Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

941–950 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#941

Post by phaed »

nodesocket wrote: post #935
slipmagic wrote: post #932

Earlier quoted context omitted.

I would be pretty mad if a website that I was supposed to trust with my data made an untrue statement about how something was taken care of, when it was not, and then publish details of the bug while cache it still out in the wild, and now exploitable by any hacker who was living under a rock during the past few months.

Actually I proxy two of my profitable startup frontend sites with CloudFlare, so I am affected (not really), but giving them the benefit of the doubt as they run a great service and these things happen.

They are well past deserving the benefit of the doubt.

I would also advise you notify your cloud-based services' customers how they might be affected (yes really), trust erosion tends to be contagious.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#942

Post by winteriscoming »

eastdakota wrote: post #624
sikhnerd wrote: post #291

Earlier quoted context omitted.

jgrahamc: can you list which public caches you worked with to attempt to address this? It does not inspire confidence when even google is still showing obvious results

Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team. I agree it's troubling that Google is taking so long. We were working with…

>> We have continued to escalate this within Google to get the crawl team to prioritize the clearing of their caches as that is the highest priority remaining remediation step.

If you are using the same attitude as you use in this comment, with their team, i'm pretty sure they will be thrilled to keep aside all their regular work and help you out cleaning up a enormous mess created by a bug in your service.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#943

Post by AndrewKemendo »

nikisweeting wrote: post #369
jkells wrote: post #44

My first thought was relief, thank god I'm not using Cloudflare. Where would you even start to address this? Everything you've been serving is potentially compromised, API keys, sessions, personal information, user passwords, the works. You've got no idea what has been leaked. Should you reset all your user passwords, cycle all or your keys, notify all your customers that there data may have been stolen? My second th…

We're compiling a list of domains using several scrapers and updating it here: https://github.com/pirate/sites-using-cloudflare You can start by cross referencing your password manager with this list, and working your way out from there.

As an aside, I found this really interesting:

ashleymadison.com

ashleyrnadison.com

I find it really interesting that they registered that particular misspelling and they both point to the same servers. I can see doing this for some obvious domains like gogle.com, but the distinction there is simply that r+n looks like m.

Probably a really obvious answer here, but my guess is that they are trying to help people throw off the scent of someone browsing a history.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#944

Post by tptacek »

nodesocket wrote: post #935
slipmagic wrote: post #932

Earlier quoted context omitted.

I would be pretty mad if a website that I was supposed to trust with my data made an untrue statement about how something was taken care of, when it was not, and then publish details of the bug while cache it still out in the wild, and now exploitable by any hacker who was living under a rock during the past few months.

Actually I proxy two of my profitable startup frontend sites with CloudFlare, so I am affected (not really), but giving them the benefit of the doubt as they run a great service and these things happen.

So far as I know, nothing like this thing has ever happened at any CDN ever before.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#945

Post by cjcampbell »

chasb wrote: post #898
chimeracoder wrote: post #619

Earlier quoted context omitted.

> If anyone here is HIPAA-regulated or you have a customer who is Cloudflare certainly does; I founded a health tech company, and Cloudflare was the recommended go-to for health tech startups who needed a CDN while serving PHI. And this is definitely a reportable breach. Technically any breach is supposed to be reported to HHS, but in reality, a lot of covered entities (e.g. insurers) fail to report smaller breaches…

Does Cloudflare sign BAAs?

I've also been looking into the same question, and I don't see any external indication that they consider themselves a Business Associate as far as their policies go. I would argue, however, that CloudFlare is a BA by definition if an application is using any of the WAF or SSL proxy functionality.

We've been reaching out to a couple of vendors that do use the proxy functionality (given that the data spill could impact our clients as well). Hoping to resolve the BAA uncertainty in the process too.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#946

Post by cjcampbell »

chasb wrote: post #902
patio11 wrote: post #455

Earlier quoted context omitted.

If anyone here is HIPAA-regulated or you have a customer who is, and you used Cloudflare during those dates, it is Big Red Button time. You've almost certainly got a reportable breach; depending on how tightly you're able to scope it maybe it won't be company-ending.

If you are/were using Cloudflare to cache PHI though their CDN without a BAA, you were likely in breach before this. Some have suggested that Cloudflare might not be a business associate because of an exception to the definition of business associate known as the "conduit" exception. Cloudflare is almost certainly not a conduit. HHS's recent guidance on cloud computing takes a very narrow view[0]: "The conduit except…

Agree completely with you on this, and based on my experience with OCR, I'd say they would as well. The analogy for a "mere conduit" is the postal service. And that analogy falls apart as soon as you realize that CloudFlare, when being used as an SSL termination point, is opening and repackaging each "letter" on the way to the destination.

I do hate for CloudFlare to be the example for companies playing fast and loose with the rules, but I am hoping we'll have an opportunity in this to clarify the conduit definition a bit more.

Would like to mention that I don't think this declaration applies to every scenario. CloudFlare isn't just one service. I don't see an immediate issue using CloudFlare for DNS on a healthcare app. Neither do I see an issue using CloudFlare as the CDN for static assets. Both of these cases should be evaluated in a risk analysis, but they don't necessitate the level of shared responsibility a BAA entails.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#947

Post by mrich »

phaed wrote: post #921
taviso wrote: post #879

Earlier quoted context omitted.

Matthew, with all due respect, you don't know what you're talking about. view-source: http://cc.bingj.com/cache.aspx?q=&d=4857656909960944&w=rj9cg... view-source: http://cc.bingj.com/cache.aspx?q=&d=4901023173710126&w=n3mEZ... view-source: http://cc.bingj.com/cache.aspx?q=&d=4558611265887320&w=urwoW... view-source: http://cc.bingj.com/cache.aspx?q=&d=4592983872701813&w=Ghwdd... view-source: http://cc.bingj.com/cache.…

Thousands of years from now, when biological life on this planet is all but extinct and superintelligent AI evolving at incomprehensible rates roam the planet, new pieces of the great PII pollution incident that CloudFlare vomited across the internet are still going to be discovered on a daily basis.

I was expecting this:

Thousands of years from now, when biological life on this planet is all but extinct and superintelligent AI evolving at incomprehensible rates roam the planet, taviso will still be finding 0-days impacting billions of machines on an hourly basis.

Be glad that Google is employing him and not some random intelligence agency.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#948

Post by Dylan16807 »

sneak wrote: post #870
jedberg wrote: post #599

Earlier quoted context omitted.

To be fair, you were kind of a fool if you actually let Uber have your location at all times. As soon as they announced that I blocked Uber from my location. I only allow it when I take an Uber (which is almost never now).

Sometimes I'm in a rush and forget to turn it back to Never. That doesn't make me a fool, it makes me human. Don't be a jerk. It's a dark pattern for a reason.

If you only sometimes forget, then that's not letting them have your location at all times, and you weren't called a fool.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#949

Post by FiwHacker »

taviso wrote: post #879
eastdakota wrote: post #624

Earlier quoted context omitted.

Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team. I agree it's troubling that Google is taking so long. We were working with…

Matthew, with all due respect, you don't know what you're talking about. view-source: http://cc.bingj.com/cache.aspx?q=&d=4857656909960944&w=rj9cg... view-source: http://cc.bingj.com/cache.aspx?q=&d=4901023173710126&w=n3mEZ... view-source: http://cc.bingj.com/cache.aspx?q=&d=4558611265887320&w=urwoW... view-source: http://cc.bingj.com/cache.aspx?q=&d=4592983872701813&w=Ghwdd... view-source: http://cc.bingj.com/cache.…

Hacker

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#950

Post by FiwHacker »

taviso wrote: post #879
eastdakota wrote: post #624

Earlier quoted context omitted.

Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team. I agree it's troubling that Google is taking so long. We were working with…

Matthew, with all due respect, you don't know what you're talking about. view-source: http://cc.bingj.com/cache.aspx?q=&d=4857656909960944&w=rj9cg... view-source: http://cc.bingj.com/cache.aspx?q=&d=4901023173710126&w=n3mEZ... view-source: http://cc.bingj.com/cache.aspx?q=&d=4558611265887320&w=urwoW... view-source: http://cc.bingj.com/cache.aspx?q=&d=4592983872701813&w=Ghwdd... view-source: http://cc.bingj.com/cache.…

Hacker
Post reply on HN