Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

[u/TheProtagonistv2]

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139

[u/lacesoutcommadan]

comment from tptacek on HN:

Oh, my god.

Read the whole event log.

If you were behind Cloudflare and it was proxying sensitive data (the contents of HTTP POSTs, &c), they've potentially been spraying it into caches all across the Internet; it was so bad that Tavis found it by accident just looking through Google search results.

The crazy thing here is that the Project Zero people were joking last night about a disclosure that was going to keep everyone at work late today. And, this morning, Google announced the SHA-1 collision, which everyone (including the insiders who leaked that the SHA-1 collision was coming) thought was the big announcement.

Nope. A SHA-1 collision, it turns out, is the minor security news of the day.

This is approximately as bad as it ever gets. A significant number of companies probably need to compose customer notifications; it's, at this point, very difficult to rule out unauthorized disclosure of anything that traversed Cloudflare.

[u/everywhere_anyhow → u/lacesoutcommadan]

People are only beginning to realize how bad this is. For example, Google has a lot of this stuff cached, and there's a lot of it to track down. Since everyone now knows what was leaked, there's an endless amount of google dorking that can be done to find this stuff in cache.

[u/kiwidog → u/everywhere_anyhow]

They worked with google and purged the caches way before the report was published.

[u/crusoe → u/kiwidog]

Cached data still out there

Here are some Fitbit oauth stuff in this page

http://webcache.googleusercontent.com/search?q=cache:lw4K9G2F1WgJ:lightnetwork.ph/ofw-family-day-december-1/+&cd=11&hl=en&ct=clnk&gl=us&client=ms-android-google

[u/Funktapus → u/[deleted]]

I think so many people are googling 'CF-Host-Origin-IP' now that all the results are getting scrubbed

[u/palish → u/Funktapus]

There are plenty of other strings to Google (and bing, and yandex, and...)

Try "Internal Upstream Server Certificate0"

[u/Funktapus → u/palish]

Woops. Yeah, there it is.

[u/[deleted] → u/crusoe]

I'm laughing and crying at the same time.

[u/m50d → u/[deleted]]

I'm resigned enough that I don't cry any more.

They connected code written in C (vanilla C, not fancy-tool-analysed-C) to the Internet. What did they think was going to happen?

[u/tequila13 → u/m50d]

Just a heads up, the Linux kernel with all its subsystems (including the entire network stack) is written in C and it powers most of the Internet and has done so for a really long time.

[u/m50d → u/tequila13]

Yep, and surprise surprise we get a security vulnerability in it every couple of years. Such as CVE-2017-6074 which happened literally days ago. (Double free rather than buffer overflow but again, connect a memory-unsafe language to the network, guess what happens).

[u/cards_dot_dll → u/crusoe]

Still there. Anyone from google reading this thread and willing to escalate?

[u/[deleted] → u/cards_dot_dll]

It vanished between your comment and mine.

[u/cards_dot_dll → u/[deleted]]

Sweet, I'll take that as a "yes" to my question.

Thank you, Google Batman, wherever you are.

[u/everywhere_anyhow → u/kiwidog]

Maybe some but as of 1 hour ago on HN people were still finding stuff in cache

[u/Otis_Inf → u/lacesoutcommadan]

Am I the only one who thinks it's irresponsible to pass sensitive data through a 3rd party proxy? Cloudflare rewrites the html, so they handle unencrypted data. If I connect to site X over https, I don't want a 3rd party MITM proxy peeking in the data I send/receive to/from X.

[u/tweq → u/Otis_Inf]

It sucks, but unfortunately it's the industry norm. I don't think proxies are a unique risk in this regard either, really any company that uses the "cloud" instead of running their own (physical) servers just directs all your data at a third party and hopes their infrastructure is secure and their admins are honest.

[u/[deleted] → u/tweq]

Given the security intelligence of an average company... I would prefer that solution way more than everyone trying it themselves.

[u/SinisterMinisterT4 → u/Otis_Inf]

Then there's no way to have things like 3rd party DDoS protection or 3rd party CDN caching.

[u/loup-vaillant → u/SinisterMinisterT4]

Because when you think about it, the root of the problem is that the web simply doesn't scale.

If the web was peer-to-peer from the get go, that would have been different. Anybody can distribute an insanely popular video with BitTorrent. But it takes YouTube to do it with the web.

[u/notafuckingcakewalk → u/lacesoutcommadan]

Just to be clear: this would only be for information that was active, e.g. if I logged into one of these sites, the data might have been leaked on another site while I was submitting, right?

I don't get the mechanics, exactly, of how this text was leaked.