Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

861–870 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#861

Post by gkop »

compuguy wrote: post #818
eridius wrote: post #146

Earlier quoted context omitted.

My bad. I thought Flexible SSL was the option where you can use any arbitrary self-signed cert. But you're right, Flexible SSL means no encryption at all between the origin server and CloudFlare. I will edit my post accordingly.

What if the origin server forces https on the link between CF and the origin server?

That would be much better. Also Cloudflare gives an option to require HTTPS on this link. What's so sneaky about Cloudflare is they call the insecure option "Flexible SSL" rather than what it is, "Insecure SSL". And a major issue is that the end user has no way of knowing the site's Cloudflare configuration and whether it is secure or not.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#862

Post by alxndr »

4ad wrote: post #789
rand77763 wrote: post #686

Earlier quoted context omitted.

I should have done my research, but I walked away from an accepted offer at a company once I found out they took money from In-Q-Tel.

How do you find stuff like this in general? I would love to limit my business to entities I know haven't dealt with other entities I consider suspect, but I don't know how to actually do this filtering.

Could be a good topic for Ask HN?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#863

Post by azna »

porker wrote: post #663
tptacek wrote: post #4

Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…

> A significant number of companies probably need to compose customer notifications; As a one-man company who has never done this before (and to the best of my knowledge never needed to): Any guides/examples to writing a customer notification for security ups like this? Or just recommendations? Thanks.

Email your customers, telling them to change their passwords, and link to some info about the leak. (in case they don't visit your website and miss seeing the security alert banner)

Advise them to change passwords for other services too, list sites possibly affected: https://github.com/pirate/sites-using-cloudflare/blob/master...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#864

Post by SomeCallMeTim »

DINKDINK wrote: post #334
SomeCallMeTim wrote: post #80

Earlier quoted context omitted.

My password manager has > 500 entries. Changing all the passwords....isn't going to happen any time soon. If it only took 60 seconds per site, it would still take eight hours to change them all. Might change a few key passwords, though. Couldn't hurt. I only have a couple of bank/financial passwords at this point. And my various hosting service access passwords. Anything else is not worth the hassle -- and mostly wou…

Your argument essentially revolves around "what are the chances I'll be compromised!?" rather than focusing on "What's the potentially affect of getting compromised" Most people with data or access rights which have several orders of magnitude of value relative to 8 hours worth of labor. The decision to wear a seatbelt isn't driven by the probability of needing it, the decision is drive by the magnitude of exposure t…

> Your argument essentially revolves around "what are the chances I'll be compromised!?" ...

You misunderstand. My argument is explicitly around "What is the potential effect?" That's why I listed changing financial passwords is on my list of things that I might do. (Though see below for why I won't.)

If I only change passwords where someone can do real damage (my primary social media accounts, my accounts that have a current, saved credit card, and any hosting-related accounts) then I've already hit the 98th percentile in damage avoidance. And as I pointed out above, most (all?) of those accounts are unaffected because they don't use CloudFlare at all.

If someone has stolen my password to the Woodworking Forums, and they ... what, post rabid alt-right spam in my name and get me banned? Oh well, either tell them that it was hacked, or if they don't believe me, let that account die and create a new one, if I ever decide to go back and post something again. No big deal. I haven't used it in years anyway, and I can create unlimited new (wildcard-based) email addresses on any of several domains I own.

Aside from the top 10-15 sites I use, I rarely have logins that are that important, anyway. So I'm totally basing this on worst-case damage assessment, not on "how likely it is I'm attacked."

AND...I just looked through all of the top sites I use, and according to the HTTP header, none of them is served using CloudFlare at all (I only checked the index page of each, but none have the telltale CF-Cache-Status headers). No financial sites, no shopping sites that have my credit card, no social media sites. So where's the fire exactly?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#865

Post by dang »

anc84 wrote: post #705

Are the Chinks worse than the Russkis though????! /s

Posting like this is a way to get banned from HN. We've warned you about breaking the site guidelines before.

We detached this comment from https://news.ycombinator.com/item?id=13720467 and marked it off-topic.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#866

Post by eridius »

x0 wrote: post #363
eridius wrote: post #333

Earlier quoted context omitted.

They could ban booters. But then someone else will say "but you allow ! They're clearly bad, you should ban them too". And so they do, and now someone else complains about some other site. Once you start banning sites for the content they hold, where do you draw the line? I don't fault CloudFlare for drawing it at the legal barrier (e.g. no CP).

> Once you start banning sites for the content they hold, where do you draw the line? I mean, you could always just draw the line at booters. Not everything has such a slippery slope.

You can say that. But I guarantee you if they do that, other people will think they should ban other sites too.

Really the only way to avoid the problem is to not play the game, and so that's what CloudFlare does. It's pretty much the only defensible stance to take.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#867

Post by eridius »

yestoallthat wrote: post #666
danielweber wrote: post #250

Earlier quoted context omitted.

I get this argument. I have made it in the past. But CF doesn't want to play Internet cop. Everyone who manages a service gets a constant barrage of "someone using your site did something offensive , I want you to kick them off your service!" CF has decided they are just not going to play the game, at all. Because once they start, then all the piranha come to feast. I'm not saying this means they aren't a racket, whi…

DOS attacks being a bad thing is the whole reason the service exists, so to then group it with "things some people consider offensive" is just double think. If Cloud Flare didn't want to play internet cop in regards to DOS attacks, it would not exist. Since it does, it might as well say the same things with both sides of the mouth.

DDoS attack protection is just one of the services CloudFlare offers. Saying it's the whole reason the service exists suggests that you haven't actually looked at what they do.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#868

Post by SwellJoe »

bsamuels wrote: post #849
SwellJoe wrote: post #269

Earlier quoted context omitted.

I think I'd need to see some sort of evidence of this assertion. Bug bounties are commonly offered across a huge variety of online services, and they get results...not always, not necessarily consistently high quality, but even the giants (facebook comes to mind) have had reasonably serious bugs found by people seeking bounties.

I'll gladly offer some anecdotal evidence: We've got about 2500 tickets in our ticketing queue that have been filed over the past 8 months (excluding spam). Out of those 2500 tickets, only five are valid issues, and only one came with an actual write up. The signal to noise ratio is absolutely awful - and it's not uncommon for people with invalid issues to demand that you pay them regardless.

Wow, that's much worse than I would have guessed. I would have assumed 10:1, tops. We get security reports, and sometimes they ask for a bounty, and only a very small number are bogus (but we don't have a formal bounty program). Less than half of our security issue reports are totally bogus, and another quarter are theoretical issues, but result in some sort of clean up in the code (e.g. no one can figure out how it could be exploited, but it gets refactored anyway).

I've been meaning to try a formal bounty program, as our software is a high value target (administrative tool running on over a million systems), but we're Open Source and don't have a lot of budget for bounties or anything else. If it produced hundreds of reports for every valid issue, it'd be counter-productive, for sure.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#869

Post by b1naryth1ef »

PuffinBlue wrote: post #778
b1naryth1ef wrote: post #655

Earlier quoted context omitted.

Mind emailing me some details? az@discordapp

I didn't keep details, sorry. It was late (UK time) and I was attempting to get my own response out the door. I saw three domains directly myself with compromised details: android-cdn-api.fitbit.com iphone-cdn-client.fitbit.com api-v2launch.trakt.tv I saw data relating to Discord whilst on various cached pages when I was looking at the above domains. The pages are no longer available in Google's cache so I can't link…

No worries, thanks for the response anyway!

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#870

Post by sneak »

jedberg wrote: post #599
sneak wrote: post #366

Earlier quoted context omitted.

That's terrifying. Thanks to Uber now requiring location services on Always instead of just when hailing a car, my and others' personal location history even outside of Uber usage could have been compromised. Sweet.

To be fair, you were kind of a fool if you actually let Uber have your location at all times. As soon as they announced that I blocked Uber from my location. I only allow it when I take an Uber (which is almost never now).

Sometimes I'm in a rush and forget to turn it back to Never.

That doesn't make me a fool, it makes me human. Don't be a jerk. It's a dark pattern for a reason.

Post reply on HN