Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Cloudflare responded to the “Copy Fail” Linux vulnerability

blog.cloudflare.com

Post reply on HN
Print view View original

51–60 of 86 posts

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#51

Post by jeffbee »

parliament32 wrote: post #50
staticassertion wrote: post #25

Earlier quoted context omitted.

lol no one does that (edit: or, rather, that is extremely uncommon, even in "serious" environments, for a ton of reasons).

Look at the FedRAMP requirements around integrity protection, then look at how massive the list of complaint products is. I promise, pretty much everyone in regulated environments is. It's so prevelant Azure is even pushing a turnkey solution for k8s https://learn.microsoft.com/en-us/azure/aks/use-azure-linux-...

If you have much experience with fedramp, and it sounds like you do, perhaps you might agree that it is a huge list of things that superficially indicate doing something, without actually doing anything. As the documentation for IPE freely admits, it has no protective benefits because it is unaware of anonymous executable regions.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#52

Post by parliament32 »

jeffbee wrote: post #51
parliament32 wrote: post #50

Earlier quoted context omitted.

Look at the FedRAMP requirements around integrity protection, then look at how massive the list of complaint products is. I promise, pretty much everyone in regulated environments is. It's so prevelant Azure is even pushing a turnkey solution for k8s https://learn.microsoft.com/en-us/azure/aks/use-azure-linux-...

If you have much experience with fedramp, and it sounds like you do, perhaps you might agree that it is a huge list of things that superficially indicate doing something, without actually doing anything. As the documentation for IPE freely admits, it has no protective benefits because it is unaware of anonymous executable regions.

It sure has limitations, but "no protective benefits" is pretty wrong. In a real world example, if your containerized application has an RCE, you're preventing the attacker from executing binaries they tampered with or down/up-loaded. Combined with minimal distroless containers, it's a very effective attack surface reduction strategy, and works much better than the legacy scan-occasionally integrity-checking methods (rkhunter et al).

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#53

Post by QuantumNoodle »

dboreham wrote: post #12

The "Hunting for Exploitation" section is unclear to me: "The exploit leaves a distinctive trace in kernel logs when it runs." Hmm. Wouldn't a system with a compromised kernel also log exactly what the attacker wanted logged?

Also 48 hours prior the disclosure is a very narrow window? I wonder if their logs don't go back further or if there was another reason to look back only two days.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#55

Post by dang »

john_strinlai wrote: post #5

this is a techincal dive into how cloudflare responded, not a confirmation that they responded for whatever reason, unknown to me, hn automatically strips "how" from the start of titles. i cant remember ever seeing a title where this was an improvement.

Of course you can't, because the cases it improves don't get noticed, while the ones that break stick out like sore thumbs.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#56

Post by staticassertion »

parliament32 wrote: post #50
staticassertion wrote: post #25

Earlier quoted context omitted.

lol no one does that (edit: or, rather, that is extremely uncommon, even in "serious" environments, for a ton of reasons).

Look at the FedRAMP requirements around integrity protection, then look at how massive the list of complaint products is. I promise, pretty much everyone in regulated environments is. It's so prevelant Azure is even pushing a turnkey solution for k8s https://learn.microsoft.com/en-us/azure/aks/use-azure-linux-...

Nothing about fedramp requires that you enable any of the features you're talking about. Linking to a public preview of an Azure product that doesn't even run with enforcement on is not great supporting evidence.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#57

Post by mixdup »

computerfriend wrote: post #44
mkj wrote: post #38

If they're already running a custom Linux kernel build, why did they have AF_ALG enabled? Seems the perfect situation to limit features to only those actually being used.

In the article they explain that some of their services use it.

And also as part of this, they have learned the lesson parent comment is trying to make: they called out that they are going to review their deployments and make sure there's no unused modules being deployed

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#58

Post by em-bee »

tempest_ wrote: post #47
jmclnx wrote: post #23

> Linux kernel build based on the community's Long-Term Support (LTS) CopyFail only highlights why Companies want LTS. If there was a supported kernel built prior to 2017, most large companies would still be on that version, avoiding this issue all-together. The corporate mindset is usually "never upgrade unless there is new hardware needed or critical software failure". All CopyFail did was reinforce that mindset. I…

The longer you wait the more painful the switch will eventually be.

for the kernel? hardly. only if the kernel breaks userspace. which it shouldn't.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#59

Post by tptacek »

This is an interesting post from Cloudflare, as usual, but it's not clear to me why they would have been vulnerable to CopyFail. Did I miss the point in this blog where that's addressed? What triggered the threat hunting and mitigation exploit? At what points in their architecture were they reliant on Linux user-based access control?

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#60

Post by robotbikes »

tptacek wrote: post #59

This is an interesting post from Cloudflare, as usual, but it's not clear to me why they would have been vulnerable to CopyFail. Did I miss the point in this blog where that's addressed? What triggered the threat hunting and mitigation exploit? At what points in their architecture were they reliant on Linux user-based access control?

I would assume it was about protecting their servers from internal sources escalating privileges vs. them providing publicly accessible Linux shells.
Post reply on HN