Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

601–610 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#601

Post by Gibbon1 »

magnetic wrote: post #497
amalcon wrote: post #360

Earlier quoted context omitted.

Some old IBM environments initialized fresh allocations to 0xDEADBEEF, which had the advantage that the result you got from using such memory would (usually) be obviously incorrect. The fact that it was done decades ago is pretty good evidence that it's not about the actual initialization cost: these things cost a lot more back then. What changed is the paged memory model: modern systems don't actually tie an address…

> What changed is the paged memory model: modern systems don't actually tie an address to a page of physical RAM until the first time you try to use it (or something else on that page). Initializing the memory on malloc() would "waste" memory in some cases, where the allocation spans multiple pages and you don't end up using the whole thing. Some software assumes this, and would use quite a bit of extra RAM if malloc…

Unsure, not my job. But I read stuff along those lines. A modern OS plays all sorts of games to delay doing work. Allocate a couple of megs of memory and the OS sets up some pointers in a page table. And yes it'll keep already zero'd pages handy. And mark pages as dirty to be scraped clean later.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#602

Post by tuwtuwtuw »

vacri wrote: post #555
fictioncircle wrote: post #51

Earlier quoted context omitted.

I would say the crazy thing is a mere t-shirt as their "bug bounty" top tier award given how they've pitched themselves as an extremely secure service. https://hackerone.com/cloudflare I'm sorry but when the reward for breaking into you is basically a massive pinata of personal information...that simply is a bad joke. Security flaws are going to happen and if you aren't going to even offer a reasonable financial rewa…

The reward includes a t-shirt, it isn't a mere t-shirt. You also get "12 months of CloudFlare's Pro or 1 month of Business service on us" (~$200). The reward is also not tiered. The award may still not be all that much, but let's not make things up about them.

That's still pretty much as silly as a tshirt. When a vulnerability was found in my hobby project I paid 200 to the reporter as a thanks. From my own pocket for my own open source program.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#603

Post by ec109685 »

tptacek wrote: post #532
ec109685 wrote: post #505

Earlier quoted context omitted.

Any chance you can describe why these cached pages missed the purge that cloudflare initiated? Seems like cloudflare should have brought an outside expert to try to exploit this issue before the disclosure was made.

For vulnerabilities with immediate exploit exposure, where people are currently being victimized by the flaw, Project Zero has a 7-day embargo. The short waiting period balances the vendor's interest in coordinating the smoothest fix to the problem with the public's interest in knowing its exposure and maximizing it's options for reacting to the exposure. The fixed waiting period keeps the process sane. Every vendor…

Thank you for your thoughtful reply and realize the difficult situation you are in.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#604

Post by Udo »

gambler wrote: post #591
Udo wrote: post #572

Earlier quoted context omitted.

I'm running a side-project on Cloudflare and it's accessible through Tor without problems. I suspect this comes down to the settings a site owner sets up in their Cloudflare interface. It would stand to reason if for example you applied the highest security setting across the board, Tor and VPN users would get presented with a captcha.

Is this made clear in their UI? Do they have something saying "this setting will screw over many VPN users" and "this setting will screw over with all Tor users"? If not, it's in large part their problem as well.

I would say it's "clear" in exactly the same way the privacy slider within the Tor browser is clear. Why not set everything to its max value always? Because there will be limitations arising from it. In the CF interface it's pretty obvious adjusting the settings in that way will increase filtering and captcha challenges for users.

I think the decision that goes on in the minds of most site operators is "fuck convenience and sleazy Tor users, I want my site to be as safe as they can make it".

It's worth noting that other reverse proxy providers I worked with when freelancing expose the very same controls to site owners. Based on anecdotal knowledge, I'd say anonymized users accessing a site behind CF are subject to less hassle than those accessing a site behind something like X4B with comparable settings.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#605

Post by lifthrasiir »

bubblethink wrote: post #593
homakov wrote: post #570

Chrome marking Cloudflare HTTPS as "Secure" must be turned into something different, like "Not So Secure" or whatever. Secure = end to end. Cloudflare is MitM by design. Chrome and others must not tolerate it. This vulnerability is just another reason to do it asap.

That's because HTTPS allows that. Whether it's cloudflare, or your own servers and load balancers, it's all legal. So it would be unfair to single cloudflare out. You could take some measures to identify their flexible-ssl traffic, and that's a grey area, but their regular ssl is fine. If it weren't for them, you would roll your own solution, which wouldn't be very different.

Ultimately I believe CF is sustaining its business by filling a gap in the Internet, namely DDoS protection. Until somehow the gap is closed we will see CF-like services continue to be popular even after this incident.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#606

Post by uladzislau »

edwinyzh wrote: post #597
fagnerbrack wrote: post #64

TL;DR for the lazy ones: > The examples we're finding are so bad, I cancelled some weekend plans to go into the office on Sunday to help build some tools to cleanup. I've informed cloudflare what I'm working on. I'm finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings. We're talking full https reques…

Just deleted my LastPass account - have been converted to KeePass for over a month.

Did Lastpass use Cloudflare? That would be a disaster.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#607

Post by pat2man »

homakov wrote: post #570

Chrome marking Cloudflare HTTPS as "Secure" must be turned into something different, like "Not So Secure" or whatever. Secure = end to end. Cloudflare is MitM by design. Chrome and others must not tolerate it. This vulnerability is just another reason to do it asap.

So is any CDN.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#608

Post by tptacek »

ec109685 wrote: post #603
tptacek wrote: post #532

Earlier quoted context omitted.

For vulnerabilities with immediate exploit exposure, where people are currently being victimized by the flaw, Project Zero has a 7-day embargo. The short waiting period balances the vendor's interest in coordinating the smoothest fix to the problem with the public's interest in knowing its exposure and maximizing it's options for reacting to the exposure. The fixed waiting period keeps the process sane. Every vendor…

Thank you for your thoughtful reply and realize the difficult situation you are in.

Hah, no, my situation is super easy; it is "partisan bystander." I don't work for Google.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#609

Post by aleksei »

AYBABTME wrote: post #317

This comes around to me as something that just shouldn't have happened. CloudFlare are pretty big on Go, as far as I can tell (and I guess Lua for scripting nginx). Why was this parsing package written in a non memory-safe language? Parsing is one of those "obvious" things easy to mess up; the likelihood of a custom, hand written parser being buggy is pretty high. If it's somehow understood that your library is likel…

It is not the fault of the language if you use it wrong.

CloudFlare is to blame here, nothing else.

As for the reason why C, I'm pretty confident they knew what they were doing, and had considered other tools that did not meet all requirements.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#610

Post by [deleted] »

nikisweeting wrote: post #412

I've compiled a list of 7,385,121 domains served through cloudflare using several scrapers. https://github.com/pirate/sites-using-cloudflare The full list is available for download here (23mb) https://github.com/pirate/sites-using-cloudflare/raw/master/... I will be updating it as I find more domains.

[deleted]
Post reply on HN