Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

581–590 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#581

Post by gukov »

mattbee wrote: post #219
user5994461 wrote: post #149

> The greatest period of impact was from February 13 and February 18 with around 1 in every 3,300,000 HTTP requests through Cloudflare potentially resulting in memory leakage (that’s about 0.00003% of requests). 1) From the metrics I recalled when I interviewed there, and assuming the given probability is correct, that means a potential of 100k-200k paged with private data leaked every day. 2) What's the probably tha…

This assumes that the Bad Guys hadn't noticed the bug before Tavis, and hadn't started intensively mining Cloudflare for data.

I hope something like intense mining would've caused a detectable spike in turn alerting CF sooner. Looks like it didn't...

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#583

Post by patio11 »

spydum wrote: post #539
patio11 wrote: post #455

Earlier quoted context omitted.

If anyone here is HIPAA-regulated or you have a customer who is, and you used Cloudflare during those dates, it is Big Red Button time. You've almost certainly got a reportable breach; depending on how tightly you're able to scope it maybe it won't be company-ending.

Isn't it worse than that? Even if you are not a CF user, if your apps make calls to a third party site protected by CF, you could be at risk (stolen credentials, API keys), and could be attacked using those now.

That's also a bad thing, but you can roll creds and check if anyone has exfiltrated data from your various accounts. You can't roll patient identities. There doesn't appear to be any way to figure out which of your HTTPS pages served in last 6 months are presently publicly exposed.

I feel for folks who lost API keys -- really -- but everyone regulated should be in full-on disaster recovery mode right now.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#584

Post by askvictor »

tptacek wrote: post #4

Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…

> This is approximately as bad as it ever gets.

*as bad as it has ever gotten so far.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#585

Post by ers35 »

ndesaulniers wrote: post #566
ers35 wrote: post #414

Earlier quoted context omitted.

I used Censys to search for the IPv4 addresses of servers serving matching TLS certificates: https://censys.io/ipv4?q=443.https.tls.certificate.parsed.na...

Couldn't someone DDoS'ing a site use this to get around Cloudflare "protection?" Uh, asking for a friend.

Yes. One can identify the IP address of the origin server behind a reverse proxy if the server responds to direct requests in a way that identifies itself. See: https://cloudpiercer.org/

Two steps towards obscuring the origin server include requiring that the HTTP Host header is set and only responding to Cloudflare IP ranges: https://www.cloudflare.com/ips/

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#586

Post by joshkpeterson »

tr44564 wrote: post #245
AznHisoka wrote: post #111

Earlier quoted context omitted.

Can someone tell me the implications of this in laymen terms? For instance what does it mean "sprayed into caches"? what cache? dns cache? browser cache? if the latter, does it mean you are safe if the person who owns that cache is an innocent non technical iser?

As for the SHA-1 collision mentioned by jgrahamc[1] earlier today: How am I going to explain this to my wife? Actually a serious question. How do we communicate something like this to the general public? [1] https://news.ycombinator.com/item?id=13713826

Well. Does your wife work in info sec?

Let's do our part to make this place less toxic to women please

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#587

Post by steven_pack »

If only there were a systems programming language, offering c-like performance with memory guarantees and well suited to high throughput network servers that would catch this class of bugs at compile-time [1] [2]

[1] https://www.rust-lang.org/en-US/ [2] Self declared rust fanboy

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#588

Post by gambler »

hoorayimhelping wrote: post #85
_wmd wrote: post #11

Step 1) MITM the entire Internet, undermining its SSL infrastructure, build a business around it Step 2) leak cleartext from said MITM'd connections to the entire Internet I recently noted that in some ways Cloudflare are probably the only entity to have ever managed to cause more damage to popular cryptography since the 2008 Debian OpenSSL bug (thanks to their "flexible" ""SSL"" """feature"""), but now I'm certain o…

> edit: why the revulsion I'd guess it's because of the crude and reductive way you describe the service cloudflare provides. I don't know what type of programming you do, but many small services don't have the infrastructure to mitigate the kind of attacks cloudflare deals with and they wouldn't be around without services like this. I don't like the internet becoming centralized into a few small places that mitigate…

>I'm not ready to throw out the baby with the bathwater because of one issue.

Extreme centralization of the Internet is not a "baby", except maybe in the sense of a cuckoo's egg.

But I'm willing to bet the mentality of this comment is highly representative of many web developers and service providers. They will not seek to fix anything, because they don't see this state of things as a problem in the first place.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#589

Post by ComputerGuru »

Some day, the world will wake up to the fact that we've taken the beauty of a decentralized internet and willingly traded it in for a single-point-of-failure design.

I will refrain from any criticism of Cloudflare and what I think about this because they're going through hell as it is. But everyone else is fair game. The higher a level of service you centralize, the more you stand to lose.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#590

Post by ComputerGuru »

pepve wrote: post #318
wilde wrote: post #247

Earlier quoted context omitted.

Are you guys planning to release the list so we can all change our passwords on affected services? Or are you planning on letting those services handle the communication?

That list contains domains where the bug was triggered. The information exposed through the bug though can be from any domain that uses Cloudflare. So: all services that have one or more domains served through Cloudflare may be affected. The consensus seem to be that no one discovered this before now, and no bad guys have been scraping this leak for valuable data (passwords, OAuth tokens, PII, other secrets). But the…

> The consensus seem to be that no one discovered this before now, and no bad guys have been scraping this leak for valuable data (passwords, OAuth tokens, PII, other secrets).

This is literally as bad as it gets, anyone trying to palliate the solution has something to sell you. You'd have to be an idiot to think that $organization (public, private, or shadow) doesn't have automated systems to check for something as stupid simple as this by querying resources at random intervals and searching for artifacts.

Someone found it. Probably more than one someone. Denial won't help.

Post reply on HN