Cloudfare HTTPS Traffic Leak (aka Cloudbleed) - Change Your Passwords! - Page 1
Forum section: electronics / general

author: AntiProtonBoy
author_rank: Frequent Contributor
timestamp: February 24, 2017, 08:35:37 am
content: Major security flaw in Cloudflare services has been discivered  which apparently has been leaking customer HTTPS sessions for quite some time now [2, 3]. Services such as Uber, 1Password, FitBit, OKCupid, and more, maybe affected. To give you an idea how bad the situation is, let me quote you an excerpt from :QuoteI suspect that we could be seeing a future data dump or two for some of the popular online services. Keep your eyes peeled on this one. If you are on any of the websites listed in , change your passwords! Looks like the EEVblog domain might be affected, too (I found it on the domain list in ).1. Cloudflare Reverse Proxies are Dumping Uninitialized Memoryhttps://bugs.chromium.org/p/project-zero/issues/detail?id=11392. Reddit discussionhttps://www.reddit.com/r/programming/comments/5vtv16/cloudflare_have_been_leaking_customer_https/3. Hacker News discussionhttps://news.ycombinator.com/item?id=137187524. List of Sites possibly affected by Cloudflare's #Cloudbleed HTTPS Traffic Leakhttps://github.com/pirate/sites-using-cloudflare

author: Monkeh
author_rank: Super Contributor
timestamp: February 24, 2017, 09:04:32 pm
content: Yaaaaaay single point of failure.

author: Jeroen3
author_rank: Super Contributor
timestamp: February 24, 2017, 09:45:21 pm
content: Yes, shit is hitting the fan.Google de-autheticated all my session yesterday. Google does not do that on small rumors.

author: sleemanj
author_rank: Super Contributor
timestamp: February 24, 2017, 09:59:45 pm
content: CF working with search engines to "purge the caches" seems a lot like covering a mound of shit with a rug and calling it cleaning. There are caches *everywhere*, not just in major search engines, my sites have a constant uninterrupted stream of bots, some announced, many not (Chinanet ip address.....), who knows how many of them cache the entire html. I wonder if it is even in the best interests to purge those large search engine caches at all, better you KNOW that data has been compromised....

author: jimdeane
author_rank: Regular Contributor
timestamp: February 24, 2017, 11:24:36 pm
content: Jesus. Is there some sort of checker program that could search history and saved sites to highlight ones you use that are compromised?

author: SeanB
author_rank: Super Contributor
timestamp: February 26, 2017, 01:12:57 pm
content: Amipwned.com is a good place to start from........

author: station240
author_rank: Unknown
timestamp: February 26, 2017, 04:33:44 pm
content: Also been picked up by zdnet.http://www.zdnet.com/article/cloudflare-found-leaking-customer-https-sessions-for-months/I wonder if the odd bugs in this forum will fix themselves now, as they always seem to be something in Cloudflare rather than the forum software itself. You know the ones where a topic loads for some people and not others.

author: helius
author_rank: Super Contributor
timestamp: February 26, 2017, 04:46:00 pm
content: Quote from: jimdeane on February 24, 2017, 11:24:36 pmYes, if your browser uses an open format for its history.https://gist.github.com/zweizeichen/10bca3803b54070090ac48f5173910b2