Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

621–630 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#623

Post by Elizzy »

jwcrux wrote: post #471
nikisweeting wrote: post #369

Earlier quoted context omitted.

We're compiling a list of domains using several scrapers and updating it here: https://github.com/pirate/sites-using-cloudflare You can start by cross referencing your password manager with this list, and working your way out from there.

You don't have to use scrapers, just use copies of the TLD zone files looking for cloudflare nameservers.

Not everyone uses Cloudflare for their proxying service. I use them purely for my DNS, but don't have the MITM proxy enabled at all. His scraping is a better idea probably.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#624

Post by eastdakota »

sikhnerd wrote: post #291
PuffinBlue wrote: post #187

Earlier quoted context omitted.

> The infosec team worked to identify URIs in search engine caches that had leaked memory and get them purged. With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory. Those 770 unique URIs covered 161 unique domains. The leaked memory has been purged with the help of the search engines. So I tried it too, and there's still data cached there. Am…

jgrahamc: can you list which public caches you worked with to attempt to address this? It does not inspire confidence when even google is still showing obvious results

Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team.

I agree it's troubling that Google is taking so long. We were working with them to coordinate disclosure after their caches were cleared. While I am thankful to the Project Zero team for their informing us of the issue quickly, I'm troubled that they went ahead with disclosure before Google crawl team could complete the refresh of their own cache. We have continued to escalate this within Google to get the crawl team to prioritize the clearing of their caches as that is the highest priority remaining remediation step.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#625

Post by Elizzy »

benjaminl wrote: post #596
Anderkent wrote: post #311

Earlier quoted context omitted.

Lastpass knows how to change your passwords for many popular sites, and can automate it away for you.

LastPass uses local encryption to enable LastPass to have Zero knowledge of users passwords. This means that user's passwords aren't passed in the clear even inside a TSL session. So LastPass isn't the password manager mentioned in the post.

I think he's recommending it, more so than assuming it's what he uses.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#626

Post by chimeracoder »

niftich wrote: post #394
tr44564 wrote: post #245

Earlier quoted context omitted.

As for the SHA-1 collision mentioned by jgrahamc[1] earlier today: How am I going to explain this to my wife? Actually a serious question. How do we communicate something like this to the general public? [1] https://news.ycombinator.com/item?id=13713826

"It's like some extremely popular remailer company accidentally put badly or barely shredded copies of handled letters into other people's envelopes. Strangers' sensitive info is potentially sitting inside unsuspecting mailboxes worldwide."

> It's like some extremely popular remailer company accidentally put badly or barely shredded copies of handled letters into other people's envelopes.

Or used as confetti for a parade: http://www.npr.org/2012/11/27/166023474/social-security-numb...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#627

Post by mook »

AYBABTME wrote: post #317

This comes around to me as something that just shouldn't have happened. CloudFlare are pretty big on Go, as far as I can tell (and I guess Lua for scripting nginx). Why was this parsing package written in a non memory-safe language? Parsing is one of those "obvious" things easy to mess up; the likelihood of a custom, hand written parser being buggy is pretty high. If it's somehow understood that your library is likel…

The blog post makes it seem like the problem was in an nginx module. Looking at the docs [1] it looks like that's a C API; as far as I know writing shared libraries in golang for a C caller isn't really a thing (because the runtime needs to exist). Rust might have better luck here (I _think_ there have been attempts to get rust code loaded by not-rust code), but I haven't kept track.

[1] https://www.nginx.com/resources/wiki/extending/api/main/

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#629

Post by cm2187 »

Udo wrote: post #572
JumpCrisscross wrote: post #490

Earlier quoted context omitted.

They also actively deter Tor use. I've cancelled subscriptions with Cloudflare-hosted sites because they make securely and anonymously browsing their sites a pain.

I'm running a side-project on Cloudflare and it's accessible through Tor without problems. I suspect this comes down to the settings a site owner sets up in their Cloudflare interface. It would stand to reason if for example you applied the highest security setting across the board, Tor and VPN users would get presented with a captcha.

I have been presented with a captcha by cloudflare many times without using tor or a VPN. It is the best way to divert users from your website. My natural reaction is that unless I absolutely need to use this particular website, I move to the next result on google. Websites who use cloudflare are suicidal.
Post reply on HN