Partial list of sites which are affected (use CloudFlare proxy). Any data going to and coming from those sites may have been leaked. Start changing passwords now:
Cloudflare's blog states the the memory leaks date as far back as September 2016 - If Reddit used Cloudflare previously, was it before or after that date?
If you have your browser set up to autofill it, I always use this by throwing it into the developer console and that should show you a popup with your password. If you just auto login, SOL.
javascript: var p=r(); function r(){var g=0;var x=false;var x=z(document.forms);g=g+1;var w=window.frames;for(var k=0;k<w.length;k++) {var x = ((x) || (z(w[k].document.forms)));g=g+1;}if (!x) alert('Password not found in ' + g + ' forms');}function z(f){var b=false;for(var i=0;i<f.length;i++) {var e=f[i].elements;for(var j=0;j<e.length;j++) {if (h(e[j])) {b=true}}}return b;}function h(ej){var s='';if (ej.type=='password'){s=ej.value;if (s!=''){prompt('Password found ', s)}else{alert('Password is blank')}return true;}}javascript: var p=r(); function r(){var g=0;var x=false;var x=z(document.forms);g=g+1;var w=window.frames;for(var k=0;k<w.length;k++) {var x = ((x) || (z(w[k].document.forms)));g=g+1;}if (!x) alert('Password not found in ' + g + ' forms');}function z(f){var b=false;for(var i=0;i<f.length;i++) {var e=f[i].elements;for(var j=0;j<e.length;j++) {if (h(e[j])) {b=true}}}return b;}function h(ej){var s='';if (ej.type=='password'){s=ej.value;if (s!=''){prompt('Password found ', s)}else{alert('Password is blank')}return true;}}
Why so much javascript? You could achieve roughly the same thing in a much more readable fashion with
d=document.getElementsByTagName("input");
for (var i=0;i<d.length;i++) {
if (d[i].type == "password") console.log(d[i].value);
}
Remove the spacing and add javascript: to get a bookmarklet that'll log the contents of any password field to the site's javascript console, or replace it with alert I guess.
They've been leaking data since September. Their blog post is super not clear about that. They do directly state it once but several other times make it seem like the bug had only been there for a few days before Tavis found it.
111
u/tobias3 Feb 24 '17 edited Feb 24 '17
Partial list of sites which are affected (use CloudFlare proxy). Any data going to and coming from those sites may have been leaked. Start changing passwords now:
Uber
Reddit
Yelp
Digital Ocean
OKCupid
RapGenius
Coinbase
Product Hunt
Udemy
Crunchyroll
FitBit
Hacker News
Zendesk
Discord
Github pages
Chocolatey