[Pulz]

Source from discord: Liberal clam(Programmix#0748)

Just a heads up of a recently exposed vulnerability within CloudFlare's infrastructure. The vulnerability pertains to data exposure during transmission between CloudFlare's proxy servers and the target server. This has been the case for data transferred between 2016-09-22 and 2017-02-18.

Discord's Aethex developer, 'Liberal clam' made the announcement on his server within the hour of this post.
Passwords should be changed on all sites using CloudFlare.

Discord itself is listed as an affected site, but Discord confirmed that they are unlikely to have been affected as they do not use the features of CloudFlare that were vulnerable. But your password should be changed anyway, just for safety.

Affected sites and more information can be found in this list:
https://github.com/pirate/sites-using-cloudflare

Liberal's sources:
https://bugs.chromium.org/p/project-zero...il?id=1139
https://blog.cloudflare.com/incident-rep...arser-bug/
https://www.reddit.com/r/sysadmin/commen...e_reverse/

Edit | Some interesting news articles have popped up:
https://www.theregister.co.uk/2017/02/24...onal_data/
https://medium.com/@octal/cloudbleed-how....ahn7wcd5a
https://www.lifehacker.com.au/2017/02/cl...-affected/
https://www.privateinternetaccess.com/bl...t-history/

Got this from CF today...

Quote:
Your domain is not one of the domains where we have discovered exposed data in any third party caches. The bug has been patched so it is no longer leaking data.

[Ainaj]

Got it in 20 seconds before me..

[Eternal.]

This is a serious breach, I recommend changing your passwords pretty much everywhere because even if the site itself wasn't affected, it could have used a site connected to cloudflare and been leaked.

[Ainaj]

I some reason sensed something like this yesterday and changed most important passwords

[Wαlrυѕ]

Wait about a weeks worth of time and this will be all over the news just like heartbleed

[Ainaj]

Oh and CC info could be exposed too. RIP.

[vaiperboy]

hackforums is on that list :|
my 2fa will still protect me, right? (unless if the secret key is stolen as well)

even https://www.authy.com/ is on that list lmfao, fuckin rip us

[Ace of Knaves]

So many BTC sites on that list that could be affected (Coinbase, Localbitcoins, Poloniex). Potential for a lot of money to go 'missing'...

[SIM-888979]

hackforums is on that list :|
my 2fa will still protect me, right?

We'll have to wait for Omniscient to confirm this.

[Pulz]

Wait about a weeks worth of time and this will be all over the news just like heartbleed

Maybe. CloudFlare claims only a small percentile of requests were 'leaked', but then again, you never know if your own data was included.

[Ainaj]

We'll have to wait for Omniscient to confirm this.

Every website that uses Cloudflare, and any part of their service that modifies the HTML code has been affected. So yes, this includes HF

[SIM-888979]

Every website that uses Cloudflare, and any part of their service that modifies the HTML code has been affected. So yes, this includes HF

I thought it was only websites that uses specific features of CloudFlare such as email obfuscation, server-side Excludes and automatic HTTPS rewrites.

https://blog.cloudflare.com/incident-rep...arser-bug/

Perhaps HF does not have those features enabled?

[Jаson]

general idea how bad this is

[Ainaj]

I thought it was only websites that uses specific features of CloudFlare such as email obfuscation, server-side Excludes and automatic HTTPS rewrites.

https://blog.cloudflare.com/incident-rep...arser-bug/

Perhaps HF does not have those features enabled?

Pretty sure Omni mentioned he was trying the HTTPS rewrites for something, around the time he moved to https

[Pulz]

I don't pretend to understand exactly what features and requirements have to be met in order to be part of the whole Cloudbleed problem, so it's pretty possible that many sites on the list- including HF, weren't affected at all. But still, passwords should be changed regularly anyway. So nows a better time than any.