Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

271–280 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#271

Post by Edmond »

espadrine wrote: post #125
tptacek wrote: post #4

Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…

It is far from over, too! Google Cache still has loads of sensitive information, a link away! Look at this, click on the downward arrow, "Cached": https://www.google.com/search?q="CF-Host-Origin-IP:"+"author... (And then, in Google Cache, "view source", search for "authorization".) (Various combinations of HTTP headers to search for yield more results.)

more results from duckduckgo: https://duckduckgo.com/?q=+%7B%22scheme%22%3A%22http%22%7D+C...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#272

Post by curuinor »

curuinor wrote: post #264

Can we start a list of affected right now? I found: OKCupid Uber people claiming 1Password, can't find Reddit Lyft Yelp Pingdom Digital Ocean Montecito Bank and Trust

I found:

FitBit

Hacker News

Stack Overflow

Zendesk

Discord

FastMail (not really see below)

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#273

Post by cancancan »

the_common_man wrote: post #173
bubblethink wrote: post #83

Earlier quoted context omitted.

How do you check if a website uses cloudflare ? Any scripts that do that ?

$ host -t NS digitalocean.com digitalocean.com name server walt.ns.cloudflare.com. digitalocean.com name server kim.ns.cloudflare.com.

That may not necessarily work. Example:

  $ host -t NS okcupid.com
  okcupid.com name server nameserver2.okcupid.com.
  okcupid.com name server nameserver1.okcupid.com.
But if you check the response headers you'll see 'CF-RAY:...' and 'Server: cloudflare-nginx'

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#274

Post by eridius »

mattbee wrote: post #233
eridius wrote: post #210

Earlier quoted context omitted.

In what way is this a protection racket? That's sort of like complaining that mob-owned businesses enjoy the same police & fire protection that all other businesses have.

Cloudflare sells protection from the internet attacks through its network. The same company and network facilitates the organisation of those same attacks, and helps keep them anonymous. That's a high-tech protection racket.

It's not a racket. Refusing to police their own customers, and having customers that do bad things that CloudFlare incidentally helps protect against, does not make it a racket.

In a protection racket (or more accurately an extortion racket), businesses that don't pay up will get attacked by the racketeers, and so for the most part paying up just means the racketeer won't attack them. That doesn't even remotely describe CloudFlare. Whether or not you pay for CloudFlare doesn't affect whether some other customer of CloudFlare attacks you. And the fact that those other customers are using CloudFlare themselves does not make CloudFlare responsible for their actions.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#275

Post by eridius »

arestor wrote: post #203
eridius wrote: post #140

Earlier quoted context omitted.

No it won't. It's using pointers, not array indices. The compiler has no possible way of knowing that `pe` is the one-past-the-end address.

It's still UB. The array could potentially be at the end of the address space...

Well yes, it could, but that's not really an argument for saying that Ragel using == is just as good as using >=.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#276

Post by vbernat »

arestor wrote: post #104
eridius wrote: post #32

Earlier quoted context omitted.

Ragel shares part of the blame. Why did it use a strict equality check when it could have trivially done a >=?

It's C. If you have an array, you may only compare to one element behind the last. Everything else is undefined behavior. So a compiler may just "optimize" your >= to ==.

It's not an array. It's inside a large buffer allocated by nginx.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#277

Post by curuinor »

curuinor wrote: post #264

Can we start a list of affected right now? I found: OKCupid Uber people claiming 1Password, can't find Reddit Lyft Yelp Pingdom Digital Ocean Montecito Bank and Trust

https://stackshare.io/cloudflare

RapGenius

Coinbase

Bitpay

Product Hunt

Udemy

Crunchyroll

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#278

Post by nine_k »

bigiain wrote: post #88
_wmd wrote: post #11

Step 1) MITM the entire Internet, undermining its SSL infrastructure, build a business around it Step 2) leak cleartext from said MITM'd connections to the entire Internet I recently noted that in some ways Cloudflare are probably the only entity to have ever managed to cause more damage to popular cryptography since the 2008 Debian OpenSSL bug (thanks to their "flexible" ""SSL"" """feature"""), but now I'm certain o…

Step 0) Obtain black funding from NSA budget to start and "VC invest" in a global CDN company... (Now I'm trawling Crunchbase to see if I can work out which investors are NSA front companies, then I'm gonna look to see what _else_ them and their partners have invested in...)

Covertly get into a company that terminates ssl for half the internet, and... spill your precious secrets everywhere, instead of siphoning them off silently?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#279

Post by jleader »

sparkling wrote: post #121
kalmi10 wrote: post #112

Earlier quoted context omitted.

Headers (among other sensitive stuff) were being leaked inside document bodies.

So just to clarify: some bug makes Cloudflare leak the HTTP Headers into the HTML being served and those HTML pages containing sensitive Info got cached by Google (and others)?

They leak uninitialized memory contents into the HTML being served; that memory could (and did) contain data from any other traffic that passed through their hands.

So a request sent to Cloudflare customer A's site could return data from Cloudflare customer B, including data that B thought was only being served via https to authenticated users of B.

Post reply on HN