Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

951–960 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#951

Post by hbbio »

eastdakota wrote: post #624
sikhnerd wrote: post #291

Earlier quoted context omitted.

jgrahamc: can you list which public caches you worked with to attempt to address this? It does not inspire confidence when even google is still showing obvious results

Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team. I agree it's troubling that Google is taking so long. We were working with…

Next time, beware of parsers. Or formally verify them :)

https://arxiv.org/pdf/1105.2576.pdf

(disclaimer: co-author)

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#952

Post by janwillemb »

taviso wrote: post #879
eastdakota wrote: post #624

Earlier quoted context omitted.

Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team. I agree it's troubling that Google is taking so long. We were working with…

Matthew, with all due respect, you don't know what you're talking about. view-source: http://cc.bingj.com/cache.aspx?q=&d=4857656909960944&w=rj9cg... view-source: http://cc.bingj.com/cache.aspx?q=&d=4901023173710126&w=n3mEZ... view-source: http://cc.bingj.com/cache.aspx?q=&d=4558611265887320&w=urwoW... view-source: http://cc.bingj.com/cache.aspx?q=&d=4592983872701813&w=Ghwdd... view-source: http://cc.bingj.com/cache.…

Offtopic: "with all due respect" is often followed by words void of respect.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#953

Post by Lazare »

eastdakota wrote: post #624
sikhnerd wrote: post #291

Earlier quoted context omitted.

jgrahamc: can you list which public caches you worked with to attempt to address this? It does not inspire confidence when even google is still showing obvious results

Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team. I agree it's troubling that Google is taking so long. We were working with…

This comment greatly lowers my respect for Cloudflare.

Bugs happen to us all; how you deal with this is what counts, and wilful, blatant lying in a transparent attempt to deflect blame from where it belongs (Cloudflare) onto the team that saved your bacon?

I've recommended Cloudflare in the past, and I was planning, with some reservations, to continue to do so even after disclosure of this issue. But seeing this comment? I don't see how I can continue.

(For the sake of maximum clarity: I take issue: 1) with the attempt at suggesting the main issue is in clearing caches, not on the leak itself. It doesn't matter how fast you close the barn door after the horse is gone and the barn has burned down. 2) With the blatantly false claim that non-Google caches have been cleared, or were faster to clear than Google's. Cloudflare should know, better than anyone, the massive scope of this leak, and the fact that NO search engine's cache has or could be cleared of this leak. If you find yourself in a situation so bad you feel like you need to misdirect attention to someone else, and it turns out no one else is actually doing anything so you have to like about that...maybe you should just shut up and stop digging?)

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#955

Post by Dylan16807 »

kyledrake wrote: post #793
Blahah wrote: post #697

Earlier quoted context omitted.

It's not the responsibility of anyone except the police to police those sites. Cloudflare aren't providing those attack sites with an attack vector, they are just serving their webpages. The post office isn't responsible for policing blackmail letters sent through the mail.

The theory that Cloudflare only enforces against sites they receive court orders for is yet another argument that is not backed by evidence. They actively take down phishing attacks, without warrants or court orders. Presumably because if they didn't, Google would shitlist them in pagerank. They behave responsibly and morally when it benefits them financially, and tell everyone they need court orders when it doesn't,…

The morality of hosting the sites of jerks is not nearly as objective as you claim. I could make an argument that they behave morally by treating everyone equally, but they make an exception and perform immorally with phishing sites because google would punish them.

But the real answer is a lot simpler. The DDoS sites are not doing the DDoS through cloudflare. The phishing sites are doing the phishing through cloudflare.

And exposing some DDoS sites to DDoS is not going to fix the root problem. People will still sell DDoS services, and people will still put insecure devices online to become part of botnets.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#956

Post by Bino »

taviso wrote: post #879
eastdakota wrote: post #624

Earlier quoted context omitted.

Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team. I agree it's troubling that Google is taking so long. We were working with…

Matthew, with all due respect, you don't know what you're talking about. view-source: http://cc.bingj.com/cache.aspx?q=&d=4857656909960944&w=rj9cg... view-source: http://cc.bingj.com/cache.aspx?q=&d=4901023173710126&w=n3mEZ... view-source: http://cc.bingj.com/cache.aspx?q=&d=4558611265887320&w=urwoW... view-source: http://cc.bingj.com/cache.aspx?q=&d=4592983872701813&w=Ghwdd... view-source: http://cc.bingj.com/cache.…

You really have to see this to really grasp the severity of the bug.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#957

Post by LeoPanthera »

janwillemb wrote: post #952
taviso wrote: post #879

Earlier quoted context omitted.

Matthew, with all due respect, you don't know what you're talking about. view-source: http://cc.bingj.com/cache.aspx?q=&d=4857656909960944&w=rj9cg... view-source: http://cc.bingj.com/cache.aspx?q=&d=4901023173710126&w=n3mEZ... view-source: http://cc.bingj.com/cache.aspx?q=&d=4558611265887320&w=urwoW... view-source: http://cc.bingj.com/cache.aspx?q=&d=4592983872701813&w=Ghwdd... view-source: http://cc.bingj.com/cache.…

Offtopic: "with all due respect" is often followed by words void of respect.

This is perfectly fine if the amount of respect due is sufficiently low.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#958

Post by i336_ »

taviso wrote: post #289
danielweber wrote: post #284

Earlier quoted context omitted.

Good. They're trying to clean up all the private data leaked everywhere. I tempted to say "why couldn't they figure out this google dork themselves" but they've probably been slammed for the past 7 days cleaning up a bunch of stuff anyway.

You have no idea.

Not sure if you'll see this, but I've noticed that the cache links have been removed on literally all hits for these queries.

And yet, I occasionally see working cache links on relevant unaffected pages.

Really, really awesome to see this kind of response. It's an obvious course of action (also considering corporate liability that you're publicly holding/offering this data) but it's really cool to see everyone work to fix this en masse so quickly.

I think a lot of people would enjoy hearing campfire battle stories of the past ~week once this is all over.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#959

Post by i336_ »

SwellJoe wrote: post #868
bsamuels wrote: post #849

Earlier quoted context omitted.

I'll gladly offer some anecdotal evidence: We've got about 2500 tickets in our ticketing queue that have been filed over the past 8 months (excluding spam). Out of those 2500 tickets, only five are valid issues, and only one came with an actual write up. The signal to noise ratio is absolutely awful - and it's not uncommon for people with invalid issues to demand that you pay them regardless.

Wow, that's much worse than I would have guessed. I would have assumed 10:1, tops. We get security reports, and sometimes they ask for a bounty, and only a very small number are bogus (but we don't have a formal bounty program). Less than half of our security issue reports are totally bogus, and another quarter are theoretical issues, but result in some sort of clean up in the code (e.g. no one can figure out how it…

It sounds like your system might be a candidate for https://wiki.mozilla.org/MOSS/Secure_Open_Source.

There's a form listed under "How to apply", and an email address nearby.

It appears that projects are only documented once audited, FWIW.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#960

Post by kakarot »

mrich wrote: post #947
phaed wrote: post #921

Earlier quoted context omitted.

Thousands of years from now, when biological life on this planet is all but extinct and superintelligent AI evolving at incomprehensible rates roam the planet, new pieces of the great PII pollution incident that CloudFlare vomited across the internet are still going to be discovered on a daily basis.

I was expecting this: Thousands of years from now, when biological life on this planet is all but extinct and superintelligent AI evolving at incomprehensible rates roam the planet, taviso will still be finding 0-days impacting billions of machines on an hourly basis. Be glad that Google is employing him and not some random intelligence agency.

What's funny is he kinda just stumbled upon this bug accidentally while making queries.

If I were just casually googling two weeks ago and came across a leaked cloudflare session in the middle of my search results I think I would have vomited all over my desk immediately. Dude must have been sweating bullets and trembling as he reached out on twitter for a contact, not knowing yet how bad this was or for just how long it's been going on.

Post reply on HN