Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

391–400 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#391

Post by pmahoney »

maknz wrote: post #387
pmahoney wrote: post #385

I haven't found a clear answer to this: CloudFlare has multiple SSL configurations: > Flexible SSL: There is an encrypted connection between your website visitors and Cloudflare, but not from Cloudflare to your server. > Full SSL: Encrypts the connection between your website visitors and Cloudflare, and from Cloudflare to your server (I'll add Full SSL mode still involves CloudFlare terminating SSL (decrypting) befor…

Full SSL requests still terminate at CloudFlare, and would still be vulnerable. It's just that CloudFlare's connection to your origin is also encrypted.

Thanks. Wish they had explicitly stated that all SSL modes were affected (unless I missed it...)

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#392

Post by chrissnell »

espadrine wrote: post #125
tptacek wrote: post #4

Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…

It is far from over, too! Google Cache still has loads of sensitive information, a link away! Look at this, click on the downward arrow, "Cached": https://www.google.com/search?q="CF-Host-Origin-IP:"+"author... (And then, in Google Cache, "view source", search for "authorization".) (Various combinations of HTTP headers to search for yield more results.)

It seems like the reasonable thing for Google to do is to clear their entire cache. The whole thing. This is the one thing that they could do to be certain that they aren't caching any of this.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#393

Post by Deimorz »

rrdharan wrote: post #244
chm wrote: post #34

Some important parts: The examples we're finding are so bad, I cancelled some weekend plans to go into the office on Sunday to help build some tools to cleanup. I've informed cloudflare what I'm working on. I'm finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings. We're talking full https requests, c…

Connecting some dots, I'm wondering if the "well-known chat service" is Slack: http://www.computing.co.uk/ctg/news/2462266/whatsapp-reddit-...

I'm fairly sure that it's Discord.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#394

Post by niftich »

tr44564 wrote: post #245
AznHisoka wrote: post #111

Earlier quoted context omitted.

Can someone tell me the implications of this in laymen terms? For instance what does it mean "sprayed into caches"? what cache? dns cache? browser cache? if the latter, does it mean you are safe if the person who owns that cache is an innocent non technical iser?

As for the SHA-1 collision mentioned by jgrahamc[1] earlier today: How am I going to explain this to my wife? Actually a serious question. How do we communicate something like this to the general public? [1] https://news.ycombinator.com/item?id=13713826

"It's like some extremely popular remailer company accidentally put badly or barely shredded copies of handled letters into other people's envelopes. Strangers' sensitive info is potentially sitting inside unsuspecting mailboxes worldwide."

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#395

Post by belovedeagle »

AYBABTME wrote: post #317

This comes around to me as something that just shouldn't have happened. CloudFlare are pretty big on Go, as far as I can tell (and I guess Lua for scripting nginx). Why was this parsing package written in a non memory-safe language? Parsing is one of those "obvious" things easy to mess up; the likelihood of a custom, hand written parser being buggy is pretty high. If it's somehow understood that your library is likel…

Memory safe languages aren't a panacea. There could just as easily have been a bug in the compiler or standard library with the same result.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#397

Post by rickhanlonii »

benwilber0 wrote: post #312
jgrahamc wrote: post #222

Earlier quoted context omitted.

From my blog on this: The three features implicated were rolled out as follows. The earliest date memory could have leaked is 2016-09-22. 2016-09-22 Automatic HTTP Rewrites enabled 2017-01-30 Server-Side Excludes migrated to new parser 2017-02-13 Email Obfuscation partially migrated to new parser 2017-02-18 Google reports problem to Cloudflare and leak is stopped

Well fuck. I have no idea what (if any, or all) of my authenticated web sessions have been going through CloudFlare in the last 6 months. How do I even start to protect myself from this?

Reset everything you don't want to assume is public

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#398

Post by mcbits »

mattbee wrote: post #148

Cloudflare isn't just a security hole in the middle of the internet, they're a protection racket. If you wanted to pay to DDoS a site, search for "booter" and you'll get a list of sites that will take another site off the internet for money with a flood of traffic. quezstresser.com webstresser.co topbooter.co instabooter.com booter.xyz critical-boot.com top10booters.com betabooter.com databooter.com etc. etc. - from…

By the same logic, the search engine you used to find those sites is also a "protection racket".

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#400

Post by ppoint »

infinity0 wrote: post #307
PuffinBlue wrote: post #187

Earlier quoted context omitted.

> The infosec team worked to identify URIs in search engine caches that had leaked memory and get them purged. With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory. Those 770 unique URIs covered 161 unique domains. The leaked memory has been purged with the help of the search engines. So I tried it too, and there's still data cached there. Am…

Could someone enlighten me on why malloc and free don't automatically zero memory by default? Someone pointed me to MALLOC_PERTURB_ and I've just run a few test programs with it set - including a stage1 GCC compile, which granted may not be the best test - and it really doesn't dent performance by much. (edit: noticeably, at all , in fact) People who prefer extreme performance over prudent security should be the ones…

calloc zeroes memory on allocation.
Post reply on HN