Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

481–490 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#481

Post by cmsj »

eridius wrote: post #333
mattbee wrote: post #287

Earlier quoted context omitted.

It's not a game, it's policing your own network and keeping your business activities legal. My network has run an abuse desk for 15 years and there are no feasting piranhas (what does that even mean?). Cloudflare definitely already runs an abuse desk, and ban accounts, they just choose not to ban network abuse tools. They are making the internet a more dangerous place for hosting, then asking you to buy a solution. T…

They could ban booters. But then someone else will say "but you allow ! They're clearly bad, you should ban them too". And so they do, and now someone else complains about some other site. Once you start banning sites for the content they hold, where do you draw the line? I don't fault CloudFlare for drawing it at the legal barrier (e.g. no CP).

They can draw the line wherever they like, they are under zero obligation to provide a service to anyone they don't want to.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#482

Post by ceejayoz »

hkjgkjy wrote: post #426

One of the reasons I prefer paying with Bitcoin over credit card, is that when using cryptocurrency I don't have to give them they key to my account - instead they give me an inbox that I send the value into. Guessing a lot of credit card details are ripe for picking in the data they leaked.

> Guessing a lot of credit card details are ripe for picking in the data they leaked.

Sure, but that's where credit cards shine in comparison to Bitcoin. In the US, you're protected by Federal law in that scenario. A brief pain in the ass - reporting the fraud and getting a new card number - and you're out $0.

Meanwhile, a bit of malware can drain millions of dollars of Bitcoin with zero recourse. It's gone. This isn't theoretical, it has happened. https://www.theguardian.com/technology/2016/aug/03/bitcoin-s...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#484

Post by ceejayoz »

chris_7 wrote: post #292
davb wrote: post #61

Earlier quoted context omitted.

Thankfully it looks like it's not 1Password, who seem to use AWS CloudFront.

I am confused - why is 1Password is using anything but iCloud or Dropbox? Those are the only options I see (and "Folder" which is presumably just local).

Their Teams product has a web-based console for granting users access to vaults: https://1password.com/teams/

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#485

Post by hueving »

chrissnell wrote: post #410
callahad wrote: post #407

Earlier quoted context omitted.

What about Bing, Baidu, Yandex, The Internet Archive, and Common Crawl? What about caches that are surely maintained by the NSA, ФСБ, and 3PLA?

Of course. Google dumping their cache puts only a small dent into the problem, but I feel that it's their responsibility to the innocent site operators caught in the middle of this.

Cloudflare's incompetence isn't Google's responsibility, particularly when Google wiping out their caches and damaging their own search results doesn't fix the problem. Hackers know how to use more than one search engine.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#486

Post by chipperyman573 »

kyledrake wrote: post #462

Friendly reminder that Cloudflare willingly hosts the top DDoS-for-hire attack sites, and refuses to take them down when they are reported. Run WHOIS on them, it's almost 100% behind Cloudflare: https://www.google.com/#q=ddos+booter I would be less concerned about the fact that Cloudflare is spraying private data all over the internet if people weren't being coerced into it by a racket. We won't have a decentralized…

>Friendly reminder that Cloudflare willingly hosts the top DDoS-for-hire attack sites, and refuses to take them down when they are reported.

Why should CF be required to police the internet? CF doesn't even host them, they just protect their sites from DDoS and DNS.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#487

Post by niftich »

aerovistae wrote: post #459

I noticed StackOverflow is on the list of compromised sites. I sign into that via my google account. Does this mean I need to change Google credentials?

Most of these 'Sign in with [Social Identity Provider]' implementations, including Google [1] use OIDC ("OpenID Connect"), which in turn itself is built on top of OAuth 2.0. From the OAuth 2.0 side, the site into which you wish to gain access into -- in this case, StackOverflow -- only sees opaque tokens that are usually short-lived.

However, OIDC then typically delivers some choice personal info -- no more than you agreed to when first consented to the integration, but usually account name and/or email, and maybe real name and some demographic data -- to the requesting service so that they can both find you in their datastore, and sync up these attributes. In the case of a service whose OAuth/OIDC callback url's SSL is terminated with CloudFlare, which we (as of writing) don't yet know if applies to StackOverflow, this info will touch CloudFlare servers and could have been contents of memory that was exposed. However, your password would not be, as in your case, the password was supplied to the Social Identity Provider (Google) who didn't use CloudFlare to terminate that connection, and the password never left Google, which was the precise usecase and requirement that the OAuth/OIDC specs were authored to support.

[1] https://developers.google.com/identity/protocols/OpenIDConne...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#488

Post by flukus »

mabbo wrote: post #404
eli wrote: post #58

Earlier quoted context omitted.

If serious researchers are looking to get paid, I think bug bounties are the wrong approach entirely

It's about payoff * probability. Let's say I (an idiot, but knowledgeable enough) stumble upon a serious vulnerability in Google. Option 1: I could try to sell that on a darknet market for a decent amount of money. State actors, hacker groups, lots of people want to pay for such things to exploit. But, I might not get paid very much, I might get screwed over, I might go to jail, who the heck knows, I'm playing with a…

> I might go to jail

Is selling exploits illegal? If so is selling them to google also illegal?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#489

Post by dunham »

toyg wrote: post #263
espadrine wrote: post #125

Earlier quoted context omitted.

It is far from over, too! Google Cache still has loads of sensitive information, a link away! Look at this, click on the downward arrow, "Cached": https://www.google.com/search?q="CF-Host-Origin-IP:"+"author... (And then, in Google Cache, "view source", search for "authorization".) (Various combinations of HTTP headers to search for yield more results.)

Lol, Google just purged that search. EDIT: but there's still plenty of fish: http://webcache.googleusercontent.com/search?q=cache:lw4K9G2... This will take weeks to clean, and that's just for Google. EDIT2: found other oauth tokens, lots of fitbit calls... And this just by searching for typical CF internal headers on Google and Bing. There is no way to know what else is out there. What a mess.

OAuth1 doesn't send the secrets with the requests, just a key to identify the secret and a signature made with the secret.

OAuth2 does send the secret, typically in an "Authorization: Bearer ..." header.

The uber stuff that somebody else linked to looks like a home-grown auth scheme and it appears that "x-uber-token" is a secret, but hard to know for sure.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#490

Post by JumpCrisscross »

_wmd wrote: post #11

Step 1) MITM the entire Internet, undermining its SSL infrastructure, build a business around it Step 2) leak cleartext from said MITM'd connections to the entire Internet I recently noted that in some ways Cloudflare are probably the only entity to have ever managed to cause more damage to popular cryptography since the 2008 Debian OpenSSL bug (thanks to their "flexible" ""SSL"" """feature"""), but now I'm certain o…

They also actively deter Tor use. I've cancelled subscriptions with Cloudflare-hosted sites because they make securely and anonymously browsing their sites a pain.
Post reply on HN