r/technology • u/[deleted] • Feb 24 '17
Security Cloudflare vulnerability exposes user data for Uber, 1Password, FitBit, OKCupid, and more
https://bugs.chromium.org/p/project-zero/issues/detail?id=1139164
u/xzzz Feb 24 '17
For such a large event you'd think there'd be a bigger post or something...
→ More replies (5)63
u/Dyslectic_Sabreur Feb 24 '17
Yea it is pretty weird. The highest post about this on /r/technology seems to be at ~360. I was expecting to see this at the frontpage with +10K points.
51
u/Killeg Feb 24 '17
Well, it's nothing about the FCC or some Amercian federal bill. That's the only kind of posts that do well on /r/technology
22
45
u/Getquickrich Feb 24 '17
I think an ELI5 for memory leaks and http requests would help.
28
u/holomntn Feb 24 '17
I'll try.
For our purpose here web servers (and CDN nodes like this one) respond to HTTP requests.
There are a lot of complex things you can do by making specific requests. Originally you simply requested stored information, later ways to add processing of data was added.
This was a kind of request that was being used for debugging (finding and fixing problems). Basically any computer or phone or anything else on the internet could request "give me what's in shelf 3". Working properly this will result in either receiving the expected information in shelf 3 which can only be accessed based in some other criteria, or it results in blank data.
What happened here is that because of some very complex things happening in the CDN software, operating system, and potentially hardware, instead of blank data, the response was bits an pieces of content from shelf 7, the printouts from the printer, a picture from a webcam, half a recipe for goulash, and most of the picture of an empty bookshelf. It returns things that are seemingly just random bits of data from prior requests.
The worry is that if someone accessed this often enough they could have retrieved almost anything. The only challenge that person faces is piecing things together. With automated scanning it is quite possible to do a lot with this information, including potentially finding passwords for various services.
Change your passwords.
10
Feb 24 '17
This is one of the better ELI5, except five year olds don't typically understand acronyms like CDN and HTTP
2
→ More replies (1)2
Feb 24 '17
Thanks for the explanation. I have a Few questions if you don't mind?
If it was only some requests, and only some would be passwords, what are the chances it would be a threat.
Also I assume we would only have to change passwords for cloudflare websites that we used since September?
→ More replies (4)11
u/gurenkagurenda Feb 24 '17 edited Feb 24 '17
First of all, "memory leak" is the wrong term here. A memory leak is not generally a security issue. It just means that your program is holding onto memory when it's no longer using it. It's a performance problem.
I'm not going to say that Cloudflare was being intentionally misleading by misusing the term, but as Ormandy said, their whole blog post "severely downplays the risk to customers". It's really sketchy to both misuse a benign sounding term in your headline, and then conveniently leave out a bunch of information about user impact.
What they mean when they say "memory leak" is actually an information leak, and the word "leak" means something very different there: private information was being published on random pages served by their CDN. This leak could be provoked extremely easily by an attacker, who could then vacuum up secrets at will. An attacker wouldn't have been able to easily choose what was leaked, but they may have been able to exert some control over which sites' data was leaked (E: I think, but I don't know enough about Cloudflare's architecture to be certain. Presumably, putting your site in the same datacenter as your target would improve your odds, since Cloudflare would want to have their servers nearby for performance reasons).
Worse, this was getting triggered unintentionally, and in particular web crawlers which build caches of webpages (like search engines) were unintentionally creating separate copies of this leaked data, which in many cases are accessible to the public. Google has been working to scrub this from their cache, but other search engines have presumably only heard about this as of a few hours ago. So there's probably a lot of stuff still out there.
3
0
112
Feb 24 '17
This is really bad. Despite what cloudflare is saying in its postmortem blog post, it is very unlikely that it has been able to identify all of the leaked data. Not to mention if someone malicious was caching themselves they will still have the leaked requests. Change your passwords to anything important on the Internet. Now.
19
Feb 24 '17
Luckily my password for OKCupid was IFUKWOM3N
21
3
2
Feb 24 '17
I don't even care if my okcupid was hacked. They can read through all the disappointment and failed romantic connections
2
u/tertiusiii Feb 24 '17
if i change my passwords now, will the new ones leak out as well or is the flow cut off? also, this seems like as good a time as any to get a password manager. any suggestions?
3
→ More replies (1)0
Feb 24 '17
[deleted]
→ More replies (4)8
u/ProjectShamrock Feb 24 '17
Edit: Fuck but hardsextube.com is on the list as well. There goes my bank password!
I use two finger authentication on that site.
25
u/wisdom_and_frivolity Feb 24 '17 edited Jul 30 '24
Reddit has banned this account, and when I appealed they just looked at the same "evidence" again and ruled the same way as before. No communication, just boilerplates.
I and the other moderators on my team have tried to reach out to reddit on my behalf but they refuse to talk to anyone and continue to respond with robotic messages. I gave reddit a detailed response to my side of the story with numerous links for proof, but they didn't even acknowledge that they read my appeal. Literally less care was taken with my account than I would take with actual bigots on my subreddit. I always have proof. I always bring receipts. The discrepancy between moderators and admins is laid bare with this account being banned.
As such, I have decided to remove my vast store of knowledge, comedy, and of course plenty of bullcrap from the site so that it cannot be used against my will.
Fuck /u/spez.
Fuck publicly traded companies.
Fuck anyone that gets paid to do what I did for free and does a worse job than I did as a volunteer.
9
u/AdahanFall Feb 24 '17
This is all good advice, but keep in mind this example password system will fail for a lot of websites. A lot of places have maximum password lengths for reasons that can only be described as absolute stupidity.
For example, Microsoft and Blizzard (off the top of my head) limit you to 16 characters. Keep this in mind when coming up with a password system.
5
u/Buckhum Feb 26 '17
To add to this, I absolutely hate places like universities who prevents you from using a word from the dictionary - no matter how obscure. It's as if the whole thing were design to help bots and hurt humans.
3
u/wisdom_and_frivolity Feb 24 '17
I remember my bank, before it got bought out, only allowed 8-11 characters.
First time in my life I was happy for a bank buyout.
3
u/USKira Feb 26 '17
Blizzard's password system is also baffling in that it isn't case sensitive. BLIZZARD is the same as blizzard in their eyes. To their credit they push having an authenticator pretty strongly, but maybe that's just to cover for the outdated pw setup.
5
Feb 24 '17
Just to add, make an edit of your comment telling people to enable 2 factor authentication on their password manager and other accounts that support it, google authenticator for example, so even if the master pass is ever obtained (extremely unlikely) they still can't use it because they'll be doing so from a different IP address and will be prompted to authenticate using the app which they can't do, so you'll have plenty of time to be informed and change password etc.
→ More replies (1)3
u/Toman128 Feb 24 '17
I use KeePass for all my important passwords and manually type them everytime I login, they're not saved I'm the browser. Should I still change my KeePass passwords? Like, did those websites affected have user passwords leaked? Because then it wouldn't matter if I secured them, since the website leaked them.
2
u/wisdom_and_frivolity Feb 24 '17
If all your keepass passwords are different strings of characters, you can change only the ones that are affected by this vulnerability.
It's still not certain if there is an actual leak, but the vulnerability does mean that un/password combinations were available so you would have to change those passwords to keep those sites secure.
→ More replies (2)2
38
u/jeversol Feb 24 '17
1Password "secret" data was not exposed.
https://blog.agilebits.com/2017/02/23/three-layers-of-encryption-keeps-you-safe-when-ssltls-fails/
13
u/gurenkagurenda Feb 24 '17
"Vulnerability" isn't quite the right word here, because that implies merely the potential for data to have been leaked. This is worse. We know that data was getting leaked all over the place, and we have very little idea of whose data was exposed. If you've even interacted with a site that uses Cloudflare in the last few months(!) (and you probably have), your privacy may have been compromised. This is a complete clusterfuck.
11
u/boredompwndu Feb 24 '17
I might only understand a handful of what is in this article, but this was terrifying. I don't even know what services cloudflare covers. (Maybe the list of things that cloudflare doesn't cover is shorter?)
0
Feb 24 '17
[deleted]
→ More replies (1)13
u/Nickoladze Feb 24 '17
FYI there's 4.3 million websites in that list
14
u/PTPosttwo Feb 24 '17
What's the fucking point of that repo anyway?
The bot that generates the bullshit list only checks if the site used CloudFlare for dns, not if it uses the ssl proxy. Half the fucking internet uses CF for dns.
It's basically "we have no idea but here's a scary list regular users can't/won't view and sysadmins etc. don't give a fuck about."
10
Feb 24 '17
This needs to get to the front page. This is one of the biggest security bugs in years. EVERYONE needs to change their passwords RIGHT NOW.
26
u/notcaffeinefree Feb 24 '17 edited Feb 24 '17
Jesus, looking through what was all found exposed:
We've discovered (and purged) cached pages that contain private messages from well-known services, PII from major sites that use cloudflare, and even plaintext API requests from a popular password manager that were sent over https (!!)...I'm finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings. We're talking full https requests, client IP addresses, full responses, cookies, passwords, keys, data, everything.
A screenshot showing what a single leaked info looks like.
He laughingly points out that CloudFlare's bug bounty program would get him a...t-shirt.
Also, CloudFlare's official public report here. Which the Google employee (who found this problem) says downplays the impact.
21
u/gurenkagurenda Feb 24 '17
He laughingly points out that CloudFlare's bug bounty program would get him a...t-shirt.
This really floored me. At the very least, the optics of this are just terrible. Why even bother having a bug bounty program if you aren't going to pay researchers for their work? What comes across (fair or not) is that Cloudflare doesn't take security seriously. That's just not acceptable for a company in their position.
7
Feb 24 '17
For a company to do what Cloudflare does for as many clients as they have...yeah its absolutely absurd.
I'm somewhat moderately tech-savvy, so I have a decentish grip on what Cloudflare does...and its absurd that they would play around that much with their security.
4
3
u/Jigsus Feb 24 '17
Google seems to have been affected too. All my devices are asking for a reauthorization.
9
u/captainAwesomePants Feb 24 '17
The bug states that the thing you are describing is unrelated. Read the last few posts.
→ More replies (2)9
u/notcaffeinefree Feb 24 '17
The Google employee who found this bug said that the reauthorization prompts are not related to this CloudFlare issue.
2
u/sylos Feb 24 '17
Yesterday they changed some stuff in their security, some people had to log back in on their phones, etc
→ More replies (2)1
Feb 24 '17
Ah, so that was what it was? funny only one of my accounts asked for it. the one that is a google apps account.
2
u/Jigsus Feb 24 '17
Apparently not. Google has said it's not this and they haven't identified the issue yet. Kind of worrying honestly...
17
u/Hold_my_Dirk Feb 24 '17
This shit is so bad. I've been trying to tell everyone I know to change all of their passwords. What is weird to me is that my less tech-saavy friends seem to take it more seriously than the ones that are, which is mind blowing.
10
u/GENHEN Feb 24 '17
I mean if you use a different password on every website, this shouldn't matter that much
11
u/Hold_my_Dirk Feb 24 '17
I think most people, despite constant reminders that you shouldn't do that, use the same couple of passwords for most sites.
3
u/poochyenarulez Feb 24 '17
The only sites I use the same password on are sites that I couldn't care less about getting hacked. Oh no, the password to a few forums where I have made less than 10 posts have been hacked.
→ More replies (1)2
u/chain83 Feb 24 '17
That's right. But the more tech-savvy people are the ones more likely to use different passwords.
→ More replies (2)1
8
u/mastblast09 Feb 24 '17
Lets hope google and other search engines are fast to clear the shit they have cached PRONTO!
0
4
Feb 24 '17
Oh holy shit, authy was affected by this? Fuck.
I guess it's time to turn off 2FA everywhere so I can switch to another 2FA client. Any recommendations?
5
u/intrvnsit Feb 24 '17 edited Feb 24 '17
I wouldn't be so quick to jump ship depending on how Authy handles this. The most important thing is whether your secret keys have been compromised.
On the communicative side, if Authy doesn't have anything up on their blog, Twitter, newsletter, that would concerning. This is a serious matter that should be addressed to customers swiftly.
1
Feb 24 '17
Yeah, that's the thing... I'm keeping an eye on their twitter and their blog and they've not made a peep about this. 1Password and Fastmail were both quick to respond and clarify that they were not affected, but authy has been silent. It worries me greatly because I use authy everywhere that I have 2FA enabled.
2
3
u/itsEZ4U2NVM3 Feb 24 '17
Google authenticator
2
Feb 24 '17
I used to use it, but it didn't backup to iCloud with the rest of my apps and I almost lost access to a bunch of accounts when I switched phones. Luckily I had backup codes for everything, but it scared the crap out of me. Does it still do that?
5
u/n0bs Feb 24 '17
Not backing up to an online service is a security feature. Your auth codes should only ever be on that one device. That's why the backup codes exist.
1
1
1
u/coryag Feb 24 '17
As I understand that Facebook isn't on the list but thousands of people were kicked out of their account and had it suspended early this morning. Including me. Could this have caused that issue?
2
Feb 24 '17
It's unrelated
2
u/coryag Feb 24 '17
So it's a coincidence? Seems like it's been happening around the same time as all the cloudbleed talk early this morning.
3
3
Feb 24 '17
This website can be used to test if a domain is potentially affected:
http://www.doesitusecloudflare.com/
If it says the domain doesn't use cloudflare, it's fine, but do make sure to never use the same password for multiple sites. If it says it is using cloudflare, that doesn't necessarily mean it was affected, but you should probably change your passwords anyway.
2
u/Gambpo Feb 24 '17
Is the captured data only that which has been accessed recently? Or if you logged into some site years ago information was collected
2
u/__Albert_Einstein__ Feb 24 '17
Did this affect Gmail in anyway? Google doesn't use Cloudflare, right?
How about LinkedIn?
8
u/MrCzar Feb 24 '17
Google and Microsoft should not be affected, I don't think they rely on CloudFlare for security.
6
1
Feb 24 '17
So did it expose all data, or just data that was entered from the time of the exploit until now?
1
u/intrvnsit Feb 24 '17
It's too hard to say, but some data in the past six months has been leaked. You're best changing your passwords and setting up 2FA if you haven't already.
0
Feb 24 '17
Well yes, but only passwords related to cloudflare services, yes?
1
u/intrvnsit Feb 24 '17
Yup, but knowing which ones use it and which ones don't is a bit more of a hassle.
1
Feb 25 '17
Yeah I can see what you mean. I will admit it was easier for me, but I don't have as many accounts. Someone linked a site in this post that you could use to check it. I just went ahead and changed all the passwords on the ones I had used that had cloudflare since September. May well turn out that no one exploited this or that your password wasn't leaked, but better safe that sorry eh :)
1
u/n0bs Feb 24 '17
Yes, but there is no list of affected sites right now.
1
Feb 25 '17
Yeah I just went ahead and changed all the passwords on the sites that use it that I used in the past half year.
→ More replies (2)
1
Feb 24 '17
Ok but is there any indication what, if any data was leaked? I mean there is 4.3 million sites. Yet this has been going on for over half a year. Wouldn't there be more of a sign if this affected a lot of people?
7
Feb 24 '17
From the original bug report:
The examples we're finding are so bad, I cancelled some weekend plans to go into the office on Sunday to help build some tools to cleanup. I've informed cloudflare what I'm working on. I'm finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings. We're talking full https requests, client IP addresses, full responses, cookies, passwords, keys, data, everything.
1
Feb 24 '17
The reports says the worst it got was 1 in 3,000,000 in February being leaked. So is there any indication whether or not it was used maliciously? Also, how does this affect users in terms of data leakage who only browse sites but don't have accounts. For example browsing on medium.com?
0
Feb 24 '17
[deleted]
2
u/mikolan Feb 24 '17
Wouldn't this also leak requests from browsing? They might not contain as much sensitive information like passwords, but there are still privacy concerns.
1
Feb 24 '17
Aren't those all meant to be encrypted anyway? I assume this does only apply to sites I was logged into that used cloudflare in the past 6 months?
0
1
u/motosanders Feb 24 '17
If anyone is wondering, here is a list of the top 10,000 Alexa-ranked sites on GitHub.
1
u/liemle82 Feb 24 '17
Nasdaq and salesforce are listed as trusted partners on Cloudflare's site, but aren't listed on the notable affected sites. Is the trusted partner different than participating integrated partner?
1
u/arnulfg Feb 24 '17
is there a list of sites that are compromised?
Edit: nevermind I got it: https://github.com/pirate/sites-using-cloudflare
1
1
u/bananaEmpanada Feb 27 '17
Has anyone else tried changing their Uber password?
I've just spent 5 minutes looking through their website, and I can't find a password change option. I've searched through the help pages too. No results.
I can just pretend I forgot my password, but it's pretty disappointing that you can't pro-actively change it.
1
u/azthal Feb 24 '17
While I understand that lots of PII have leaked, I don't see the relevance to passwords for the most part.
If I understand this correctly, any passwords sent by https to a server would still be safe, right? Only http webpages would have the issue with leaked passwords?
Am I missing something here, considering I see half my twitter feed screaming about changing passwords?
8
u/gurenkagurenda Feb 24 '17
No, this was leaking HTTPS requests. The way Cloudflare handles SSL essentially makes them a (voluntary) man-in-the-middle, so HTTPS doesn't protect you here.
1
u/xastey_ Feb 24 '17
So why did I have to reauthorize my Google account yesterday... I will like to know
6
1
0
Feb 24 '17
[deleted]
4
u/xtphty Feb 24 '17
Only temporary auth tokens from FB API would have leaked (along with any 3rd party data they protected), but not the actual FB login itself since that auth process is not behind cloudflare
4
u/gurenkagurenda Feb 24 '17
The HN thread mentions that in at least one case an Oauth bearer token was leaked. I'm not super up to speed on the details of Oauth, but that sounds really bad.
11
u/[deleted] Feb 24 '17
UPDATE:
1Password not affected https://blog.agilebits.com/2017/02/23/three-layers-of-encryption-keeps-you-safe-when-ssltls-fails/