"and even plaintext API requests from a popular password [1Password] manager that were sent over https" Plaintext?
[deleted]
Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
821–830 of 1001 posts
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#822Can we start a list of affected right now? I found: OKCupid Uber people claiming 1Password, can't find Reddit Lyft Yelp Pingdom Digital Ocean Montecito Bank and Trust
I found: FitBit Hacker News Stack Overflow Zendesk Discord FastMail (not really see below)
Stack Overflow is not directly affected (see http://meta.stackexchange.com/a/291482/151385). They stopped using CloudFlare before this issue was introduced.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#823Earlier quoted context omitted.
>Friendly reminder that Cloudflare willingly hosts the top DDoS-for-hire attack sites, and refuses to take them down when they are reported. Why should CF be required to police the internet? CF doesn't even host them, they just protect their sites from DDoS and DNS.
"CF doesn't even host them, they just protect their sites from DDoS and DNS." The #1 excuse people use. They do more than just DNS, they deliver the actual data, that would have been delivered by the original host, to visitors. So I'd consider them hosting an automatically updated mirror, and as bad as the original host.
Related story:
I used to use Cloudflare for DNS, but I left because I was becoming uncomfortable with their policy regarding DDoS attack sites. We run our own Anycast CDN now for the HTTP, but I didn't want to have to deal with the DNS servers so I outsourced it to DNSimple.
Turns out that DNSimple unknownst to me started using Cloudflare's DNS servers under the hood. They were getting attacked by the DDoS attack sites Cloudflare hosts and it was threatening the service. I figured this out by doing a lookup of their nameserver IPs.
So my attempt to get away from using Cloudflare has meant that I'm just right back on Cloudflare's servers, again.
This is an insidious cycle that will not end well for the internet, or for our freedom on it. The internet will not be decentralized anymore if the entire thing sits on Cloudflare and depends on Cloudflare to function. Cloudbleed is a canary in the coalmine.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#824Webmasters and App-devs running on CloudFlare. You (at least) have to "force-logout" your users that have "remember me" cookie set.
At least change the cookie name so the token stops working. For example, in ASP.NET - change the "forms-auth" name in the web.config file. etc etc.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#825[deleted]
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#826RIP Cloudflare 2017.. took you long enough
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#827Earlier quoted context omitted.
If I'm understanding correctly, that list would include not only the 3,438 domains with content that triggered the bug, but every Cloudflare customer between 2016-09-22 and 2017-02-18.
No. Only Cloudflare customers using a subset of features of the SSL proxy service are impacted. Cloudflare has a lot of customers who only use the free DNS service, for example.
Careful. It appears that any Cloudflare client who was sending HTTP/S traffic through their proxies is affected. A small subset of their customers had the specific problem that triggered the bug, but once triggered, the bug disclosed secrets from all their web customers.
You're not exposed if you never sent traffic through their proxies; for instance, if you somehow only used them for DNS.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#828Earlier quoted context omitted.
It's about payoff * probability. Let's say I (an idiot, but knowledgeable enough) stumble upon a serious vulnerability in Google. Option 1: I could try to sell that on a darknet market for a decent amount of money. State actors, hacker groups, lots of people want to pay for such things to exploit. But, I might not get paid very much, I might get screwed over, I might go to jail, who the heck knows, I'm playing with a…
> I might go to jail Is selling exploits illegal? If so is selling them to google also illegal?
> Is selling exploits illegal?
Maybe. If the FBI decides to build a case against you for it, I'm sure they could find a law to use.
> is selling them to google also illegal?
I'm disclosing, and Google is granting me a reward. There's... Some difference I'm sure.
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#829Earlier quoted context omitted.
This could easily happen in Go as well. All that would be needed is to reuse the buffer in between requests, and rely on the buffer length instead of clearing it. To make it safer you would need to deallocate and reallocate the buffer for each request, but that might be slow. Doing that would fix it for Go, or for C, it would be the same either way. So I'm not convinced that using Go would have helped here.
"This could easily happen in Go as well." Not really true. Go operates on slices that panic on out-of-bounds accesses. So, for this to happen in Go you would have to reinvent slices and use a lot of manual C-style code to operate on them, which literally nobody does in Go, because it's too hard.
Recycling memory buffers, like CloudFlare does?
Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory
#830Earlier quoted context omitted.
Always nice to have options. Not zeroing memory on allocation might save a few cpu cycles.
It's pretty much the definition of false economy. Would you rather save a few cycles or suffer debilitating security bugs at random intervals? Always use calloc unless a) there's a proven performance problem and b) you know for a fact that due to careful inspection/static analysis/black magic malloc is safe. Then use calloc anyway because why risk it?
It depends on the size of the chunk of allocated memory. If it is quite large, time spent zeroing it can be substantial.
Then again, if you're allocating in performance critical path, you're doing it wrong anyways.