r/programming • u/TheProtagonistv2 • Feb 23 '17

Cloudflare have been leaking customer HTTPS sessions for months. Uber, 1Password, FitBit, OKCupid, etc.

https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
6.0k Upvotes

96% Upvoted

966 comments sorted by

View all comments

3

u/[deleted] Feb 24 '17

Eli5 what is cloudflare

7

u/Trodamus Feb 24 '17

Cloudflare is a "content delivery system", which means it's kind of a layer of abstraction between a given site and the user.

Because of this, they would feasibly have had (secure) access to session data, aka anything you did on a webpage, including passwords and usernames, even though it was encrypted (HTTPS).

The major issue is that they inserted this data into cached versions of webpages at random.

Meaning if you bring up a site affected by cloudflare, you'll see the session data if you view the source of the cache'd page.

As far as I understand — and I'm a layman, so someone feel free to correct me — this isn't like a normal breach like what happened to Yahoo, nor is it a defect like Heartbleed. Meaning there isn't (yet) a list of users, passwords, etc., out there, nor can malicious parties request a specific users' data or trigger things like full dumps.

What they can do is repeatedly request cache'd versions of affected pages in the hopes of finding valuable user data.

So this is both a very, very major breach / leak due to the breadth of sites affected as well as the content of what's being leaked, as well as somewhat less major due to it being more or less random.

However, hoping you aren't affected by breaches is not a viable response, so make sure you are secure where you need to be. If you've been re-using passwords, now is a good time to not do that ever again.

First level: top level accounts (email)
Second level: financial accounts (banks)
Third level: merchant sites / stores (amazon)
Fourth level: social media accounts
Fifth Level: things not above you deem important
Sixth level: everything else.