Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

bugs.chromium.org

Post reply on HN
Print view View original

91–100 of 1001 posts

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#91

Post by _wmd »

tptacek wrote: post #79
tptacek wrote: post #4

Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…

In case you're wondering how this could be worse than Heartbleed: Yes, apparently the allocation patterns inside Cloudflare mean TLS keys aren't exposed to this vulnerability. But Heartbleed happened at the TLS layer. To get secrets from Heartbleed, you had to make a particular TLS request that nobody normally makes. Cloudbleed is a bug in Cloudflare's HTML parser, and the secrets it discloses are mixed in with, appa…

It shouldn't be too difficult to feed an instrumented copy of the parser some fraction of their cached pages (after all, that's what they're for.. right?) and calculate a percentage of how many triggered e.g. valgrind, or just some magic string tacked on the end of the input appearing in the output or similar

I prefer CloudScare to Cloudbleed :)

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#92

Post by [deleted] »

[deleted] wrote: post #89
masterleep wrote: post #60

Earlier quoted context omitted.

Is that because, even though a very small number of pages (they claim) triggered the bug, any adjacent traffic in memory could be disclosed? That traffic could be basically anything sent through Cloudflare, it would seem.

[deleted]

[deleted]

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#93

Post by manigandham »

bubblethink wrote: post #83
joepie91_ wrote: post #52

Earlier quoted context omitted.

> My second thought after relief was the realization that even as a consumer I'm affected by this, my password manager has > 100 entries what percentage of them are using CloudFlare? Should I change all my passwords? Yes. Right now. Don't wait for the vendor to notify you. > What an epic mess. This is the problem with centralization, the system is broken. Yep.

How do you check if a website uses cloudflare ? Any scripts that do that ?

Response headers will contain a "cf-ray" header or "server: cloudflare-nginx"

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#94

Post by carterehsmith »

tptacek wrote: post #4

Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…

What a mess.

On the plus side, all those booter services hiding behind the Cloudflare are probably being probed and classified/identified/disabled by competitors and probably FBI. That is good.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#95

Post by zzzcpan »

_wmd wrote: post #11

Step 1) MITM the entire Internet, undermining its SSL infrastructure, build a business around it Step 2) leak cleartext from said MITM'd connections to the entire Internet I recently noted that in some ways Cloudflare are probably the only entity to have ever managed to cause more damage to popular cryptography since the 2008 Debian OpenSSL bug (thanks to their "flexible" ""SSL"" """feature"""), but now I'm certain o…

"This bug would have been caught with valgrind, and by the sounds of it, using nothing more complex than feeding their httpd a random sampling of live inputs for an hour or two"

Or prevented using abstraction that do bounds checking. Or even just used ragel with a memory safe language and prevented all issues like that from ever happening. Probably would have been less work even with the reimplementation of an http proxy from scratch.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#96

Post by sparkling »

bubblethink wrote: post #83
joepie91_ wrote: post #52

Earlier quoted context omitted.

> My second thought after relief was the realization that even as a consumer I'm affected by this, my password manager has > 100 entries what percentage of them are using CloudFlare? Should I change all my passwords? Yes. Right now. Don't wait for the vendor to notify you. > What an epic mess. This is the problem with centralization, the system is broken. Yep.

How do you check if a website uses cloudflare ? Any scripts that do that ?

$ dig example.com

to get the A Record, then

$ whois 1.2.3.4|grep Cloudflare

Not 100% reliable, but should do the Job.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#97

Post by manigandham »

eli wrote: post #58
summarity wrote: post #40

Earlier quoted context omitted.

Not only that, but the "reward" in the program is laughable and frankly insulting to any serious researcher considering the scope of CF. Bug bounty platforms are already becoming the fiverr of ITSEC (that's not a good thing), CF just made an extra effort do diminish the value for researchers. Management: "Why do we offer $5k for a small bug again? Look at CF, they don't offer any money!"

If serious researchers are looking to get paid, I think bug bounties are the wrong approach entirely

Why? Many can help find problems without having to be full-time, that's the point of crowd-sourcing with payouts.

Re: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory

#98

Post by jgrahamc »

tptacek wrote: post #79
tptacek wrote: post #4

Oh, my god. Read the whole event log. If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results. The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep e…

In case you're wondering how this could be worse than Heartbleed: Yes, apparently the allocation patterns inside Cloudflare mean TLS keys aren't exposed to this vulnerability. But Heartbleed happened at the TLS layer. To get secrets from Heartbleed, you had to make a particular TLS request that nobody normally makes. Cloudbleed is a bug in Cloudflare's HTML parser, and the secrets it discloses are mixed in with, appa…

You really want to see Cloudflare spend more time discussing how they've quantified the leak here.

What would you like to see? The SAFE_CHAR logging allowed us to get data on the rate which is how I got the % of requests figure.

Post reply on HN