How Cloudflare responded to the “Copy Fail” Linux vulnerability
blog.cloudflare.com
How Cloudflare responded to the “Copy Fail” Linux vulnerability
1–10 of 86 posts
Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability
#2[deleted]
Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability
#3Would love to learn more about their internal behavioural detection program.
> One of the first things our security team did was confirm that our existing endpoint detection would catch this exploit. Our servers run behavioral detection that continuously monitors process execution patterns. It doesn't rely on knowing about specific vulnerabilities; it watches for anomalous behavior across the fleet.
Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability
#4Would love to learn more about their internal behavioural detection program. > One of the first things our security team did was confirm that our existing endpoint detection would catch this exploit. Our servers run behavioral detection that continuously monitors process execution patterns. It doesn't rely on knowing about specific vulnerabilities; it watches for anomalous behavior across the fleet.
Would certainly be interesting to learn more about. A simple check: allowlist of known "processes that run as root". Any new process shows up, something happened.
Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability
#5this is a techincal dive into how cloudflare responded, not a confirmation that they responded
for whatever reason, unknown to me, hn automatically strips "how" from the start of titles. i cant remember ever seeing a title where this was an improvement.
Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability
#6Would love to learn more about their internal behavioural detection program. > One of the first things our security team did was confirm that our existing endpoint detection would catch this exploit. Our servers run behavioral detection that continuously monitors process execution patterns. It doesn't rely on knowing about specific vulnerabilities; it watches for anomalous behavior across the fleet.
Would certainly be interesting to learn more about. A simple check: allowlist of known "processes that run as root". Any new process shows up, something happened.
Based on what? Proc title?
Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability
#7this is a techincal dive into how cloudflare responded, not a confirmation that they responded for whatever reason, unknown to me, hn automatically strips "how" from the start of titles. i cant remember ever seeing a title where this was an improvement.
Starting a title with “How” is standard clickbait.
Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability
#8Earlier quoted context omitted.
Would certainly be interesting to learn more about. A simple check: allowlist of known "processes that run as root". Any new process shows up, something happened.
Based on what? Proc title?
Proc title is very easily forged (without root even). Obviously a real privileged process could modify the kernel and do whatever it wants, but if I were trying to detect this I would start with /proc/$id/exe.
Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability
#9Earlier quoted context omitted.
Would certainly be interesting to learn more about. A simple check: allowlist of known "processes that run as root". Any new process shows up, something happened.
Based on what? Proc title?
It's curious they're just "monitoring" rather than preventing.
In a serious environment you'd run IPE with dm-verity/fs-verity to ensure binaries are whitelisted and integrity-checked at every execution.
Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability
#10this is a techincal dive into how cloudflare responded, not a confirmation that they responded for whatever reason, unknown to me, hn automatically strips "how" from the start of titles. i cant remember ever seeing a title where this was an improvement.
Starting a title with “How” is standard clickbait.
If we are taking that attitude why not go all the way?
Titles are standard clickbait.