Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

631–640 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#631

Post by tfar »

chipperyman573 wrote: post #486
kyledrake wrote: post #462

Friendly reminder that Cloudflare willingly hosts the top DDoS-for-hire attack sites, and refuses to take them down when they are reported. Run WHOIS on them, it's almost 100% behind Cloudflare: https://www.google.com/#q=ddos+booter I would be less concerned about the fact that Cloudflare is spraying private data all over the internet if people weren't being coerced into it by a racket. We won't have a decentralized…

>Friendly reminder that Cloudflare willingly hosts the top DDoS-for-hire attack sites, and refuses to take them down when they are reported. Why should CF be required to police the internet? CF doesn't even host them, they just protect their sites from DDoS and DNS.

"CF doesn't even host them, they just protect their sites from DDoS and DNS."

The #1 excuse people use. They do more than just DNS, they deliver the actual data, that would have been delivered by the original host, to visitors. So I'd consider them hosting an automatically updated mirror, and as bad as the original host.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#632

Post by [deleted] »

edwinyzh wrote: post #597
fagnerbrack wrote: post #64

TL;DR for the lazy ones: > The examples we're finding are so bad, I cancelled some weekend plans to go into the office on Sunday to help build some tools to cleanup. I've informed cloudflare what I'm working on. I'm finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings. We're talking full https reques…

Just deleted my LastPass account - have been converted to KeePass for over a month.

[deleted]

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#633

Post by mook »

mattbee wrote: post #148

Cloudflare isn't just a security hole in the middle of the internet, they're a protection racket. If you wanted to pay to DDoS a site, search for "booter" and you'll get a list of sites that will take another site off the internet for money with a flood of traffic. quezstresser.com webstresser.co topbooter.co instabooter.com booter.xyz critical-boot.com top10booters.com betabooter.com databooter.com etc. etc. - from…

Given that the whole class of operators seem somewhat shady, I imagine that sometimes they would need to fend off attacks from competition services. In that case, being on a free DDoS protection plan seems like a reasonable thing to do (from their point of view). As long as they're not initiating the DDoS via Cloudflare, I'm not sure how that would be unreasonable of CF's part, given that I assume it's all automated and nobody ever looks at what sites have signed up.

I don't like CF for their fishy SSL architecture, the increased centralization of internet traffic, and the constant captchas when using tor, but the DDoS protection part (regardless to what sort of people they're providing service for) seems fine.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#634

Post by Erik816 »

pitaj wrote: post #611
uladzislau wrote: post #606

Earlier quoted context omitted.

Did Lastpass use Cloudflare? That would be a disaster.

It does not appear that LP was using Cloudflare. Even if they were, at most, your master password is all that leaked. All of their encryption and decryption is done on the client.

Only my master password? That seems kind of important.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#635

Post by pkcsecurity »

jlgaddis wrote: post #55

Anyone wrote a script yet that checks the top 1M (or so) web sites to find out which use Cloudflare? It would help with knowing what secrets I need to change (as an end user -- I'm not a Cloudflare customer, thank $deity).

Not as epic, but I wrote a small node app that checks a list of URLs (made it to check my 1password sites, but it can be used on stuff in general). Not very sophisticated, just checks DNS and setCookie strings...

https://github.com/weltan/cloudbleed-1password

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#637

Post by rasz_pl »

Kalium wrote: post #321
spydum wrote: post #147

People are going to lambast CF for downplaying the impact, and there could be merit in that. However, I really want to say I am absolutely impressed with both Project Zero AND Cloudflare on so many fronts, from clarity of communication, to collaboration, and rapid response. So many other organizations would have absolutely tanked when presented with this problem. Huge kudos for CF guys understanding the severity and…

CF's infosec team is very, very good at their jobs.

Good at lying for sure https://twitter.com/taviso/status/834918182640996353

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#638

Post by chimeracoder »

Aeolun wrote: post #531
DINKDINK wrote: post #334

Earlier quoted context omitted.

Your argument essentially revolves around "what are the chances I'll be compromised!?" rather than focusing on "What's the potentially affect of getting compromised" Most people with data or access rights which have several orders of magnitude of value relative to 8 hours worth of labor. The decision to wear a seatbelt isn't driven by the probability of needing it, the decision is drive by the magnitude of exposure t…

In the case of seat belts that's probably because the cost of your life is infinity. The same isn't quite true for my blogger account.

> In the case of seat belts that's probably because the cost of your life is infinity.

The cost of your life is much higher than your blogger account, but it's not literally infinite, even from your own perspective.

If it were truly infinite, then it would be irrational for you ever to take any action that were not 100% motivated by the desire to protect your life. (Not just "never take any risks", but literally irrational not to actively spend every waking second solely on that goal).

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#639

Post by gooeyblob »

jimmaswell wrote: post #547
pepve wrote: post #318

Earlier quoted context omitted.

That list contains domains where the bug was triggered. The information exposed through the bug though can be from any domain that uses Cloudflare. So: all services that have one or more domains served through Cloudflare may be affected. The consensus seem to be that no one discovered this before now, and no bad guys have been scraping this leak for valuable data (passwords, OAuth tokens, PII, other secrets). But the…

Myself and 4 other people I know all happened to get their reddit accounts temporarily locked due to a "possible compromise" in the past week or so, which has never happened to any of us before. Anyone else?

That would be unrelated to this. We haven't taken any action on any accounts because of this issue and have no plans to, as we (reddit.com) were unaffected.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#640

Post by gooeyblob »

neuland wrote: post #205
sparkling wrote: post #96

Earlier quoted context omitted.

$ dig example.com to get the A Record, then $ whois 1.2.3.4|grep Cloudflare Not 100% reliable, but should do the Job.

whois $(dig +short yoursitehere.com) | grep -i 'Cloudflare' 1>/dev/null; if [[ $? -eq 1 ]]; then echo 'Didnt find CloudFlare'; else echo 'Found CloudFlare'; fi Not at a terminal now, but this long one-liner should work. Like you said, not 100% reliable though. For example, I'm pretty sure Reddit uses CloudFlare, but their whois mentions Fastly, which is a competitor.

We moved off of CloudFlare to Fastly before this vulnerability.
Post reply on HN