How was https trafic leaked? Cloudflare, in order to offer its services, acts like a man in the middle and internally decrypts https trafic [0]
[0]: https://scotthelme.co.uk/tls-conundrum-and-leaving-cloudflar...
Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
671–680 of 1001 posts
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#672>Cloudflare pointed out their bug bounty program, but I noticed it has a top-tier reward of a t-shirt. Considering the amount and sensitivity of the data they handle, I'm not sure a t-shirt is an appropriate top-tier reward.
I got a t-shirt from cloudflare, and all i did was tell them "please send me a t-shirt" - they shipped it halfway across the world as well, for free! (it didn't fit...)
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#673Earlier quoted context omitted.
The blog post makes it seem like the problem was in an nginx module. Looking at the docs [1] it looks like that's a C API; as far as I know writing shared libraries in golang for a C caller isn't really a thing (because the runtime needs to exist). Rust might have better luck here (I _think_ there have been attempts to get rust code loaded by not-rust code), but I haven't kept track. [1] https://www.nginx.com/resourc…
Calling Rust from C is easy. Details: http://siciarz.net/24-days-of-rust-calling-rust-from-other-l...
And if you need a more expedient fix for existing C/C++ code, there's SaferCPlusPlus[1].
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#674"Cloudbleed".
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#675What bothers me is not the bug itself, but the fact that so much sites and apps terminate SSL at cloudflare that NSA/FBI/other-3-letter-agency does not need to come after any separate company, but just needs to tap cloudflare and call it a day.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#676Earlier quoted context omitted.
Myself and 4 other people I know all happened to get their reddit accounts temporarily locked due to a "possible compromise" in the past week or so, which has never happened to any of us before. Anyone else?
That would be unrelated to this. We haven't taken any action on any accounts because of this issue and have no plans to, as we (reddit.com) were unaffected.
Happened to me as well. If it's not related to CloudBleed, can you tell us specifically what happened? It's making me not trust Reddit.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#677Earlier quoted context omitted.
> only sites with one or more of those features enabled leaked data No. From what he says, enabling that feature on a CF proxy basically triggered the bug on any site that happened to go through that proxy, regardless of whether it used the feature or not.
It only triggered the bug on sites that were using those features, but any other CF site was vulnerable to getting dumped out.
yeah that's what i meant - content could be dumped from any site going through, regardless of whether they used the broken features.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#678My first thought was relief, thank god I'm not using Cloudflare. Where would you even start to address this? Everything you've been serving is potentially compromised, API keys, sessions, personal information, user passwords, the works. You've got no idea what has been leaked. Should you reset all your user passwords, cycle all or your keys, notify all your customers that there data may have been stolen? My second th…
> You've got no idea what has been leaked
If your site is served through Cloudflare, assume it's all out there because it might be. Standard Big Red Button(tm) procedure.
I don't run any particularly impressive sites but I'll be resetting passwords today. Also cycling things I use behind Cloudflare like DigitalOcean passwords/API keys.
It's supposed to be read-only Friday, Cloudflare :(
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#679Earlier quoted context omitted.
It is far from over, too! Google Cache still has loads of sensitive information, a link away! Look at this, click on the downward arrow, "Cached": https://www.google.com/search?q="CF-Host-Origin-IP:"+"author... (And then, in Google Cache, "view source", search for "authorization".) (Various combinations of HTTP headers to search for yield more results.)
Lol, Google just purged that search. EDIT: but there's still plenty of fish: http://webcache.googleusercontent.com/search?q=cache:lw4K9G2... This will take weeks to clean, and that's just for Google. EDIT2: found other oauth tokens, lots of fitbit calls... And this just by searching for typical CF internal headers on Google and Bing. There is no way to know what else is out there. What a mess.
So while people are having fun here with search queries, how many scripts are already up and running in the wild, scraping every caching service they can think of in creative ways for useful data...
This is an ongoing disaster, wasn't this disclosed too soon?
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#680Holy sh*t. Is this the end of Cloudflare with the trust being absolutely destroyed and lawsuits coming in? Can't say I'm sad for them. Cloudflare sells you DDOS protection, and hosts (eg. masks the IP of) the very DDOSers to protect against themselves, which I find bordering on the criminal.
Hosters like Hetzner, OVH have for a year now offered DDOS protection (I'm guessing it's heuristic rate limiting, but they won't tell details b/c that would make it trivial to workaround it, so they say). Could someone characterize their offering and tell me if it's any good?
To those spinning a story against C programming here: it is entirely possible (trivial, even) to isolate address spaces between requests, and has been for like 25 years (CGI programming) and more. When you absolutely must use a long running, single-address space service container, OpenBSD's httpd shows how to do it right (goes to great lengths to randomize/re-initialize memory etc.). I agree, though, that using straight C isn't a good choice for the latter.