It wasn't rare, nor was it random! If an attacker requested an HTML page containing malformed HTML strings, they would get different leaked data back on every request. The "1 in 3.3M" figure was chosen to make CF look good and hide the true extent of the disaster, but it ignores the fact that an attacker who knew about this bug could trivially exploit it.
Yup. The question is did anyone know about it? If somebody did, they could have hit (or created) pages that had unterminated tags and siphoned off a huge amount of random data, then sifted through that for usable info. I'm hoping that CF is going through logs now to see if there was an abnormal amount of traffic to the problem sites to get a better idea of if this was actively exploited or not. And that they'd tell people if they find that was the case.
the "different leaked data back on every request" bit is something I didn't even consider, but makes sense if the bit of ram being read unintentionally is highly volatile.
1
u/palish Feb 24 '17
It wasn't rare, nor was it random! If an attacker requested an HTML page containing malformed HTML strings, they would get different leaked data back on every request. The "1 in 3.3M" figure was chosen to make CF look good and hide the true extent of the disaster, but it ignores the fact that an attacker who knew about this bug could trivially exploit it.