Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

331–340 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#331

Post by lnanek2 »

chatmasta wrote: post #124
jgrahamc wrote: post #98

Earlier quoted context omitted.

You really want to see Cloudflare spend more time discussing how they've quantified the leak here. What would you like to see? The SAFE_CHAR logging allowed us to get data on the rate which is how I got the % of requests figure.

Perhaps as a follow up to this bug, you can write a temporary rule to log the domain of any http responses with malformed HTML that would have triggered a memory leak. That way you can patch the bug immediately, and observe future traffic to find the domains that were most likely affected by the bug when it was running. Or is the problem that one domain can trigger the memory leak, and another (unpredictable) domain…

Yes, the victim can be a different site. Cloudflare's post mentions this: " Because Cloudflare operates a large, shared infrastructure an HTTP request to a Cloudflare web site that was vulnerable to this problem could reveal information about an unrelated other Cloudflare site. " https://blog.cloudflare.com/incident-report-on-memory-leak-c...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#332

Post by problems »

toomuchtodo wrote: post #330
problems wrote: post #249

Earlier quoted context omitted.

Private fiber in other people's datacenters. Better I suppose, but not much.

Unencrypted over private fiber and unencrypted over the public internet are worlds apart.

That has nothing to do with using fiber vs internet though.

EDIT: Original comment said he could pull content off Google results. To respond to the new one:

No, they're not worlds apart when you're on the backbone. They still go through other people's datacenters and that's what causes the problem - we're not talking about stuff that goes over wifi or corporate networks here - we're talking generally just big ISPs in both cases.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#333

Post by eridius »

mattbee wrote: post #287
danielweber wrote: post #250

Earlier quoted context omitted.

I get this argument. I have made it in the past. But CF doesn't want to play Internet cop. Everyone who manages a service gets a constant barrage of "someone using your site did something offensive , I want you to kick them off your service!" CF has decided they are just not going to play the game, at all. Because once they start, then all the piranha come to feast. I'm not saying this means they aren't a racket, whi…

It's not a game, it's policing your own network and keeping your business activities legal. My network has run an abuse desk for 15 years and there are no feasting piranhas (what does that even mean?). Cloudflare definitely already runs an abuse desk, and ban accounts, they just choose not to ban network abuse tools. They are making the internet a more dangerous place for hosting, then asking you to buy a solution. T…

They could ban booters. But then someone else will say "but you allow ! They're clearly bad, you should ban them too". And so they do, and now someone else complains about some other site. Once you start banning sites for the content they hold, where do you draw the line? I don't fault CloudFlare for drawing it at the legal barrier (e.g. no CP).

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#334

Post by DINKDINK »

SomeCallMeTim wrote: post #80
joepie91_ wrote: post #52

Earlier quoted context omitted.

> My second thought after relief was the realization that even as a consumer I'm affected by this, my password manager has > 100 entries what percentage of them are using CloudFlare? Should I change all my passwords? Yes. Right now. Don't wait for the vendor to notify you. > What an epic mess. This is the problem with centralization, the system is broken. Yep.

My password manager has > 500 entries. Changing all the passwords....isn't going to happen any time soon. If it only took 60 seconds per site, it would still take eight hours to change them all. Might change a few key passwords, though. Couldn't hurt. I only have a couple of bank/financial passwords at this point. And my various hosting service access passwords. Anything else is not worth the hassle -- and mostly wou…

Your argument essentially revolves around "what are the chances I'll be compromised!?" rather than focusing on "What's the potentially affect of getting compromised" Most people with data or access rights which have several orders of magnitude of value relative to 8 hours worth of labor.

The decision to wear a seatbelt isn't driven by the probability of needing it, the decision is drive by the magnitude of exposure to an event where you would need it.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#335

Post by killing_time »

Natanael_L wrote: post #254
_wmd wrote: post #91

Earlier quoted context omitted.

It shouldn't be too difficult to feed an instrumented copy of the parser some fraction of their cached pages (after all, that's what they're for.. right?) and calculate a percentage of how many triggered e.g. valgrind, or just some magic string tacked on the end of the input appearing in the output or similar I prefer CloudScare to Cloudbleed :)

Downpour is my preference right now. The clouds are dumping everything they got

How about Cloudburst?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#337

Post by vengefulduck »

PuffinBlue wrote: post #187
espadrine wrote: post #125

Earlier quoted context omitted.

It is far from over, too! Google Cache still has loads of sensitive information, a link away! Look at this, click on the downward arrow, "Cached": https://www.google.com/search?q="CF-Host-Origin-IP:"+"author... (And then, in Google Cache, "view source", search for "authorization".) (Various combinations of HTTP headers to search for yield more results.)

> The infosec team worked to identify URIs in search engine caches that had leaked memory and get them purged. With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory. Those 770 unique URIs covered 161 unique domains. The leaked memory has been purged with the help of the search engines. So I tried it too, and there's still data cached there. Am…

I'm also seeing a ton from cn-dc1.uber.com with oauth, cookies and even geolocation info. https://webcache.googleusercontent.com/search?q=cache:VlVylT...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#338

Post by emmelaich »

tlrobinson wrote: post #236
espadrine wrote: post #125

Earlier quoted context omitted.

It is far from over, too! Google Cache still has loads of sensitive information, a link away! Look at this, click on the downward arrow, "Cached": https://www.google.com/search?q="CF-Host-Origin-IP:"+"author... (And then, in Google Cache, "view source", search for "authorization".) (Various combinations of HTTP headers to search for yield more results.)

The first couple I looked at were requests to Uber and Fitbit...

One of my Uber rides two weeks ago went completely nuts. Both my and my drivers app screwed up at the same time and I was never picked up and then seconds later the app claimed I reached my destination.

You have to wonder whether something like this is implicated.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#339

Post by curuinor »

curuinor wrote: post #264

Can we start a list of affected right now? I found: OKCupid Uber people claiming 1Password, can't find Reddit Lyft Yelp Pingdom Digital Ocean Montecito Bank and Trust

Patreon

4chan used to use it apparently, don't know if affected

kik

Zoho CRM

change.org

Cloudflare itself, of course

Feedly

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#340

Post by nerdponx »

infinity0 wrote: post #307
PuffinBlue wrote: post #187

Earlier quoted context omitted.

> The infosec team worked to identify URIs in search engine caches that had leaked memory and get them purged. With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory. Those 770 unique URIs covered 161 unique domains. The leaked memory has been purged with the help of the search engines. So I tried it too, and there's still data cached there. Am…

Could someone enlighten me on why malloc and free don't automatically zero memory by default? Someone pointed me to MALLOC_PERTURB_ and I've just run a few test programs with it set - including a stage1 GCC compile, which granted may not be the best test - and it really doesn't dent performance by much. (edit: noticeably, at all , in fact) People who prefer extreme performance over prudent security should be the ones…

Are these results hardware independent? Maybe it makes a difference on older machines, or different architectures.
Post reply on HN