for easy firewalling and i'm sure a fun internet experience https://www.cloudflare.com/ips-v4
Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
241–250 of 1001 posts
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#242Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#243Neither this thread nor the Cloudflare blog post include concise steps for customers who were exposed. There's an argument for changing secrets (user passwords, API keys, etc.) for potentially affected sites, plus of course investigating logs for any anomalous activity. It would be nice if there were a guide for affected users, maybe a supplemental blog post. (and yet again: thank you Google for Project Zero!)
Right there with you. I'm currently scrambling for remediation ideas. "Change everything" isn't tractable.
>I'm currently scrambling for remediation ideas. "Change everything" isn't tractable.
It's not easy to deal with but it is the best remediation available to you, given the exceptionally broad scope and months-long period where data was apparently leaking (the cloudflare blog post lists 2016-09-22 as the first date when leaks were possible)
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#244Some important parts: The examples we're finding are so bad, I cancelled some weekend plans to go into the office on Sunday to help build some tools to cleanup. I've informed cloudflare what I'm working on. I'm finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings. We're talking full https requests, c…
Connecting some dots, I'm wondering if the "well-known chat service" is Slack:
http://www.computing.co.uk/ctg/news/2462266/whatsapp-reddit-...
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#245Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…
Can someone tell me the implications of this in laymen terms? For instance what does it mean "sprayed into caches"? what cache? dns cache? browser cache? if the latter, does it mean you are safe if the person who owns that cache is an innocent non technical iser?
As for the SHA-1 collision mentioned by jgrahamc[1] earlier today:
How am I going to explain this to my wife?
Actually a serious question. How do we communicate something like this to the general public?
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#246Earlier quoted context omitted.
> My second thought after relief was the realization that even as a consumer I'm affected by this, my password manager has > 100 entries what percentage of them are using CloudFlare? Should I change all my passwords? Yes. Right now. Don't wait for the vendor to notify you. > What an epic mess. This is the problem with centralization, the system is broken. Yep.
So it's fixed, then? (I haven't read the article yet.)
No, nothing is fixed. The leak has been plugged, but the water damage (and partly the water itself) is still there.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#247Earlier quoted context omitted.
How many different sites? Your team sent a list to Tavis's team. How many entries were on the list?
We identified 3,438 unique domains. I'm not sure if those were all sent to Tavis because we were only sending him things that we wanted purged.
Are you guys planning to release the list so we can all change our passwords on affected services? Or are you planning on letting those services handle the communication?
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#248This sounds to me like an object lesson in "Why you shouldn't write your own HTML parser." Every time I see a dev trying to parse HTML with a custom solution or regex or anything other than a proven OSS library designed to parse HTML I recoil reflexively. Sure, maybe you don't need a parser to see if that strong tag is properly closed but the alternative is ...
You're right in 99+% of cases. But I suspect that the needs of cloudflare for this use case aren't typical of what's expected of an html parser. I'm not certain that there isn't an existing parser that would work for them, but I'm equally not certain that there is.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#249Earlier quoted context omitted.
"Cloudflare undermines that entirely. " In their defense, this is a flaw of the whole SSL/TLS security model. I think even Google did that before Snowden, presented you with https:// urls but proxied everything in clear text (they claim they don't do it now). Still, you can be pretty sure that many https websites might pass traffic in clear text to their backends and not necessary take security even a little bit seri…
Google at least proxied everything over their own private fiber. Cloudflare proxies it over the public internet on a long route (since they terminate SSL as close to the client as possible).
Private fiber in other people's datacenters. Better I suppose, but not much.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#250Earlier quoted context omitted.
In what way is this a protection racket? That's sort of like complaining that mob-owned businesses enjoy the same police & fire protection that all other businesses have.
Cloudflare sells protection from the internet attacks through its network. The same company and network facilitates the organisation of those same attacks, and helps keep them anonymous. That's a high-tech protection racket.
I get this argument. I have made it in the past.
But CF doesn't want to play Internet cop. Everyone who manages a service gets a constant barrage of "someone using your site did something offensive, I want you to kick them off your service!"
CF has decided they are just not going to play the game, at all. Because once they start, then all the piranha come to feast.
I'm not saying this means they aren't a racket, which is charging people money to solve a problem you made. But they do have some good reasons for simply refusing to censor what they offer.