Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

731–740 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#731

Post by tinco »

mcintyre1994 wrote: post #709
tinco wrote: post #696

Earlier quoted context omitted.

Well HIPAA wouldnt allow your https traffic flow unencrypted through a shared proxy right? This means cloudflare couldnt offer that feature, so they probably didn't? Just think about the HIPAA document describing a single endpoint of dozens of sensitive datastreams, decrypting and then encrypting them all on the same machine, a machine that does some random HTML parsing for snippet caching on the side. I don't see th…

From their blog post: https://blog.cloudflare.com/incident-report-on-memory-leak-c... "Because Cloudflare operates a large, shared infrastructure an HTTP request to a Cloudflare web site that was vulnerable to this problem could reveal information about an unrelated other Cloudflare site." You don't need to be using this feature, or to be sending malformed HTML yourself - just to be in memory for this Cloudflare proc…

Apparently I was incorrect, and HIPAA does not require protected data streams to be isolated from each other. Perhaps I was confusing some other (European) regulation. For HIPAA it seems to be sufficient to promise that everything is secure, that you have documented everything and that you know what to do when stuff goes wrong.

So we should see very quickly that Cloudflare knows what to do when stuff goes wrong.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#732

Post by rmc »

SomeCallMeTim wrote: post #80
joepie91_ wrote: post #52

Earlier quoted context omitted.

> My second thought after relief was the realization that even as a consumer I'm affected by this, my password manager has > 100 entries what percentage of them are using CloudFlare? Should I change all my passwords? Yes. Right now. Don't wait for the vendor to notify you. > What an epic mess. This is the problem with centralization, the system is broken. Yep.

My password manager has > 500 entries. Changing all the passwords....isn't going to happen any time soon. If it only took 60 seconds per site, it would still take eight hours to change them all. Might change a few key passwords, though. Couldn't hurt. I only have a couple of bank/financial passwords at this point. And my various hosting service access passwords. Anything else is not worth the hassle -- and mostly wou…

You use 500 sites which use 2FA?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#734

Post by kmfrk »

vengefulduck wrote: post #337
PuffinBlue wrote: post #187

Earlier quoted context omitted.

> The infosec team worked to identify URIs in search engine caches that had leaked memory and get them purged. With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory. Those 770 unique URIs covered 161 unique domains. The leaked memory has been purged with the help of the search engines. So I tried it too, and there's still data cached there. Am…

I'm also seeing a ton from cn-dc1.uber.com with oauth, cookies and even geolocation info. https://webcache.googleusercontent.com/search?q=cache:VlVylT...

What did it show before it was taken down? In vague terms, of course.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#735

Post by rmc »

sparkling wrote: post #86
fagnerbrack wrote: post #64

TL;DR for the lazy ones: > The examples we're finding are so bad, I cancelled some weekend plans to go into the office on Sunday to help build some tools to cleanup. I've informed cloudflare what I'm working on. I'm finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings. We're talking full https reques…

I don't get it. How is this info leaked? From the blog posts, it seems that "only" the HTTP Headers are being leaked and somehow being crawled by Google? But since when does Google store HTTP request info? Can someone explain?

HTTP Headers were being including the http response bodies of other random websites. Those websites were being crawled and cached.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#736

Post by rmc »

sparkling wrote: post #121
kalmi10 wrote: post #112

Earlier quoted context omitted.

Headers (among other sensitive stuff) were being leaked inside document bodies.

So just to clarify: some bug makes Cloudflare leak the HTTP Headers into the HTML being served and those HTML pages containing sensitive Info got cached by Google (and others)?

Near as I can tell, the HTTP Headers from one site are being included in HTML of other sites...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#737

Post by user5994461 »

firebones wrote: post #516
user5994461 wrote: post #255

Earlier quoted context omitted.

Intensive mining indeed, if it's true that it requires 3.3M requests to get a page leak. With a fixed 100Mbps connection and assuming 2kB per HTTP request-response, you can hope to get one leak every 11 minutes and 6.6GB of traffic, which is a constant 5k requests/s. Maybe if Google reassigns all its SHAterred ressources to doing that... ... and then I realize that we were talking about cloudflare and my mining bot a…

That's what was observed on the Cloudflare end. Without the multiplicand of how many pages Cloudflare served in a given amount of time, you can't determine the impact. Assuming that affected sites were affected en masse, a targeted attack from a connection would be minuscule compared to the pages Cloudflare serves. Cloudflare is serving up more than 100Mbps; the attacker only has to zero in on what's fruitful, which…

Mid 2016 they were serving 4M requests per second.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#738

Post by rmc »

user5994461 wrote: post #255
mattbee wrote: post #219

Earlier quoted context omitted.

This assumes that the Bad Guys hadn't noticed the bug before Tavis, and hadn't started intensively mining Cloudflare for data.

Intensive mining indeed, if it's true that it requires 3.3M requests to get a page leak. With a fixed 100Mbps connection and assuming 2kB per HTTP request-response, you can hope to get one leak every 11 minutes and 6.6GB of traffic, which is a constant 5k requests/s. Maybe if Google reassigns all its SHAterred ressources to doing that... ... and then I realize that we were talking about cloudflare and my mining bot a…

Botnets

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#739

Post by obituary_latte »

eastdakota wrote: post #624
sikhnerd wrote: post #291

Earlier quoted context omitted.

jgrahamc: can you list which public caches you worked with to attempt to address this? It does not inspire confidence when even google is still showing obvious results

Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team. I agree it's troubling that Google is taking so long. We were working with…

>I'm troubled that they went ahead with disclosure before Google crawl team could complete the refresh of their own cache.

It sounded like they (cf) were under a lot of pressure to disclose ASAP from project zero and their 7 day requirement...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#740

Post by alkonaut »

Just stop using pointer arithmetic and manually managed buffers for anything security/safety related already.

Had this proxy been written in nearly any other language it wouldn't have had this vulnerability, like so many similar vulnerabilities.

Using ML or Rust or Java or whatever doesn't magically make all vulnerabilities disappear but it sure makes those that are intrinsic to C disappear. And that's not just a few.

There is just no excuse.

Post reply on HN