Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

Post by Lxr » Fri, Feb 24, 2017, 2:23 AM UTC

infinity0 wrote: post #307

PuffinBlue wrote: post #187

Earlier quoted context omitted.

> The infosec team worked to identify URIs in search engine caches that had leaked memory and get them purged. With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory. Those 770 unique URIs covered 161 unique domains. The leaked memory has been purged with the help of the search engines. So I tried it too, and there's still data cached there. Am…

Could someone enlighten me on why malloc and free don't automatically zero memory by default? Someone pointed me to MALLOC_PERTURB_ and I've just run a few test programs with it set - including a stage1 GCC compile, which granted may not be the best test - and it really doesn't dent performance by much. (edit: noticeably, at all , in fact) People who prefer extreme performance over prudent security should be the ones…

Post by x0 » Fri, Feb 24, 2017, 2:25 AM UTC

eridius wrote: post #333

mattbee wrote: post #287

Earlier quoted context omitted.

It's not a game, it's policing your own network and keeping your business activities legal. My network has run an abuse desk for 15 years and there are no feasting piranhas (what does that even mean?). Cloudflare definitely already runs an abuse desk, and ban accounts, they just choose not to ban network abuse tools. They are making the internet a more dangerous place for hosting, then asking you to buy a solution. T…

They could ban booters. But then someone else will say "but you allow ! They're clearly bad, you should ban them too". And so they do, and now someone else complains about some other site. Once you start banning sites for the content they hold, where do you draw the line? I don't fault CloudFlare for drawing it at the legal barrier (e.g. no CP).

Post by jackmott » Fri, Feb 24, 2017, 2:26 AM UTC

infinity0 wrote: post #327

Terr_ wrote: post #322

Earlier quoted context omitted.

Just like why most filesystems don't zero deleted files.

Neither of these are good reasons: I already talked about MALLOC_PERTURB_ (man mallopt) in my post and my naive performance tests, and we rarely get bad security holes based on data from deleted files left on filesystems.

Post by w8rbt » Fri, Feb 24, 2017, 2:28 AM UTC

infinity0 wrote: post #307

PuffinBlue wrote: post #187

Earlier quoted context omitted.

> The infosec team worked to identify URIs in search engine caches that had leaked memory and get them purged. With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory. Those 770 unique URIs covered 161 unique domains. The leaked memory has been purged with the help of the search engines. So I tried it too, and there's still data cached there. Am…

Could someone enlighten me on why malloc and free don't automatically zero memory by default? Someone pointed me to MALLOC_PERTURB_ and I've just run a few test programs with it set - including a stage1 GCC compile, which granted may not be the best test - and it really doesn't dent performance by much. (edit: noticeably, at all , in fact) People who prefer extreme performance over prudent security should be the ones…

Post by nikisweeting » Fri, Feb 24, 2017, 2:29 AM UTC

jkells wrote: post #44

My first thought was relief, thank god I'm not using Cloudflare. Where would you even start to address this? Everything you've been serving is potentially compromised, API keys, sessions, personal information, user passwords, the works. You've got no idea what has been leaked. Should you reset all your user passwords, cycle all or your keys, notify all your customers that there data may have been stolen? My second th…