Cache, "view source", search for "authorization".) (Various combinations of HTTP headers to search for yield more results.)

The first couple I looked at were requests to Uber and Fitbit...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#237

Post by zzzcpan »

pepve wrote: post #199
eridius wrote: post #32

Earlier quoted context omitted.

Ragel shares part of the blame. Why did it use a strict equality check when it could have trivially done a >=?

That's a great defensive technique. But even when you do that, the underlying bug should still be fixed. I don't think the equality operator is the underlying bug. Consecutive pointer increments without a bounds check in between sounds like a bug to me. But I don't really know Ragel, and perhaps the compiler doesn't have enough information to determine this is what's happening.

Ragel is a low-level tool, it doesn't operate on bounds-checkable abstractions. But it does allow you to specify how to get the character, where you can do bounds-checking, if you need.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#238

Post by danielweber »

dmitrygr wrote: post #37

Cloudflare's announcement, as it is currently worded, deserves the understatement-of-the-centry award.

"Don't worry, the keys weren't compromised."

I know how to replace my TLS keys. I have no idea how to replace everything else.

It's like people who think losing my credit card number is the worst thing. No, it can be a hassle, but once I replace it I'm okay. It's everything else.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#239

Post by freakz »

bubblethink wrote: post #83
joepie91_ wrote: post #52

Earlier quoted context omitted.

> My second thought after relief was the realization that even as a consumer I'm affected by this, my password manager has > 100 entries what percentage of them are using CloudFlare? Should I change all my passwords? Yes. Right now. Don't wait for the vendor to notify you. > What an epic mess. This is the problem with centralization, the system is broken. Yep.

How do you check if a website uses cloudflare ? Any scripts that do that ?

Icon lights up if the current site is on Cloudflare proxy.

https://chrome.google.com/webstore/detail/claire/fgbpcgddpmj...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#240

Post by joepie91_ »

bubblethink wrote: post #83
joepie91_ wrote: post #52

Earlier quoted context omitted.

> My second thought after relief was the realization that even as a consumer I'm affected by this, my password manager has > 100 entries what percentage of them are using CloudFlare? Should I change all my passwords? Yes. Right now. Don't wait for the vendor to notify you. > What an epic mess. This is the problem with centralization, the system is broken. Yep.

How do you check if a website uses cloudflare ? Any scripts that do that ?

There is no reliable way to check. The problem is that even if you verify that a site isn't using CloudFlare now, that doesn't mean that they didn't use it in the past (and you'd still be affected).

In other words: Just assume that everything has been compromised. With how much of the web CloudFlare controls nowadays, you're not going to be far off anyway.

Post reply on HN