Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

471–480 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#471

Post by jwcrux »

nikisweeting wrote: post #369
jkells wrote: post #44

My first thought was relief, thank god I'm not using Cloudflare. Where would you even start to address this? Everything you've been serving is potentially compromised, API keys, sessions, personal information, user passwords, the works. You've got no idea what has been leaked. Should you reset all your user passwords, cycle all or your keys, notify all your customers that there data may have been stolen? My second th…

We're compiling a list of domains using several scrapers and updating it here: https://github.com/pirate/sites-using-cloudflare You can start by cross referencing your password manager with this list, and working your way out from there.

You don't have to use scrapers, just use copies of the TLD zone files looking for cloudflare nameservers.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#472

Post by camus2 »

toyg wrote: post #263
espadrine wrote: post #125

Earlier quoted context omitted.

It is far from over, too! Google Cache still has loads of sensitive information, a link away! Look at this, click on the downward arrow, "Cached": https://www.google.com/search?q="CF-Host-Origin-IP:"+"author... (And then, in Google Cache, "view source", search for "authorization".) (Various combinations of HTTP headers to search for yield more results.)

Lol, Google just purged that search. EDIT: but there's still plenty of fish: http://webcache.googleusercontent.com/search?q=cache:lw4K9G2... This will take weeks to clean, and that's just for Google. EDIT2: found other oauth tokens, lots of fitbit calls... And this just by searching for typical CF internal headers on Google and Bing. There is no way to know what else is out there. What a mess.

Ouch, you really see everything :

> authorization: OAuth oauth_consumer_key ...

what a shit show. I'm sorry but at that point there must be consequences for incompetence. Some might argue "But nobody can't do anything" ...

I'm sorry, CF has the money to to ditch C entirely and rewrite everything from the ground up with a safer language, I don't care what it is, Go,Rust whatever.

At that point people using C directly are playing with fire. C isn't a language for highly distributed applications, it will only distribute memory leaks ... With all the wealth there is in the whole Silicon Valley, trillions of dollars, there is absolutely 0 effort to come up with an acceptable solution? all these startups can't come together and say: "Ok,we're going to design or choose a real safe language and stick to that"? where does all that money goes then? Because this bug is going to cost A LOT OF MONEY to A LOT OF PEOPLE.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#473

Post by _wmd »

_wmd wrote: post #265
tootie wrote: post #224

Earlier quoted context omitted.

CloudFlare is neither the first nor the biggest CDN. I can't recall Akamai having a hole this big. They're either more secure or better at keeping things quiet.

To be fair to CloudFlare, Google had a heap issue a few years back (maybe like 7 now) where internal flags and copies of argv (which Google use heavily for config) were clearly present in output from their HTTP frontends, including references to Borg before Borg was ever documented publicly. Over in App Engine land, someone bypassed their JVM sandbox and managed to extract a copy of their JVM image, which included mu…

here's the JVM bypass: http://seclists.org/fulldisclosure/2014/Dec/26 / http://www.security-explorations.com/materials/se-2014-02-re... (see page 58 for some fun)

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#474

Post by gruez »

_wmd wrote: post #265
tootie wrote: post #224

Earlier quoted context omitted.

CloudFlare is neither the first nor the biggest CDN. I can't recall Akamai having a hole this big. They're either more secure or better at keeping things quiet.

To be fair to CloudFlare, Google had a heap issue a few years back (maybe like 7 now) where internal flags and copies of argv (which Google use heavily for config) were clearly present in output from their HTTP frontends, including references to Borg before Borg was ever documented publicly. Over in App Engine land, someone bypassed their JVM sandbox and managed to extract a copy of their JVM image, which included mu…

I'd like to see how much of a mess their argvs are

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#475

Post by nikisweeting »

nikisweeting wrote: post #465
leoh wrote: post #457

Earlier quoted context omitted.

Looks cool, you have a lot of duplicates, though. $ cat sorted_unique_cf.txt | wc -l 7385121 $ cat sorted_unique_cf.txt | uniq |wc -l 4287625

Apologies, fixing that now! I ran uniq before but piped it into the wrong file and ended up uploading the non unique version.

Fixed: https://github.com/pirate/sites-using-cloudflare/raw/master/...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#476

Post by symlinkk »

I've been going through Google's and Bing's caches for about 2 hours looking for leaked credentials and I don't see much - many results don't have an option to view a cached copy. I think Google and Bing are wiping any cache entry that are affected by this vulnerability.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#477

Post by nikisweeting »

jkells wrote: post #438
nikisweeting wrote: post #412

I've compiled a list of 7,385,121 domains served through cloudflare using several scrapers. https://github.com/pirate/sites-using-cloudflare The full list is available for download here (23mb) https://github.com/pirate/sites-using-cloudflare/raw/master/... I will be updating it as I find more domains.

More than 7 million domains... Letting that sink in... I'm assuming this list is based on DNS records? I wonder what proportion of those offloaded their SSL to Cloudflare.

I had duplicates, it's actually only 4,287,625 (still a lot though).

Fixed the duplicates: https://github.com/pirate/sites-using-cloudflare/raw/master/...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#478

Post by nikisweeting »

nikisweeting wrote: post #413
wilde wrote: post #247

Earlier quoted context omitted.

Are you guys planning to release the list so we can all change our passwords on affected services? Or are you planning on letting those services handle the communication?

I've compiled a list of 7,385,121 domains that use Cloudflare here: https://github.com/pirate/sites-using-cloudflare

(whoops forgot to remove dupes, it's only 4,287,625) https://github.com/pirate/sites-using-cloudflare/raw/master/...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#479

Post by ceejayoz »

aerovistae wrote: post #459

I noticed StackOverflow is on the list of compromised sites. I sign into that via my google account. Does this mean I need to change Google credentials?

You won't need to change your Google password, that's never given to websites as part of Google's OAuth process.

You may want to revoke access at https://myaccount.google.com/permissions and reconnect to SO.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#480

Post by richardwhiuk »

toyg wrote: post #227
kogir wrote: post #57

I'm not 100% clear: Only three features were affected, and only sites with one or more of those features enabled leaked data into their pages. But was the leaked data similarly limited to only the sites with the features enabled? Or could it have come from any request - even an entirely unrelated site?

> only sites with one or more of those features enabled leaked data No. From what he says, enabling that feature on a CF proxy basically triggered the bug on any site that happened to go through that proxy, regardless of whether it used the feature or not.

It only triggered the bug on sites that were using those features, but any other CF site was vulnerable to getting dumped out.
Post reply on HN