Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

801–810 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#801

Post by IceyEC »

lexicality wrote: post #720
camus2 wrote: post #472

Earlier quoted context omitted.

Ouch, you really see everything : > authorization: OAuth oauth_consumer_key ... what a shit show. I'm sorry but at that point there must be consequences for incompetence. Some might argue "But nobody can't do anything" ... I'm sorry, CF has the money to to ditch C entirely and rewrite everything from the ground up with a safer language, I don't care what it is, Go,Rust whatever. At that point people using C directly…

This actually happened because they started to rewrite it all, according to their blog post.

Started to re-write it...in C

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#802

Post by dewey »

cm2187 wrote: post #629
Udo wrote: post #572

Earlier quoted context omitted.

I'm running a side-project on Cloudflare and it's accessible through Tor without problems. I suspect this comes down to the settings a site owner sets up in their Cloudflare interface. It would stand to reason if for example you applied the highest security setting across the board, Tor and VPN users would get presented with a captcha.

I have been presented with a captcha by cloudflare many times without using tor or a VPN. It is the best way to divert users from your website. My natural reaction is that unless I absolutely need to use this particular website, I move to the next result on google. Websites who use cloudflare are suicidal.

> Websites who use cloudflare are suicidal.

I think you are overestimating the amount of people doing their regular browsing through Tor

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#804

Post by vermontdevil »

I got an email from Cloudflare and here's an excerpt about the # of sites affected by this.

Not sure what to make of it - the low number of domains affected.

====================================

In our review of these third party caches, we discovered data that had been exposed from approximately 150 of Cloudflare's customers across our Free, Pro, Business, and Enterprise plans. We have reached out to these customers directly to provide them with a copy of the data that was exposed, help them understand its impact, and help them mitigate that impact.

Fortunately, your domain is not one of the domains where we have discovered exposed data in any third party caches. The bug has been patched so it is no longer leaking data. However, we continue to work with these caches to review their records and help them purge any exposed data we find. If we discover any data leaked about your domains during this search, we will reach out to you directly and provide you full details of what we have found.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#805

Post by earthboundkid »

ppoint wrote: post #550
cjbprime wrote: post #416

Earlier quoted context omitted.

Yes, I think the question was something like "why doesn't malloc call calloc?".

Always nice to have options. Not zeroing memory on allocation might save a few cpu cycles.

It's pretty much the definition of false economy. Would you rather save a few cycles or suffer debilitating security bugs at random intervals? Always use calloc unless a) there's a proven performance problem and b) you know for a fact that due to careful inspection/static analysis/black magic malloc is safe. Then use calloc anyway because why risk it?

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#806

Post by lclarkmichalek »

aioprisan wrote: post #512
Trundle wrote: post #470

Earlier quoted context omitted.

Have you asked them for an eta on your shirt?

You know a company isn't serious about security when their top security bounty is a t-shirt. Instagram has a better policy, for God's sake.

Plenty of companies that are serious about security don't do bounties. They're a real pain to administer apparently

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#807

Post by sbuttgereit »

a3_nm wrote: post #702
jkells wrote: post #44

My first thought was relief, thank god I'm not using Cloudflare. Where would you even start to address this? Everything you've been serving is potentially compromised, API keys, sessions, personal information, user passwords, the works. You've got no idea what has been leaked. Should you reset all your user passwords, cycle all or your keys, notify all your customers that there data may have been stolen? My second th…

I won't take the initiative of changing passwords, and I will only be doing it for services that ask me to do it. In my opinion, if my accounts get compromised because the provider uses Cloudflare and leaks my data all over, it's their fault, not mine... It's not my job to guess which services are using Cloudflare, which ones were affected... and further, if my account gets compromised, others presumably will. (PS: O…

If someone runs a red light, broadsides you while you're in the intersection, and leaves you paralyzed... it is their fault both morally and legally... but it still sucks to be you since you bear the consequences regardless of fault.

While this event is orders of magnitude less severe than my example, depending on the service that could be compromised there can be sufficient repercussions that you could not be made whole or avoid on-going inconvenience through the legal system or other acts of the genuinely responsible party.

I absolutely get and sympathize with where you're coming from... but you may want to check a few of your more important accounts none-the-less :-)

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#808

Post by jameshart »

jgrahamc wrote: post #113
tptacek wrote: post #108

Earlier quoted context omitted.

How many different sites? Your team sent a list to Tavis's team. How many entries were on the list?

We identified 3,438 unique domains. I'm not sure if those were all sent to Tavis because we were only sending him things that we wanted purged.

What I find remarkable is that the owners of those sites weren't ever aware of this issue. If customers were receiving random chunks of raw nginx memory embedded in pages on my site, I'd probably have heard about it from someone sooner, surely?

I guess there is a long tail of pages on the internet whose primary purpose is to be crawled by google and serve as search landing pages - but again, if I had a bug in the HTML in one of my SEO pages that caused googlebot to see it as full of nonsense, I'd see that in my analytics because a page full of uninitialized nginx memory is not going to be an effective pagerank booster.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#809

Post by cm2187 »

dewey wrote: post #802
cm2187 wrote: post #629

Earlier quoted context omitted.

I have been presented with a captcha by cloudflare many times without using tor or a VPN. It is the best way to divert users from your website. My natural reaction is that unless I absolutely need to use this particular website, I move to the next result on google. Websites who use cloudflare are suicidal.

> Websites who use cloudflare are suicidal. I think you are overestimating the amount of people doing their regular browsing through Tor

Again, I wasn't using Tor or a VPN

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#810

Post by sleepychu »

a3n wrote: post #762

Password managers are mentioned. I looked on the lastpass blog (s/www/blog/), nothing about this. Is it just too early?

Lastpass does the crypto on the client side, your encrypted password database could have been leaked but if your master password is sufficiently strong then it will be hard to break.

That said if you reset all your current lastpass passwords with newly generated ones after changing your master password you'll protect yourself from any attack.

Post reply on HN