Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

841–850 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#841

Post by dorgo »

EGreg wrote: post #665
hoorayimhelping wrote: post #85

Earlier quoted context omitted.

> edit: why the revulsion I'd guess it's because of the crude and reductive way you describe the service cloudflare provides. I don't know what type of programming you do, but many small services don't have the infrastructure to mitigate the kind of attacks cloudflare deals with and they wouldn't be around without services like this. I don't like the internet becoming centralized into a few small places that mitigate…

How about... stop CLOUD THIS and CLOUD THAT. Cloud means extreme centralization. It means giving your data to a third party you don't control. Why? Why does our networked software have to assume a centralized topology? In the days when developed countries had dialup, protocols (IRC, Email, etc.) were all decentralized. Today, all the famous developers live with fancy broadband internet connections and forgot what it'…

lol, qbix.com connects to cloudflare.com

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#842

Post by lastpasstwitter »

uladzislau wrote: post #606
edwinyzh wrote: post #597

Earlier quoted context omitted.

Just deleted my LastPass account - have been converted to KeePass for over a month.

Did Lastpass use Cloudflare? That would be a disaster.

Apparently they do not: https://twitter.com/LastPassStatus/status/835136572798431232

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#843

Post by martinvol »

jkells wrote: post #44

My first thought was relief, thank god I'm not using Cloudflare. Where would you even start to address this? Everything you've been serving is potentially compromised, API keys, sessions, personal information, user passwords, the works. You've got no idea what has been leaked. Should you reset all your user passwords, cycle all or your keys, notify all your customers that there data may have been stolen? My second th…

They said https never broke, so if you were doing things right way you should not be affected at all. Do not overreact.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#845

Post by electrum »

aioprisan wrote: post #512
Trundle wrote: post #470

Earlier quoted context omitted.

Have you asked them for an eta on your shirt?

You know a company isn't serious about security when their top security bounty is a t-shirt. Instagram has a better policy, for God's sake.

Instagram has been part of Facebook for over four years, so they are covered by the Facebook Bug Bounty: https://www.facebook.com/whitehat

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#846

Post by wlesieutre »

dajohnson89 wrote: post #769
mcintyre1994 wrote: post #709

Earlier quoted context omitted.

From their blog post: https://blog.cloudflare.com/incident-report-on-memory-leak-c... "Because Cloudflare operates a large, shared infrastructure an HTTP request to a Cloudflare web site that was vulnerable to this problem could reveal information about an unrelated other Cloudflare site." You don't need to be using this feature, or to be sending malformed HTML yourself - just to be in memory for this Cloudflare proc…

Why isn't the cloudflare encrypted with HTTPS??

It probably was, but any encrypted data still exists in unencrypted form in the server's memory before it's encrypted and sent out over https. You have to have something to encrypt before you can encrypt it.

The memory leaked by this bug includes that pre-encryption data, which is what we're seeing here.

(At least that's my interpretation, computer security isn't quite my wheelhouse)

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#847

Post by Coincoin »

kyledrake wrote: post #462

Friendly reminder that Cloudflare willingly hosts the top DDoS-for-hire attack sites, and refuses to take them down when they are reported. Run WHOIS on them, it's almost 100% behind Cloudflare: https://www.google.com/#q=ddos+booter I would be less concerned about the fact that Cloudflare is spraying private data all over the internet if people weren't being coerced into it by a racket. We won't have a decentralized…

They are charging us money to protect us from the same people they are protecting? Genius.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#848

Post by AYBABTME »

ars wrote: post #704
AYBABTME wrote: post #317

This comes around to me as something that just shouldn't have happened. CloudFlare are pretty big on Go, as far as I can tell (and I guess Lua for scripting nginx). Why was this parsing package written in a non memory-safe language? Parsing is one of those "obvious" things easy to mess up; the likelihood of a custom, hand written parser being buggy is pretty high. If it's somehow understood that your library is likel…

This could easily happen in Go as well. All that would be needed is to reuse the buffer in between requests, and rely on the buffer length instead of clearing it. To make it safer you would need to deallocate and reallocate the buffer for each request, but that might be slow. Doing that would fix it for Go, or for C, it would be the same either way. So I'm not convinced that using Go would have helped here.

That is true, but reusing buffers in Go is a lot more deliberate an action than in C. The possibility is still there, but I think it's way harder to mess up.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#849

Post by bsamuels »

SwellJoe wrote: post #269
brians wrote: post #218

Earlier quoted context omitted.

Nah. Bug bounties don't work for services like CDNs. Maybe they do elsewhere. But for enterprise services, the noise rate is too high, and the very good bug finders are either salaried, free, or working for the adversary.

I think I'd need to see some sort of evidence of this assertion. Bug bounties are commonly offered across a huge variety of online services, and they get results...not always, not necessarily consistently high quality, but even the giants (facebook comes to mind) have had reasonably serious bugs found by people seeking bounties.

I'll gladly offer some anecdotal evidence:

We've got about 2500 tickets in our ticketing queue that have been filed over the past 8 months (excluding spam). Out of those 2500 tickets, only five are valid issues, and only one came with an actual write up.

The signal to noise ratio is absolutely awful - and it's not uncommon for people with invalid issues to demand that you pay them regardless.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#850

Post by chousuke »

I used the lastpass CLI tool and some UNIX tools to do a tentative check of which of my domains might be affected. Something like the following should work okay:

    lpass ls | egrep -o '[a-z]+\.[a-z]+' | sort > mydomains.sorted
    sort sorted_unique_cf.txt > cf_really_sorted
    comm -12 mydomains.sorted cf_really_sorted
It's not perfect (since it will only look at the lastpass item description, not the actual URL, and will only match foo.tld type domains), but it still found a number of domains for me
Post reply on HN