Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

521–530 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#521

Post by jstanley »

garblegarble wrote: post #243
Kalium wrote: post #142

Earlier quoted context omitted.

Right there with you. I'm currently scrambling for remediation ideas. "Change everything" isn't tractable.

>I'm currently scrambling for remediation ideas. "Change everything" isn't tractable. It's not easy to deal with but it is the best remediation available to you, given the exceptionally broad scope and months-long period where data was apparently leaking (the cloudflare blog post lists 2016-09-22 as the first date when leaks were possible)

Change my name? Change my address? Change my date of birth? My mother's maiden name? My passport number?

It's simply not possible to change all of the sensitive information that might have been leaked.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#522

Post by SteveNuts »

flukus wrote: post #488
mabbo wrote: post #404

Earlier quoted context omitted.

It's about payoff * probability. Let's say I (an idiot, but knowledgeable enough) stumble upon a serious vulnerability in Google. Option 1: I could try to sell that on a darknet market for a decent amount of money. State actors, hacker groups, lots of people want to pay for such things to exploit. But, I might not get paid very much, I might get screwed over, I might go to jail, who the heck knows, I'm playing with a…

> I might go to jail Is selling exploits illegal? If so is selling them to google also illegal?

You're not so much selling them to google, you're disclosing them.

It's more of a contractual agreement between you and Google, or whatever company you're reporting the vulnerability to.

As long as you follow the rules for their bug bounty, you'll be fine.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#523

Post by niftich »

clebio wrote: post #515
jgrahamc wrote: post #222

Earlier quoted context omitted.

From my blog on this: The three features implicated were rolled out as follows. The earliest date memory could have leaked is 2016-09-22. 2016-09-22 Automatic HTTP Rewrites enabled 2017-01-30 Server-Side Excludes migrated to new parser 2017-02-13 Email Obfuscation partially migrated to new parser 2017-02-18 Google reports problem to Cloudflare and leak is stopped

not trolling, I followed your HN profile link: what blog post? http://blog.jgc.org/

The CloudFlare blog entry [1] authored by him, also submitted by him to HN [2], and also posted by him in this thread [3].

[1] https://blog.cloudflare.com/incident-report-on-memory-leak-c... [2] https://news.ycombinator.com/submitted?id=jgrahamc [3] https://news.ycombinator.com/item?id=13718752#13718782

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#525

Post by dang »

lsmod wrote: post #510
mattbee wrote: post #148

Cloudflare isn't just a security hole in the middle of the internet, they're a protection racket. If you wanted to pay to DDoS a site, search for "booter" and you'll get a list of sites that will take another site off the internet for money with a flood of traffic. quezstresser.com webstresser.co topbooter.co instabooter.com booter.xyz critical-boot.com top10booters.com betabooter.com databooter.com etc. etc. - from…

Be careful posting random domains.HN might flag/throttle your account for spamming.happened to one of my accounts.

That's rare but possible. If you weren't spamming, I'm sorry. Let us know at hn@ycombinator.com and we'll fix it.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#526

Post by pizza »

eridius wrote: post #333
mattbee wrote: post #287

Earlier quoted context omitted.

It's not a game, it's policing your own network and keeping your business activities legal. My network has run an abuse desk for 15 years and there are no feasting piranhas (what does that even mean?). Cloudflare definitely already runs an abuse desk, and ban accounts, they just choose not to ban network abuse tools. They are making the internet a more dangerous place for hosting, then asking you to buy a solution. T…

They could ban booters. But then someone else will say "but you allow ! They're clearly bad, you should ban them too". And so they do, and now someone else complains about some other site. Once you start banning sites for the content they hold, where do you draw the line? I don't fault CloudFlare for drawing it at the legal barrier (e.g. no CP).

CloudFlare should not align itself with the adversaries its mission is to protect its users from. This isn't a slippery slope distinction, this is a binary exclusion.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#527

Post by Blackthorn »

This is probably gonna get buried at this point, but one thing I'm surprised about is this seems like yet another parser bug. Why are we still using hand-written parsers? Even if you're Very Smart, you'll probably get it wrong. We have parser generators for a lot of things. Even for mostly unparseable garbage like wild-type HTML we have pretty good libraries for handling it. Fresh hand-written parsers are just bombs waiting to explode.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#528

Post by chrisper »

Blackthorn wrote: post #527

This is probably gonna get buried at this point, but one thing I'm surprised about is this seems like yet another parser bug. Why are we still using hand-written parsers? Even if you're Very Smart, you'll probably get it wrong. We have parser generators for a lot of things. Even for mostly unparseable garbage like wild-type HTML we have pretty good libraries for handling it. Fresh hand-written parsers are just bombs…

https://news.ycombinator.com/item?id=13719530

Doesn't seem to be hand-written.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#529

Post by kinkrtyavimoodh »

homero wrote: post #449
chrisper wrote: post #196

Earlier quoted context omitted.

Yes. Think of it this way. You have a function that strips all colons from your input. For some reason - in certain cases - your code misbehaves and when you are replacing the colons with an empty character you accidentally replace that colon with other data you have in the memory. So now all the colons in your input have been replaced with data that you shouldn't have touched. So now whoever sent you an input, gets…

But how is Google getting headers from the users of the sites, it should be from their crawler

Imagine this—Google sends a request to get data from malformedhtml.com for crawling purposes. This site's html happens to have that weird incomplete tag problem they mentioned. This site is served by Cloudflare, wherein a buggy script manages to insert some data from the server's memory into the HTML that it returns to Google. Now this data in the memory contains HTTP request headers etc. of _completely unrelated websites_ that are also behind CF.

Google gets this HTML and caches it and that's how it ends up there.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#530

Post by mordant »

sfeng wrote: post #177
mattbee wrote: post #148

Cloudflare isn't just a security hole in the middle of the internet, they're a protection racket. If you wanted to pay to DDoS a site, search for "booter" and you'll get a list of sites that will take another site off the internet for money with a flood of traffic. quezstresser.com webstresser.co topbooter.co instabooter.com booter.xyz critical-boot.com top10booters.com betabooter.com databooter.com etc. etc. - from…

You are essentially arguing against freedom of speech. Cloudflare will protect any site that doesn't host child porn. Yes that includes things which you don't like, but it also includes all the things you do.

DDoS attacks are the ultimate form of censorship.
Post reply on HN