Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Cloudflare responded to the “Copy Fail” Linux vulnerability

blog.cloudflare.com

Post reply on HN
Print view View original

81–86 of 86 posts

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#81

Post by fragmede »

js2 wrote: post #80
fragmede wrote: post #72

Earlier quoted context omitted.

I can upload arbitrary code to Cloudflare workers, which they run on their systems. It's sandboxed, but in the big bad Internet, if you were Cloudflare, how much would you really trust that sandbox?

Let's say an attacker escapes the sandbox and gets a local non-root shell on the machine. At that point, how much more access does escaping to root gain the attacker? (This is a rhetorical question. Cloudflare doesn't say, which I think is the point of this line of questioning.)

Not actually knowing anything about their architecture, but if you somehow gained root on a Cloudflare worker box, the system that I'm sure they've design against this attack for, is for that attacker to then be able to steal the private keys for all the TLS traffic hitting that machine, and then exfiltrate all data going through it and also inject their own content to visitors.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#82

Post by john_strinlai »

dang wrote: post #55
john_strinlai wrote: post #5

this is a techincal dive into how cloudflare responded, not a confirmation that they responded for whatever reason, unknown to me, hn automatically strips "how" from the start of titles. i cant remember ever seeing a title where this was an improvement.

Of course you can't, because the cases it improves don't get noticed, while the ones that break stick out like sore thumbs.

i mean... its pretty easy to tell in either direction because i read the article titles when i click on them. given the rule about matching the article title, any discrepancy is noticeable.

but its your world dang, we're just living in it. do whatever you want with the titles. you have previously made your position clear to me about receiving feedback on hn; im not under any illusions about the value of my opinion.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#83

Post by js2 »

fragmede wrote: post #81
js2 wrote: post #80

Earlier quoted context omitted.

Let's say an attacker escapes the sandbox and gets a local non-root shell on the machine. At that point, how much more access does escaping to root gain the attacker? (This is a rhetorical question. Cloudflare doesn't say, which I think is the point of this line of questioning.)

Not actually knowing anything about their architecture, but if you somehow gained root on a Cloudflare worker box, the system that I'm sure they've design against this attack for, is for that attacker to then be able to steal the private keys for all the TLS traffic hitting that machine, and then exfiltrate all data going through it and also inject their own content to visitors.

Why are you sure of that? I wouldn't design a critical system that relied on the difference between root and non-root accounts to protect private keys. I would design a system assuming the attacker can trivially escalate to root privilege. Because historically you just cannot rely on the difference. LPE attacks simply happen on too regular a basis.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#84

Post by dang »

john_strinlai wrote: post #82
dang wrote: post #55

Earlier quoted context omitted.

Of course you can't, because the cases it improves don't get noticed, while the ones that break stick out like sore thumbs.

i mean... its pretty easy to tell in either direction because i read the article titles when i click on them. given the rule about matching the article title, any discrepancy is noticeable. but its your world dang, we're just living in it. do whatever you want with the titles. you have previously made your position clear to me about receiving feedback on hn; im not under any illusions about the value of my opinion.

> but its your world dang, we're just living in it. do whatever you want with the titles. you have previously made your position clear to me about receiving feedback on hn; im not under any illusions about the value of my opinion.

Is that how you felt about https://news.ycombinator.com/item?id=47328465? I can't find any other post that you might be referring to.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#85

Post by john_strinlai »

dang wrote: post #84
john_strinlai wrote: post #82

Earlier quoted context omitted.

i mean... its pretty easy to tell in either direction because i read the article titles when i click on them. given the rule about matching the article title, any discrepancy is noticeable. but its your world dang, we're just living in it. do whatever you want with the titles. you have previously made your position clear to me about receiving feedback on hn; im not under any illusions about the value of my opinion.

> but its your world dang, we're just living in it. do whatever you want with the titles. you have previously made your position clear to me about receiving feedback on hn; im not under any illusions about the value of my opinion. Is that how you felt about https://news.ycombinator.com/item?id=47328465 ? I can't find any other post that you might be referring to.

no, its how i felt from a few different emails i have sent, with one of the more recent ones having what i felt was a pretty off-putting reply. but there is really no need to hash it out. in the grand scheme, i understand the approach you take, despite feeling frustration over it. you've got thousands of people offering their opinions, all of them thinking they are correct. my last comment should have probably been one that i wrote in a notepad and erased afterwards, rather than one that i posted. sorry.

Re: How Cloudflare responded to the “Copy Fail” Linux vulnerability

#86

Post by fragmede »

js2 wrote: post #83
fragmede wrote: post #81

Earlier quoted context omitted.

Not actually knowing anything about their architecture, but if you somehow gained root on a Cloudflare worker box, the system that I'm sure they've design against this attack for, is for that attacker to then be able to steal the private keys for all the TLS traffic hitting that machine, and then exfiltrate all data going through it and also inject their own content to visitors.

Why are you sure of that? I wouldn't design a critical system that relied on the difference between root and non-root accounts to protect private keys. I would design a system assuming the attacker can trivially escalate to root privilege. Because historically you just cannot rely on the difference. LPE attacks simply happen on too regular a basis.

I'm not sure of anything. I agree that priv escalation regularly happens, I was around for cve-2010-4258, before they got all branded and named. GP was asking why Cloudflare should be so afraid that they wrote that post and I'm saying their fear is reasonable.

https://blog.nelhage.com/2010/12/cve-2010-4258-from-dos-to-p...

Post reply on HN