The title is misleading (for now). It is just a list of all sites using CF, compromised or not.
List of Sites Affected by Cloudflare's HTTPS Traffic Leak
21–30 of 228 posts
Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak
#22Aww man I submitted my list hours ago but I guess it never made it past the New page. https://github.com/pirate/sites-using-cloudflare Original post: https://news.ycombinator.com/item?id=13720199
Hey! Super useful, thanks. Quick question: news.ycombinator.com (as an example) is listed in the README as a potentially affected site, but I don't see it in the raw dump that I've downloaded. Am I crazy?
I suspect the raw dump is a list of sites that use the CloudFlare DNS servers, but HN uses a CNAME setup on their own authoritative DNS servers so it wouldn't appear in that list.
Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak
#23"List of Sites possibly affected"
Sites using Cloudflare, really. However, Cloudflare say that only sites using three page rules were affected - email obfuscation, Server-side Excludes and Automatic HTTPS Rewrites. [1]
Is this over-estimating the impact, perhaps?
[1] https://blog.cloudflare.com/incident-report-on-memory-leak-c...
Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak
#24"List of Sites possibly affected" Sites using Cloudflare, really. However, Cloudflare say that only sites using three page rules were affected - email obfuscation, Server-side Excludes and Automatic HTTPS Rewrites. [1] Is this over-estimating the impact, perhaps? [1] https://blog.cloudflare.com/incident-report-on-memory-leak-c...
No! And this is why cloudfare's poor write up continues to confuse people. Sites with those features triggered the bug. Once the bug was trigerred the response would include data from ANY other cloudfare customer that happened to be in memory at the time. Meaning a request for a page with one of those features could include data from Uber or one of the many other customers that didn't use those features. So the potential impact is every single one of the sites using CloudFare. Not over-estimated at all.
Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak
#25"List of Sites possibly affected" Sites using Cloudflare, really. However, Cloudflare say that only sites using three page rules were affected - email obfuscation, Server-side Excludes and Automatic HTTPS Rewrites. [1] Is this over-estimating the impact, perhaps? [1] https://blog.cloudflare.com/incident-report-on-memory-leak-c...
[deleted]
Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak
#26"List of Sites possibly affected" Sites using Cloudflare, really. However, Cloudflare say that only sites using three page rules were affected - email obfuscation, Server-side Excludes and Automatic HTTPS Rewrites. [1] Is this over-estimating the impact, perhaps? [1] https://blog.cloudflare.com/incident-report-on-memory-leak-c...
As I understand the issue, the leaked data might be from any other site using Cloudflare caching.
But only requests to sites using the features you mention, will have leaked data.
Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak
#27If I have an account on an affected site, but did not interact with the site (via my browser or through some other site with an API call) during the time period when the vuln was live, am I still at risk?
It seems very unlikely that you would be at risk, but there's some remote possibility that your past request data was in memory for some reason
Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak
#28I would like to point out that, if most sites used two-factor authentication, this leak would be at most a minor inconvenience. Maybe we should push for that more. Just days ago I talked to Namecheap about its horrible SMS-only 2FA and asked them to implement something actually secure, maybe contact your favorite site if they don't have 2FA yet.
Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak
#29"List of Sites possibly affected" Sites using Cloudflare, really. However, Cloudflare say that only sites using three page rules were affected - email obfuscation, Server-side Excludes and Automatic HTTPS Rewrites. [1] Is this over-estimating the impact, perhaps? [1] https://blog.cloudflare.com/incident-report-on-memory-leak-c...
Does traffic from different sites flow through the same server process on CF? E.g., can the following sequence occur?:
1. a request hits a site that doesn't use any of those features, but loads juicy data into memory temporarily; the memory is dealloc'd, but is now "primed"
2. a request hits a site that uses those features, triggers the bug, and leaks the data from step #1.
Said differently, my reading of the CF blog is that only sites using those three page rules trigger the bug, but that is distinct from being affected by it. (The affected site is the one in the uninitialized memory; the site using the rules is in the initialized memory being processed.)
Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak
#30"List of Sites possibly affected" Sites using Cloudflare, really. However, Cloudflare say that only sites using three page rules were affected - email obfuscation, Server-side Excludes and Automatic HTTPS Rewrites. [1] Is this over-estimating the impact, perhaps? [1] https://blog.cloudflare.com/incident-report-on-memory-leak-c...
Does traffic from different sites flow through the same server process on CF? E.g., can the following sequence occur?: 1. a request hits a site that doesn't use any of those features, but loads juicy data into memory temporarily; the memory is dealloc'd, but is now "primed" 2. a request hits a site that uses those features, triggers the bug, and leaks the data from step #1. Said differently, my reading of the CF blog…
Your sequence is correct. The bug was triggered at the proxy level, in an nginx module.