Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

891–900 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#891

Post by lesterwelsh28 »

espadrine wrote: post #125
tptacek wrote: post #4

Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…

It is far from over, too! Google Cache still has loads of sensitive information, a link away! Look at this, click on the downward arrow, "Cached": https://www.google.com/search?q="CF-Host-Origin-IP:"+"author... (And then, in Google Cache, "view source", search for "authorization".) (Various combinations of HTTP headers to search for yield more results.)

Any thing

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#892

Post by ChiSoyPry »

dorgo wrote: post #841
EGreg wrote: post #665

Earlier quoted context omitted.

How about... stop CLOUD THIS and CLOUD THAT. Cloud means extreme centralization. It means giving your data to a third party you don't control. Why? Why does our networked software have to assume a centralized topology? In the days when developed countries had dialup, protocols (IRC, Email, etc.) were all decentralized. Today, all the famous developers live with fancy broadband internet connections and forgot what it'…

lol, qbix.com connects to cloudflare.com

wonder how he spells "hypocrisy".

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#893

Post by kevinr »

rmc wrote: post #727
brians wrote: post #218

Earlier quoted context omitted.

Nah. Bug bounties don't work for services like CDNs. Maybe they do elsewhere. But for enterprise services, the noise rate is too high, and the very good bug finders are either salaried, free, or working for the adversary.

Facebook and Google have bug bounties. That's pretty big scale.

Facebook and Google are not, at base, enterprise services.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#894

Post by lesterwelsh28 »

infinity0 wrote: post #415
amalcon wrote: post #360

Earlier quoted context omitted.

Some old IBM environments initialized fresh allocations to 0xDEADBEEF, which had the advantage that the result you got from using such memory would (usually) be obviously incorrect. The fact that it was done decades ago is pretty good evidence that it's not about the actual initialization cost: these things cost a lot more back then. What changed is the paged memory model: modern systems don't actually tie an address…

Parsers don't usually need to hold onto what they're parsing for a very long time, so unless they were running this parallel on a machine with 4k cores, I'd imagine it would be much more likely that a buffer overrun hits the middle of an already-freed allocation rather than going into an active one. In terms of "wasting" memory, perhaps the kernel could detect that you are writing 0s to a COW 0 page and still not act…

On my mind like to set talk what need be ask any quotation needs ask to me

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#895

Post by hacknat »

I'm surprised to learn that people with real security concerns are using Cloudflare. I put it in front of my blog, but I would never use it in front of something that has sensitive data. I just don't get how companies like Zendesk could be so stupid. I barely blame Cloudflare. If you think terminating SSL with a CDN is a good idea you get what you deserve.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#896

Post by kevinr »

dsacco wrote: post #552
SwellJoe wrote: post #269

Earlier quoted context omitted.

I think I'd need to see some sort of evidence of this assertion. Bug bounties are commonly offered across a huge variety of online services, and they get results...not always, not necessarily consistently high quality, but even the giants (facebook comes to mind) have had reasonably serious bugs found by people seeking bounties.

He's not wrong about the noise level. I conducted a survey of the most notable bug bounties in 2014 and found that the largest companies either have ineffective programs or quickly scale teams to handle inbound reports full-time. There are security engineers at Google and Facebook who spend a majority of their time responding to, and triaging bug bounty submissions. That said, I disagree that bug bounties don't work…

Bounty researchers aren't the only quasi-rational economic actors in this sytem. Cloudflare, we might surmise, get enough benefit from their bounty program that they're willing to pay for its administration costs and the occasional T-shirt, but they don't see value in spending more than that.

More than that, access to the service is actually the limiting factor for good bug bounty results. Cloudflare's bug bounty, we might surmise, works as well as it does because anyone can sign up for a Cloudflare account for free. For an enterprise CDN, who won't talk to a potential customer without the prospect of an $x0,000+/year contract, everyone who has enough access to the service to, in the general course of business, find and submit meaningful reports is employed by a customer, and likely prohibited from accepting substantial rewards. Everyone else either doesn't have enough access to submit meaningful reports, or the bug is so bad (like this one) that they'll report it regardless.

Arguably this shows that Cloudflare and other CDNs are right in their calculations: Tavis disclosed this bug to Cloudflare without promise of a payout, or even a T-shirt. Might some good Samaritan on the Internet have noticed the bug and reported it earlier if the bounty was more substantial? Perhaps. But in responding to a vulnerability of this magnitude, you want to work with someone of Tavis's caliber, who has the good of all the stakeholders in mind, not a profit-motivated rando.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#897

Post by kevinr »

fictioncircle wrote: post #833
brians wrote: post #218

Earlier quoted context omitted.

Nah. Bug bounties don't work for services like CDNs. Maybe they do elsewhere. But for enterprise services, the noise rate is too high, and the very good bug finders are either salaried, free, or working for the adversary.

> Nah. Bug bounties don't work for services like CDNs. Maybe they do elsewhere. But for enterprise services, the noise rate is too high, and the very good bug finders are either salaried, free, or working for the adversary. Yes, running a real bug bounty system requires professional security engineers and a professional security posture to sort through the noise. However, when the sole product you are selling is secu…

Here's a question: what's the trade-off in terms of return on investment between hiring salaried security engineers to administer a bug bounty and hiring salaried security engineers to find bugs directly?

Parent's claim, as I read it, is that it's a better use of an enterprise CDN's money to hire security engineers to find bugs than to administer a bounty. Seems plausible to me. Where's that line?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#898

Post by chasb »

chimeracoder wrote: post #619
patio11 wrote: post #455

Earlier quoted context omitted.

If anyone here is HIPAA-regulated or you have a customer who is, and you used Cloudflare during those dates, it is Big Red Button time. You've almost certainly got a reportable breach; depending on how tightly you're able to scope it maybe it won't be company-ending.

> If anyone here is HIPAA-regulated or you have a customer who is Cloudflare certainly does; I founded a health tech company, and Cloudflare was the recommended go-to for health tech startups who needed a CDN while serving PHI. And this is definitely a reportable breach. Technically any breach is supposed to be reported to HHS, but in reality, a lot of covered entities (e.g. insurers) fail to report smaller breaches…

Does Cloudflare sign BAAs?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#900

Post by duneroadrunner »

duneroadrunner wrote: post #660
thurston wrote: post #615

Author of Ragel here. An experienced Ragel programmer would know that when you start setting the EOF pointer you are enabling code paths that never executed before. Like, potentially buggy ones. Eek!

I'm not familiar with Ragel, but you might consider adding support for SaferCPlusPlus[1] as an output target. It should be a fairly simple modification of your existing C or C++ output generator. SaferCPlusPlus was, in part, designed for this (I mean, CloudFlare's) sort of situation - using C/C++ in internet facing applications. [1] https://github.com/duneroadrunner/SaferCPlusPlus

Actually, the Ragel generated code (fragment) looks like it's already pretty SaferCPlusPlus compliant, since it itself doesn't declare any buffers or pointer/iterators. So I guess the recommendation instead would be for CloudFlare, and anyone else writing nginx modules in C/C++, to wrap any nginx-supplied buffers in a bounds-checked wrapper (like an array_view[1], gsl::span, or RandomAccessSection[2]).

[1] https://github.com/rhysd/array_view

[2] https://github.com/duneroadrunner/SaferCPlusPlus#txscoperand...

Post reply on HN