Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

List of Sites Affected by Cloudflare's HTTPS Traffic Leak

github.com

Post reply on HN
Print view View original

91–100 of 228 posts

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#91

Post by rwilsonperkin »

pyre wrote: post #71
koolba wrote: post #60

That's a wide impact. While any hijacked account is bad, some of these are really bad. For example, https://coinbase.com is on that list! If they haven't immediately invalidated every single HTTP session after hearing this news this is going to be bad. Ditto for forcing password resets. A hijacked account that can irrevocably send digital currency to an anonymous bad guy's account would be target number one for using…

I also noticed the domain waveapps.com, which is for Wave Accounting.

We're investigating

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#92

Post by arikrak »

It would be more useful if there was a way to see sites that actually were using the Cloudflare features that caused this bug. A large number of sites use Cloudflare, but few should have been affected by this bug:

> When the parser was used in combination with three Cloudflare features—e-mail obfuscation, server-side excludes, and Automatic HTTPS Rewrites—it caused Cloudflare edge servers to leak pseudo random memory contents into certain HTTP responses. https://arstechnica.com/security/2017/02/serious-cloudflare-...

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#93

Post by cknight »

arikrak wrote: post #92

It would be more useful if there was a way to see sites that actually were using the Cloudflare features that caused this bug. A large number of sites use Cloudflare, but few should have been affected by this bug: > When the parser was used in combination with three Cloudflare features—e-mail obfuscation, server-side excludes, and Automatic HTTPS Rewrites—it caused Cloudflare edge servers to leak pseudo random memory…

As has been mentioned elsewhere on HN, those 3 features were capable of triggering the bug. Once triggered, potentially any Cloudflare-enabled site could have been affected.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#94

Post by toyg »

arikrak wrote: post #92

It would be more useful if there was a way to see sites that actually were using the Cloudflare features that caused this bug. A large number of sites use Cloudflare, but few should have been affected by this bug: > When the parser was used in combination with three Cloudflare features—e-mail obfuscation, server-side excludes, and Automatic HTTPS Rewrites—it caused Cloudflare edge servers to leak pseudo random memory…

You only needed one service triggering the involved module in the CF proxy, and all traffic going through it would be affected, regardless of which feature each account had enabled. This over three months.

I think even CF struggled to find all affected sites - which is proven by the amount of stuff still in google cache, after 7 days of purging. Unless they keep three months of logs listing all sites that used each and every proxy, you cannot be 100% certain of which traffic was affected.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#95

Post by rmaurin »

pyre wrote: post #71
koolba wrote: post #60

That's a wide impact. While any hijacked account is bad, some of these are really bad. For example, https://coinbase.com is on that list! If they haven't immediately invalidated every single HTTP session after hearing this news this is going to be bad. Ditto for forcing password resets. A hijacked account that can irrevocably send digital currency to an anonymous bad guy's account would be target number one for using…

I also noticed the domain waveapps.com, which is for Wave Accounting.

Cloudfare has advised that Wave data has not been affected/leaked. We've got engineering and security teams investigating, and we'll keep on it until we're ultra confident in the conclusion. Nonetheless, good practice for everyone to rotate all passwords today, for any services. Good security hygiene any time, and especially now.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#96

Post by pc86 »

luckystartup wrote: post #86

Oh crap. I've entered my banking password into Transferwise quite a few times. Welp, time to change all my passwords.

> Welp, time to stop using the same password for multiple services.

> Welp, time to start using a password manager.

FTFY

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#97

Post by r1ch »

Just got this classy spam from dyn.com. Wonder if they're going through this list emailing every domain contact.

> As you may be aware, Cloudflare incurred a security breach where user data from 3,400 websites was leaked and cached by search engines as a result of a bug. Sites affected included major ones like Uber, Fitbit, and OKCupid.

> Cloudflare has admitted that the breach occurred, but Ormandy and other security researchers believe the company is underplaying the severity of the incident …

> This incident sheds light and underlines the vulnerability of Cloudflare's network. Right now you could be at continued risk for security and network problems. Here at Dyn, we would like to extend a helpful hand in the event that your network infrastructure has been impacted by today's security breach or if the latest news has you rethinking your relationship with Cloudflare.

> Let me know if you would be interested in having a conversation about Dyn's DNS & Internet performance solutions.

> I look forward to hearing back from you.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#98

Post by almost_usual »

leni536 wrote: post #74
almost_usual wrote: post #34

Earlier quoted context omitted.

If you setup TOTP (Authenticator) while this bug was out in the wild your shared secret key could have leaked. SMS would actually be safer than TOTP in this scenario.

That's insightful. So you shouldn't only reset your passwords, but your TOTP setup too (if you set it up in this period). I think it's a flaw of TOTP though. The client secret should be client generated and should never leave the device.

Yes, unfortunately both the client and server need to have that shared private key to generate the same codes.

Transmitting the key over a 'secondary' channel would have protected people here.

It begs the question of whether or not TOTP is really 2FA if it is setup using a single channel of communication.

Re: List of Sites Affected by Cloudflare's HTTPS Traffic Leak

#99

Post by poorman »

actuator wrote: post #7

I wrote this(1) script to check for any affected sites from local Chrome history. It checks for the header `cf-ray` in the response headers from the domain. It is not an exhaustive list but I was able to find few important ones like my bank site. 1: https://gist.github.com/kamaljoshi/2cce5f6d35cd28de8f6dbb27d...

I wish 1Password had a feature where you could put in a list of domains like this or a "Auto Change Possibly Compromised Passwords" feature.
Post reply on HN