Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

291–300 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#291

Post by sikhnerd »

PuffinBlue wrote: post #187
espadrine wrote: post #125

Earlier quoted context omitted.

It is far from over, too! Google Cache still has loads of sensitive information, a link away! Look at this, click on the downward arrow, "Cached": https://www.google.com/search?q="CF-Host-Origin-IP:"+"author... (And then, in Google Cache, "view source", search for "authorization".) (Various combinations of HTTP headers to search for yield more results.)

> The infosec team worked to identify URIs in search engine caches that had leaked memory and get them purged. With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory. Those 770 unique URIs covered 161 unique domains. The leaked memory has been purged with the help of the search engines. So I tried it too, and there's still data cached there. Am…

jgrahamc: can you list which public caches you worked with to attempt to address this? It does not inspire confidence when even google is still showing obvious results

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#292

Post by chris_7 »

davb wrote: post #61
loeg wrote: post #46

Anyone know which password manager uses Cloudflare? Just trying to figure out if I'm affected.

Thankfully it looks like it's not 1Password, who seem to use AWS CloudFront.

I am confused - why is 1Password is using anything but iCloud or Dropbox? Those are the only options I see (and "Folder" which is presumably just local).

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#296

Post by nmjenkins »

curuinor wrote: post #272
curuinor wrote: post #264

Can we start a list of affected right now? I found: OKCupid Uber people claiming 1Password, can't find Reddit Lyft Yelp Pingdom Digital Ocean Montecito Bank and Trust

I found: FitBit Hacker News Stack Overflow Zendesk Discord FastMail (not really see below)

We, FastMail, are not affected by this. We do not proxy TLS connections via any third party. We use CloudFlare for DNS distribution only, which is not part of this issue.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#297

Post by eridius »

vertex-four wrote: post #253
WillyOnWheels wrote: post #195

Earlier quoted context omitted.

Can you think of an existing system (let's go with websites) that meets your standards?

There isn't an automated system that can tell you whether it's safe to give data to a website, just like there's no automated system which can tell you a given vendor/service provider in general is reputable. All you've got is regulations, human-based reputation ranking, and public shaming.

Exactly this. Anytime you give sensitive information to another party you have to evaluate the risk. Having an insecure connection to that party is obviously risky, but that doesn't mean that having a secure connection means there's no risk. Companies that accept sensitive information while using Flexible SSL are probably mishandling your data in other ways too.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#298

Post by nickpsecurity »

bigiain wrote: post #88
_wmd wrote: post #11

Step 1) MITM the entire Internet, undermining its SSL infrastructure, build a business around it Step 2) leak cleartext from said MITM'd connections to the entire Internet I recently noted that in some ways Cloudflare are probably the only entity to have ever managed to cause more damage to popular cryptography since the 2008 Debian OpenSSL bug (thanks to their "flexible" ""SSL"" """feature"""), but now I'm certain o…

Step 0) Obtain black funding from NSA budget to start and "VC invest" in a global CDN company... (Now I'm trawling Crunchbase to see if I can work out which investors are NSA front companies, then I'm gonna look to see what _else_ them and their partners have invested in...)

"Step 0) Obtain black funding from NSA budget to start and "VC invest" in a global CDN company..."

I once came up with that exact concept for a nation-state subversion. It would even pay for itself over time. I kept thinking back to it seeing the rise of the CDN's and the security approaches that trust them.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#300

Post by mintplant »

taviso wrote: post #289
danielweber wrote: post #284

Earlier quoted context omitted.

Good. They're trying to clean up all the private data leaked everywhere. I tempted to say "why couldn't they figure out this google dork themselves" but they've probably been slammed for the past 7 days cleaning up a bunch of stuff anyway.

You have no idea.

FYI, I'm seeing some more of these results show up (with active caches) for the following searches:

"CF-RAY" "CF-Force-Miss-TS"

"X-SSL-Server-Name"

"Internal Upstream Server Certificate0"

Post reply on HN