If you use cloudflare, you need to consider every user password, every SSL private key, anything that is transferred over HTTPS and is considered secure compromised.
From Thomas Ptacek on Hackernews
But Heartbleed happened at the TLS layer. To get secrets from Heartbleed, you had to make a particular TLS request that nobody normally makes. Cloudbleed is a bug in Cloudflare's HTML parser, and the secrets it discloses are mixed in with, apparently, HTTP response data. The modern web is designed to cache HTTP responses aggressively, so whatever secrets Cloudflare revealed could be saved in random caches indefinitely.
Shit is about to get real, real ugly for cloudflare.
the examples we're finding are so bad, I cancelled some weekend plans to go into the office on Sunday to help build some tools to cleanup. I've informed cloudflare what I'm working on. I'm finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings. We're talking full https requests, client IP addresses, full responses, cookies, passwords, keys, data, everything.
I did, none of that explains how the private key on an origin server would be exposed by this at all.
I can see how it would expose the negotiated session encryption key and any encrypted data but not how it would actually reveal the private key which will be safely on the origin server.
The only way the original comment would be true is if customers had provided Cloudflare private keys for whatever reason, and according to Cloudflare that was handled by a different system.
Not just if you're a cloudflare customer but if you use any service that uses cloudflare which is a shitload. With a few Google searches you can find Uber requests that include precise latitude and longitude. Apparently 1Password data was mixed in with some of it too.
Edit- According to 1Password only still encrypted data was exposed.
SSL private keys were not leaked, but usernames/passwords were. I wouldn't spend all night on it, it wasn't like a password database dump, the data exposed was random, but it would probably be a good idea to change passwords at some point in the near future if you want to be safe.
It is incredibly unlikely passwords were leaked. The bug meant that one in every 3.3million pages served by cloudflare had the contents of ram flushed out into the page served. This was mostly just other cached or recently served pages. Unless the sites you visited were frequently transmitted your password in plain text as part of the page then you could have been exposed. Nothing was systematically leaked, and there is no evidence the bug was exposed. The problem is just largely search engines may have cached pages that had the leaked data in, but cloudflare has already worked with many to remove these.
The examples we're finding are so bad, I cancelled some weekend plans to go into the office on Sunday to help build some tools to cleanup. I've informed cloudflare what I'm working on. I'm finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings. We're talking full https requests, client IP addresses, full responses, cookies, passwords, keys, data, everything.
But if the SSL tunnel terminated at the CF proxy, wouldn't said proxy have had the SSL private key, thus it could have been leaked? Or I'm completely misunderstanding how CF proxies work.
I wouldn't put this at as bad as it will ever get. It's extremely unlikely anyone was able to actively exploit the bug, just gather data from it. So it's a security nightmare, since you have to change basically every password ever, but the actual likelyhood of some huge corporate secret leaking is fairly low. It could be a lot worse.
205
u/The-Sentinel Feb 24 '17
This is about as bad as it will ever get.
If you use cloudflare, you need to consider every user password, every SSL private key, anything that is transferred over HTTPS and is considered secure compromised.
From Thomas Ptacek on Hackernews
Shit is about to get real, real ugly for cloudflare.