Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

451–460 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#451

Post by meowface »

chrissnell wrote: post #392
espadrine wrote: post #125

Earlier quoted context omitted.

It is far from over, too! Google Cache still has loads of sensitive information, a link away! Look at this, click on the downward arrow, "Cached": https://www.google.com/search?q="CF-Host-Origin-IP:"+"author... (And then, in Google Cache, "view source", search for "authorization".) (Various combinations of HTTP headers to search for yield more results.)

It seems like the reasonable thing for Google to do is to clear their entire cache. The whole thing. This is the one thing that they could do to be certain that they aren't caching any of this.

That might be a bit too extreme. But they should do something quickly to try to find all of these.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#452

Post by dang »

tedunangst wrote: post #446
dang wrote: post #436

Earlier quoted context omitted.

No, we log you out of all HN sessions when you change your password.

Oh, cool. (This was not the case last time I did a reset.)

I'm pretty sure kogir came up with that one and he's been off working on his bug tracker for a while now.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#453

Post by manigandham »

mattbee wrote: post #182
mattbee wrote: post #148

Cloudflare isn't just a security hole in the middle of the internet, they're a protection racket. If you wanted to pay to DDoS a site, search for "booter" and you'll get a list of sites that will take another site off the internet for money with a flood of traffic. quezstresser.com webstresser.co topbooter.co instabooter.com booter.xyz critical-boot.com top10booters.com betabooter.com databooter.com etc. etc. - from…

Another implication: they could be using their access to these sites' traffic to prepare their own infrastructure for attacks before they happen. There's nothing about their hosting of these sites that doesn't reek.

That is how DDOS protection works, learning from data and scale to better defend future attacks. Every large network and security operator does this. What is your issue with that exactly?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#454

Post by meowface »

mattbee wrote: post #233
eridius wrote: post #210

Earlier quoted context omitted.

In what way is this a protection racket? That's sort of like complaining that mob-owned businesses enjoy the same police & fire protection that all other businesses have.

Cloudflare sells protection from the internet attacks through its network. The same company and network facilitates the organisation of those same attacks, and helps keep them anonymous. That's a high-tech protection racket.

Most of those booters are on their free tier, so it's a bit hard to argue it's a racket.

If you want to claim it's unethical... maybe. But if you think about it from their position, it could genuinely get into a slippery slope if you start policing what services you're reverse proxying. Especially considering the rate they're growing now.

Think of it this way: should Google be compelled to remove all search results for all booters and other malware-related services? It's asking a lot.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#455

Post by patio11 »

tptacek wrote: post #4

Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…

If anyone here is HIPAA-regulated or you have a customer who is, and you used Cloudflare during those dates, it is Big Red Button time. You've almost certainly got a reportable breach; depending on how tightly you're able to scope it maybe it won't be company-ending.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#456

Post by nv-vn »

chrissnell wrote: post #410
callahad wrote: post #407

Earlier quoted context omitted.

What about Bing, Baidu, Yandex, The Internet Archive, and Common Crawl? What about caches that are surely maintained by the NSA, ФСБ, and 3PLA?

Of course. Google dumping their cache puts only a small dent into the problem, but I feel that it's their responsibility to the innocent site operators caught in the middle of this.

That only gives them an excuse to do nothing about this. All those companies should immediately go ahead and update any data that could have possibly leaked + inform their customers.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#457

Post by leoh »

nikisweeting wrote: post #378
jlgaddis wrote: post #55

Anyone wrote a script yet that checks the top 1M (or so) web sites to find out which use Cloudflare? It would help with knowing what secrets I need to change (as an end user -- I'm not a Cloudflare customer, thank $deity).

Yup, running it now. Results are being posted as fast as I can here: https://github.com/pirate/sites-using-cloudflare

Looks cool, you have a lot of duplicates, though.

   $ cat sorted_unique_cf.txt | wc -l
    7385121

   $ cat sorted_unique_cf.txt | uniq |wc -l
    4287625

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#458

Post by manigandham »

hehheh wrote: post #374

I'm a little drunk so please forgive me if I'm way off base here or if I'm ultimately describing a service that already exists. Unless I'm mistaken, CloudFlare's services necessarily require they act as a MITM. Would it be possible or practical change the DDoS protection service such that it uses an agent on the customer's end (the CF customer) that relays relevant data to CF, instead of having CF MITM all data? As i…

You wouldn't be able to have any CDN caching, only transit of encrypted traffic. Which is fine, but all the major clouds have load balancers that already do this and have varying levels of included and paid DDoS protection.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#460

Post by chrisper »

homero wrote: post #449
chrisper wrote: post #196

Earlier quoted context omitted.

Yes. Think of it this way. You have a function that strips all colons from your input. For some reason - in certain cases - your code misbehaves and when you are replacing the colons with an empty character you accidentally replace that colon with other data you have in the memory. So now all the colons in your input have been replaced with data that you shouldn't have touched. So now whoever sent you an input, gets…

But how is Google getting headers from the users of the sites, it should be from their crawler

If I (user A) access upwork.com (I just saw this on the list of affected websites, so it's not meant to be an ad), I am sending them my headers. Let's say my headers and other data are saved in M1 (memory register 1).

Then Google accesses the website as the crawler (user B), and their header and data is saved in M2. However, Google triggered a bug and now has access to M1 as well. So now Google sees their own headers + my data + other garbage.

Post reply on HN