Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

711–720 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#711

Post by dbmnt »

nikisweeting wrote: post #413
wilde wrote: post #247

Earlier quoted context omitted.

Are you guys planning to release the list so we can all change our passwords on affected services? Or are you planning on letting those services handle the communication?

I've compiled a list of 7,385,121 domains that use Cloudflare here: https://github.com/pirate/sites-using-cloudflare

This list is misguided. It's just a dump of sites using Cloudflare's DNS, a hugely popular and (mostly) free service. The vulnerability only affected customers using Cloudflare's paid SSL proxy (CDN) service. The latter is a much smaller subset. Even then, only a subset of the SSL proxy users, those with certain options enabled that caused traffic to go through a vulnerable parser, were really impacted. I'm not sure a list as broad as this is helpful.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#712

Post by wapz »

meowface wrote: post #451
chrissnell wrote: post #392

Earlier quoted context omitted.

It seems like the reasonable thing for Google to do is to clear their entire cache. The whole thing. This is the one thing that they could do to be certain that they aren't caching any of this.

That might be a bit too extreme. But they should do something quickly to try to find all of these.

I would say cloudflare should hire them to try to find them. It's really not on google IMO (unless caching has some implications regarding storing sensitive data).

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#713

Post by lmm »

vertex-four wrote: post #253
WillyOnWheels wrote: post #195

Earlier quoted context omitted.

Can you think of an existing system (let's go with websites) that meets your standards?

There isn't an automated system that can tell you whether it's safe to give data to a website, just like there's no automated system which can tell you a given vendor/service provider in general is reputable. All you've got is regulations, human-based reputation ranking, and public shaming.

> All you've got is regulations, human-based reputation ranking, and public shaming.

Indeed - so we should be applying all of those against CloudFlare, and any other organization that offers or uses a "Flexible SSL"-like product, as firmly as we can.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#714

Post by dbmnt »

tlrobinson wrote: post #306
wilde wrote: post #247

Earlier quoted context omitted.

Are you guys planning to release the list so we can all change our passwords on affected services? Or are you planning on letting those services handle the communication?

If I'm understanding correctly, that list would include not only the 3,438 domains with content that triggered the bug, but every Cloudflare customer between 2016-09-22 and 2017-02-18.

No. Only Cloudflare customers using a subset of features of the SSL proxy service are impacted.

Cloudflare has a lot of customers who only use the free DNS service, for example.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#716

Post by homakov »

kevcampb wrote: post #252
dsp1234 wrote: post #167

Earlier quoted context omitted.

It doesn't have to be a secret crawler. Just one that wasn't contacted by cloudflare (I didn't see any non-US search providers mentioned).

In other words, Baidu are currently sitting on a treasure trove of keys and passwords.

+Yandex

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#717

Post by corobo »

vacri wrote: post #555
fictioncircle wrote: post #51

Earlier quoted context omitted.

I would say the crazy thing is a mere t-shirt as their "bug bounty" top tier award given how they've pitched themselves as an extremely secure service. https://hackerone.com/cloudflare I'm sorry but when the reward for breaking into you is basically a massive pinata of personal information...that simply is a bad joke. Security flaws are going to happen and if you aren't going to even offer a reasonable financial rewa…

The reward includes a t-shirt, it isn't a mere t-shirt. You also get "12 months of CloudFlare's Pro or 1 month of Business service on us" (~$200). The reward is also not tiered. The award may still not be all that much, but let's not make things up about them.

If I needed CF Pro though I'd already be on it.

I mean I guess it's good if you're already on Pro and could do with the freebie year but it's not really much to get the whitehats auditing your systems for free*

* free unless they find something

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#718

Post by MattBearman »

DangerousPie wrote: post #155

Has anybody else actually received an email from Cloudflare about this? I'm a paying customer, but haven't heard anything from them yet. I hope they don't expect they can leave it at a random blog post that will go by unnoticed?

I'm a free customer, also no email...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#719

Post by wapz »

emmelaich wrote: post #645
fletchowns wrote: post #534

Earlier quoted context omitted.

But there are so many other much more likely reasons why something like that would have happened, it is quite a leap to think that it is somehow related to this issue.

Without disagreeing, can you give me an example. And it's just a speculation. Shrug.

One simple explanation could be the road was between very large concrete buildings or the area has some sort of GPS interference (there is one place in Tokyo that jumps my GPS and probably others' by about 300m to the same location every time). Another simple explanation is the software has a bug on when it thinks you arrive in some extremely bizarre scenario (hence you both had it happen simultaneously).

I don't know how it works in the back so this is all speculation of course.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#720

Post by lexicality »

camus2 wrote: post #472
toyg wrote: post #263

Earlier quoted context omitted.

Lol, Google just purged that search. EDIT: but there's still plenty of fish: http://webcache.googleusercontent.com/search?q=cache:lw4K9G2... This will take weeks to clean, and that's just for Google. EDIT2: found other oauth tokens, lots of fitbit calls... And this just by searching for typical CF internal headers on Google and Bing. There is no way to know what else is out there. What a mess.

Ouch, you really see everything : > authorization: OAuth oauth_consumer_key ... what a shit show. I'm sorry but at that point there must be consequences for incompetence. Some might argue "But nobody can't do anything" ... I'm sorry, CF has the money to to ditch C entirely and rewrite everything from the ground up with a safer language, I don't care what it is, Go,Rust whatever. At that point people using C directly…

This actually happened because they started to rewrite it all, according to their blog post.
Post reply on HN