Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

461–470 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#461

Post by bichiliad »

chrisper wrote: post #196
sparkling wrote: post #121

Earlier quoted context omitted.

So just to clarify: some bug makes Cloudflare leak the HTTP Headers into the HTML being served and those HTML pages containing sensitive Info got cached by Google (and others)?

Yes. Think of it this way. You have a function that strips all colons from your input. For some reason - in certain cases - your code misbehaves and when you are replacing the colons with an empty character you accidentally replace that colon with other data you have in the memory. So now all the colons in your input have been replaced with data that you shouldn't have touched. So now whoever sent you an input, gets…

@homero (since I can't nest a reply any further), it's not the contents of the crawler's request that gets randomly injected into the page that the crawler requests, but rather the contents of other requests to the same Cloudflare server.

Imagine I'm having a chat on some website X, which uses Cloudflare. Cloudflare acts as a man in the middle, meaning my request, and the response, likely pass through its memory at some point to allow me to communicate with X.

Later, a Google bot comes along and requests a page from site Y. Because of this bug, random bits of memory that were left around on the Cloudflare server get inserted into the response to the bot's request. Those bits of memory could be from anything that's gone through that server in the past, including my conversations on website X. The bot then assumes that the content that Cloudflare spits out for website Y is an accurate representation of website Y's contents, and it caches those contents. In this way, my data from website X ends up in Google's cached version of website Y.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#462

Post by kyledrake »

Friendly reminder that Cloudflare willingly hosts the top DDoS-for-hire attack sites, and refuses to take them down when they are reported.

Run WHOIS on them, it's almost 100% behind Cloudflare: https://www.google.com/#q=ddos+booter

I would be less concerned about the fact that Cloudflare is spraying private data all over the internet if people weren't being coerced into it by a racket.

We won't have a decentralized web anymore if this keeps going. The entire internet will sit behind a few big CDNs and spray private data through bugs and FISA court wire taps. God help us all if this happens.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#464

Post by fulafel »

danielweber wrote: post #238
dmitrygr wrote: post #37

Cloudflare's announcement, as it is currently worded, deserves the understatement-of-the-centry award.

"Don't worry, the keys weren't compromised." I know how to replace my TLS keys. I have no idea how to replace everything else. It's like people who think losing my credit card number is the worst thing. No, it can be a hassle, but once I replace it I'm okay. It's everything else.

The implied comparison to Heartbleed problem is that everyone's old encrypted traffic was suddenly in the open, key change didn't help.

(except for the enlightened few who used PFS before Heartbleed)

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#465

Post by nikisweeting »

leoh wrote: post #457
nikisweeting wrote: post #378

Earlier quoted context omitted.

Yup, running it now. Results are being posted as fast as I can here: https://github.com/pirate/sites-using-cloudflare

Looks cool, you have a lot of duplicates, though. $ cat sorted_unique_cf.txt | wc -l 7385121 $ cat sorted_unique_cf.txt | uniq |wc -l 4287625

Apologies, fixing that now! I ran uniq before but piped it into the wrong file and ended up uploading the non unique version.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#466

Post by bichiliad »

aerovistae wrote: post #459

I noticed StackOverflow is on the list of compromised sites. I sign into that via my google account. Does this mean I need to change Google credentials?

In StackOverflow's case, login happens using Oauth2 by way of accounts.google.com, meaning your google login creds don't go through StackOverflow's servers - Google acts as a trusted 3rd party and verifies that you are who you say you are, and tells StackOverflow.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#467

Post by andrenotgiant »

xuki wrote: post #447
andrenotgiant wrote: post #429

Earlier quoted context omitted.

Is your list "customers of cloudflare" or "customers of cloudflare that could have sensitive data cached by search engines" For example, Digital Ocean uses cloudflare, but the domain with sensitive data (cloud.digitalocean.com) is entirely blocked from Search Engines https://cloud.digitalocean.com/robots.txt

It doesn't matter, your info could have leaked via other sites.

Ahh thank you that bit didnt click for me, that is scary

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#468

Post by aacook »

mattbee wrote: post #148

Cloudflare isn't just a security hole in the middle of the internet, they're a protection racket. If you wanted to pay to DDoS a site, search for "booter" and you'll get a list of sites that will take another site off the internet for money with a flood of traffic. quezstresser.com webstresser.co topbooter.co instabooter.com booter.xyz critical-boot.com top10booters.com betabooter.com databooter.com etc. etc. - from…

I don't really understand your point. In 2012 I was working on a startup that was DDoS'd and it was not fun. This was back before Cloudflare offered a DDoS service and we ended up having to hire a random company in Canada to help get us back online. At the time there were surprisingly few people out there offering DDoS mitigation. Cloudflare wanted to help us but they were still in early development for their service, but I remember them being good guys. What's wrong with providing a service to help fight the bad guys?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#470

Post by Trundle »

taviso wrote: post #154
rdl wrote: post #135

Earlier quoted context omitted.

3438 domains which someone could have queried, but potentially data from any site which had "recently" passed through Cloudflare would be exposed in response, right? Purging those results helps with search engines, but a hypothetical malicious secret crawler would still potentially have any data from any site.

correct

Have you asked them for an eta on your shirt?
Post reply on HN