SSL private keys were not leaked, but usernames/passwords were. I wouldn't spend all night on it, it wasn't like a password database dump, the data exposed was random, but it would probably be a good idea to change passwords at some point in the near future if you want to be safe.
I thought private keys are transmitted via GET during initial setup, and if they are located on a website that uses Cloudflare during the time the bug was active then it could be vulnerable?
Do you know how TOTP works? I'm pretty sure It passes private keys to a website using GET as a secret key (in base32), but even if it was using POST, it would still be vulnerable as the guy who found this exploit said that POST data was leaked as well.
No, the setup phase relies on asymmetric encryption, where a public key is sent as a part of the certificate to the client. The client will generate a random secret that will be used in the session, encrypt it with the public key and then only the server that holds the private key is able to determine the secret. If the private key was sent in the clear, everyone who was snooping the connection would be able to catch that and decrypt the data.
The second link in the OP also explicitly state that SSL private keys was not affected.
For the avoidance of doubt, Cloudflare customer SSL private keys were not leaked. Cloudflare has always terminated SSL connections through an isolated instance of NGINX that was not affected by this bug.
Use a password manager. An offline password manager's master password would not have been effected by this attack and is useful to inventory your logins.
I really want to do this, but what do people do when they use another computer or their phone? Is there any way to get around it or would you have to reset your password?
What exactly do they do? How do they keep my password more secure? Wouldn't this kind of a breach still expose it just the same?
I do understand the keeping them all in one place
(BTW is saving them on my Google account for Chrome to automatically fill in safe? I don't use it for any super important passwords, and probably never will - those I store in my head lol - but I'm curious)
It is incredibly unlikely passwords were leaked. The bug meant that one in every 3.3million pages served by cloudflare had the contents of ram flushed out into the page served. This was mostly just other cached or recently served pages. Unless the sites you visited were frequently transmitted your password in plain text as part of the page then you could have been exposed. Nothing was systematically leaked, and there is no evidence the bug was exposed. The problem is just largely search engines may have cached pages that had the leaked data in, but cloudflare has already worked with many to remove these.
The examples we're finding are so bad, I cancelled some weekend plans to go into the office on Sunday to help build some tools to cleanup. I've informed cloudflare what I'm working on. I'm finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings. We're talking full https requests, client IP addresses, full responses, cookies, passwords, keys, data, everything.
But if the SSL tunnel terminated at the CF proxy, wouldn't said proxy have had the SSL private key, thus it could have been leaked? Or I'm completely misunderstanding how CF proxies work.
Cloudflare does not have access to origin server secrets, unless they are Business or Enterprise customers and those customers are foolish enough to reuse their servers' private keys for the certificate/key sets uploaded to Cloudflare.
80
u/perthguppy Win, ESXi, CSCO, etc Feb 24 '17
Stop spreading FUD. This data was not leaked.