+- Hack Forums (https://hackforums.net)
+-- Forum: General Topics (https://hackforums.net/forumdisplay.php?fid=7)
+--- Forum: World (https://hackforums.net/forumdisplay.php?fid=445)
+---- Forum: The Lounge (https://hackforums.net/forumdisplay.php?fid=25)
+---- Thread: [ALERT] CloudFlare vulernability | #Cloudbleed HTTPS Traffic Leak (/showthread.php?tid=5559373)
[ALERT] CloudFlare vulernability | #Cloudbleed HTTPS Traffic Leak - Pulz - Feb 23, 2017
Source from discord: Liberal clam(Programmix#0748)
Just a heads up of a recently exposed vulnerability within CloudFlare's infrastructure. The vulnerability pertains to data exposure during transmission between CloudFlare's proxy servers and the target server. This has been the case for data transferred between 2016-09-22 and 2017-02-18.
Discord's Aethex developer, 'Liberal clam' made the announcement on his server within the hour of this post.
Passwords should be changed on all sites using CloudFlare.
Discord itself is listed as an affected site, but Discord confirmed that they are unlikely to have been affected as they do not use the features of CloudFlare that were vulnerable. But your password should be changed anyway, just for safety.
Affected sites and more information can be found in this list:
https://github.com/pirate/sites-using-cloudflare
Liberal's sources:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1139
https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/
https://www.reddit.com/r/sysadmin/comments/5vu3yn/cloudbleed_seceurity_bug_cloudflare_reverse/
Edit | Some interesting news articles have popped up:
https://www.theregister.co.uk/2017/02/24/cloudbleed_buffer_overflow_bug_spaffs_personal_data/
https://medium.com/@octal/cloudbleed-how-to-deal-with-it-150e907fd165#.ahn7wcd5a
https://www.lifehacker.com.au/2017/02/cloudflare-cloudbleed-bug-exposes-sensitive-data-who-is-affected/
https://www.privateinternetaccess.com/blog/2017/02/cloudflares-cloudbleed-worst-privacy-leak-recent-internet-history/
Omniscient Wrote:Got this from CF today...
Quote:Quote:
Your domain is not one of the domains where we have discovered exposed data in any third party caches. The bug has been patched so it is no longer leaking data.
* - Ainaj - Feb 23, 2017
Got it in 20 seconds before me..
* - Eternal. - Feb 23, 2017
This is a serious breach, I recommend changing your passwords pretty much everywhere because even if the site itself wasn't affected, it could have used a site connected to cloudflare and been leaked.
* - Ainaj - Feb 23, 2017
I some reason sensed something like this yesterday and changed most important passwords
* - Wαlrυѕ - Feb 23, 2017
Wait about a weeks worth of time and this will be all over the news just like heartbleed
* - Ainaj - Feb 23, 2017
Oh and CC info could be exposed too. RIP.
* - vaiperboy - Feb 23, 2017
hackforums is on that list :|
my 2fa will still protect me, right? (unless if the secret key is stolen as well)
even https://www.authy.com/ is on that list lmfao, fuckin rip us
* - Ace of Knaves - Feb 23, 2017
So many BTC sites on that list that could be affected (Coinbase, Localbitcoins, Poloniex). Potential for a lot of money to go 'missing'...
* - SIM-888979 - Feb 23, 2017
(Feb 23, 2017 10:04 PM)vaiperboy Wrote: hackforums is on that list :|
my 2fa will still protect me, right?
We'll have to wait for Omniscient to confirm this.
* - Pulz - Feb 23, 2017
(Feb 23, 2017 09:48 PM)Wαlrυѕ Wrote: Wait about a weeks worth of time and this will be all over the news just like heartbleed
Maybe. CloudFlare claims only a small percentile of requests were 'leaked', but then again, you never know if your own data was included.
* - Ainaj - Feb 23, 2017
(Feb 23, 2017 10:06 PM)Aurora Wrote: We'll have to wait for Omniscient to confirm this.
Every website that uses Cloudflare, and any part of their service that modifies the HTML code has been affected. So yes, this includes HF
* - SIM-888979 - Feb 23, 2017
(Feb 23, 2017 10:11 PM)CesarVB Wrote: Every website that uses Cloudflare, and any part of their service that modifies the HTML code has been affected. So yes, this includes HF
I thought it was only websites that uses specific features of CloudFlare such as email obfuscation, server-side Excludes and automatic HTTPS rewrites.
https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/
Perhaps HF does not have those features enabled?
* - Jаson - Feb 23, 2017
general idea how bad this is
![[Image: C5ZGfdvWgAAoQWo.jpg]](https://pbs.twimg.com/media/C5ZGfdvWgAAoQWo.jpg)
* - Ainaj - Feb 23, 2017
(Feb 23, 2017 10:14 PM)Aurora Wrote: I thought it was only websites that uses specific features of CloudFlare such as email obfuscation, server-side Excludes and automatic HTTPS rewrites.
https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/
Perhaps HF does not have those features enabled?
Pretty sure Omni mentioned he was trying the HTTPS rewrites for something, around the time he moved to https
* - Pulz - Feb 23, 2017
I don't pretend to understand exactly what features and requirements have to be met in order to be part of the whole Cloudbleed problem, so it's pretty possible that many sites on the list- including HF, weren't affected at all. But still, passwords should be changed regularly anyway. So nows a better time than any.