Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

691–700 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#691

Post by oddratios »

emmelaich wrote: post #349
AznHisoka wrote: post #111

Earlier quoted context omitted.

Can someone tell me the implications of this in laymen terms? For instance what does it mean "sprayed into caches"? what cache? dns cache? browser cache? if the latter, does it mean you are safe if the person who owns that cache is an innocent non technical iser?

It's reminiscent of the earlier days of the Squid cache. When it had bugs and devivered up cached files the typical symptom was that everyone in the company got unwanted porn. Because the biggest user (by far) of the 'net was the person into porn and so 90% of the Squid cache was porn.

It served the wrong resource instead of failing to serve a resouce? Back then, if I were to suffer this, what is the likelihood of a porn for cats experience?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#692

Post by oddratios »

hueving wrote: post #493
hoorayimhelping wrote: post #85

Earlier quoted context omitted.

> edit: why the revulsion I'd guess it's because of the crude and reductive way you describe the service cloudflare provides. I don't know what type of programming you do, but many small services don't have the infrastructure to mitigate the kind of attacks cloudflare deals with and they wouldn't be around without services like this. I don't like the internet becoming centralized into a few small places that mitigate…

So rather than demand fixes for the fundamental issues that enable ddos attacks (preventing IP spoofing, allowing infected computers to remain connected, etc), we just continue down this path of massive centralization of services into a few big players that can afford the arms race against bonnets. Using services like Cloudflare as a 'fix' is wrecking the decentralized principles of the Internet. At that point we mig…

When in a tactical emergency do not say "and why is this shit raining down upon us?"

That is a separate step. First you either take cover or help.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#693

Post by kbody »

abalone wrote: post #520

Cloudfare's bug bounty maximum reward[1]: 1. Recognition on our Hall of Fame. 2. A limited edition CloudFlare bug hunter t-shirt. CloudFlare employees don't even have this shirt. It's only for you all. Wear it with pride: you're part of an exclusive group. 3. 12 months of CloudFlare's Pro or 1 month of Business service on us. 4. Monetary compensation is not currently offered under this program. Guessing they're gonna…

Indeed, I've heard the issue of low signal-to-noise ratio, but it's pretty irresponsible not to offer any real reward.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#694

Post by efdee »

tannhaeuser wrote: post #680

Holy sh*t. Is this the end of Cloudflare with the trust being absolutely destroyed and lawsuits coming in? Can't say I'm sad for them. Cloudflare sells you DDOS protection, and hosts (eg. masks the IP of) the very DDOSers to protect against themselves, which I find bordering on the criminal. Hosters like Hetzner, OVH have for a year now offered DDOS protection (I'm guessing it's heuristic rate limiting, but they won'…

Last time I checked, Hezner's DDoS "protection" basically meant they disconnected you from the network if you got an incoming DDoS. Has this changed?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#695

Post by demonshalo »

oddratios wrote: post #692
hueving wrote: post #493

Earlier quoted context omitted.

So rather than demand fixes for the fundamental issues that enable ddos attacks (preventing IP spoofing, allowing infected computers to remain connected, etc), we just continue down this path of massive centralization of services into a few big players that can afford the arms race against bonnets. Using services like Cloudflare as a 'fix' is wrecking the decentralized principles of the Internet. At that point we mig…

When in a tactical emergency do not say "and why is this shit raining down upon us?" That is a separate step. First you either take cover or help.

Problem most often is that after you take cover, you forget to ask that question.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#696

Post by tinco »

chimeracoder wrote: post #619
patio11 wrote: post #455

Earlier quoted context omitted.

If anyone here is HIPAA-regulated or you have a customer who is, and you used Cloudflare during those dates, it is Big Red Button time. You've almost certainly got a reportable breach; depending on how tightly you're able to scope it maybe it won't be company-ending.

> If anyone here is HIPAA-regulated or you have a customer who is Cloudflare certainly does; I founded a health tech company, and Cloudflare was the recommended go-to for health tech startups who needed a CDN while serving PHI. And this is definitely a reportable breach. Technically any breach is supposed to be reported to HHS, but in reality, a lot of covered entities (e.g. insurers) fail to report smaller breaches…

Well HIPAA wouldnt allow your https traffic flow unencrypted through a shared proxy right? This means cloudflare couldnt offer that feature, so they probably didn't?

Just think about the HIPAA document describing a single endpoint of dozens of sensitive datastreams, decrypting and then encrypting them all on the same machine, a machine that does some random HTML parsing for snippet caching on the side.

I don't see that passing review, but perhaps I'm naieve..

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#697

Post by Blahah »

kyledrake wrote: post #506
chipperyman573 wrote: post #486

Earlier quoted context omitted.

>Friendly reminder that Cloudflare willingly hosts the top DDoS-for-hire attack sites, and refuses to take them down when they are reported. Why should CF be required to police the internet? CF doesn't even host them, they just protect their sites from DDoS and DNS.

Cloudflare has spent a lot of time gaslighting people into believing this, but it physically, scientifically, OSI model-y isn't true. Cloudflare hosts web sites . When Cloudflare CDN edges that content, that content exists on their servers. Just because the canonical store is on another machine doesn't mean they don't host the site. If I mirror a site from some other server, and you're loading that site from my serve…

It's not the responsibility of anyone except the police to police those sites. Cloudflare aren't providing those attack sites with an attack vector, they are just serving their webpages. The post office isn't responsible for policing blackmail letters sent through the mail.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#698

Post by masklinn »

amalcon wrote: post #360
infinity0 wrote: post #307

Earlier quoted context omitted.

Could someone enlighten me on why malloc and free don't automatically zero memory by default? Someone pointed me to MALLOC_PERTURB_ and I've just run a few test programs with it set - including a stage1 GCC compile, which granted may not be the best test - and it really doesn't dent performance by much. (edit: noticeably, at all , in fact) People who prefer extreme performance over prudent security should be the ones…

Some old IBM environments initialized fresh allocations to 0xDEADBEEF, which had the advantage that the result you got from using such memory would (usually) be obviously incorrect. The fact that it was done decades ago is pretty good evidence that it's not about the actual initialization cost: these things cost a lot more back then. What changed is the paged memory model: modern systems don't actually tie an address…

> Some old IBM environments initialized fresh allocations to 0xDEADBEEF, which had the advantage that the result you got from using such memory would (usually) be obviously incorrect.

On BSDs, malloc.conf can still be configured to do that: on OpenBSD, junking (fills allocations with 0xdb and deallocations with 0xdf) is enabled by default on small allocations, "J" will enable it for all allocations. On FreeBSD, "J" will initialise all allocations with 0xa5 and deallocations with 0x5a.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#699

Post by tannhaeuser »

efdee wrote: post #694
tannhaeuser wrote: post #680

Holy sh*t. Is this the end of Cloudflare with the trust being absolutely destroyed and lawsuits coming in? Can't say I'm sad for them. Cloudflare sells you DDOS protection, and hosts (eg. masks the IP of) the very DDOSers to protect against themselves, which I find bordering on the criminal. Hosters like Hetzner, OVH have for a year now offered DDOS protection (I'm guessing it's heuristic rate limiting, but they won'…

Last time I checked, Hezner's DDoS "protection" basically meant they disconnected you from the network if you got an incoming DDoS. Has this changed?

According to https://wiki.hetzner.de/index.php/DDoS-Schutz/en, they're using Arbor and Juniper kit

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#700

Post by annnnd »

ifdefdebug wrote: post #683
summarity wrote: post #40

Earlier quoted context omitted.

Not only that, but the "reward" in the program is laughable and frankly insulting to any serious researcher considering the scope of CF. Bug bounty platforms are already becoming the fiverr of ITSEC (that's not a good thing), CF just made an extra effort do diminish the value for researchers. Management: "Why do we offer $5k for a small bug again? Look at CF, they don't offer any money!"

> "Why do we offer $5k for a small bug again? Look at CF, they don't offer any money!" Answer: "Because if they had set up a bounty of $50k for security issues, they'd had thousands of researchers/students/white hats etc. watching the output of their servers."

"...and could maybe avoid or lessen the impact of this fiasco."
Post reply on HN