17 ms·
It is far from over, too! Google Cache still has loads of sensitive information, a link away! Look at this, click on the downward arrow, "Cached": https://www.
by espadrine 10y ago
It is far from over, too! Google Cache still has loads of sensitive information, a link away!
Look at this, click on the downward arrow, "Cached": https://www.google.com/search?q="CF-Host-Origin-IP:"+"authorization:" https://www.google.com/search?q="CF-Host-Origin-IP:"+"author...
(And then, in Google Cache, "view source", search for "authorization".)
(Various combinations of HTTP headers to search for yield more results.)
- kristianp 10y agoWow, I just tried this, the first result with a google cache copy has a bunch of the kind of data described. Although there was only one result with a cache.
- batbomb 10y agoThe second page had a result with an OAuth2 Bearer token in it.
- dsp1234 10y agoPII, OAuth data, etc.
- PuffinBlue 10y agoI've so far seen an oAuth key for fitbit (via their android app) and api keys for trakt (though apparently that service doesn't use them?) I don't know, this just seems catastrophic.
- PuffinBlue 10y ago> The infosec team worked to identify URIs in search engine caches that had leaked memory and get them purged. With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory. Those 770 unique URIs covered 161 unique domains. The leaked memory has been purged with the help of the search engines. So I tried it too, and there's still data cached there. Am I misunderstanding something - that above statement must be wrong, surely? They can't have found everything even in the big search engines if it's still showing up in Google's cache, let alone the infinity other caches around the place. EDIT: If the cloudflare team sees I see leaked credentials for these domains: android-cdn-api.fitbit.com iphone-cdn-client.fitbit.com api-v2launch.trakt.tv
- toyg 10y ago> that above statement must be wrong, surely? Either they believe it's right, which means they're not competent enough to really assess the scope of the leak; or they don't believe it, but they went "fuck it, that's the best we can do". In either case, it doesn't really inspire trust in their service.
- blibble 10y agoyou missed one possibility: that they're deliberately attempting to downplay the severity to make themselves look less incompetent
- sikhnerd 10y agojgrahamc: can you list which public caches you worked with to attempt to address this? It does not inspire confidence when even google is still showing obvious results
- eastdakota 10y agoGoogle, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team. I agree it's troubling that Google is taking so long. We were working with them to coordinate disclosure after their caches were cleared. While I am thankful to the Project Zero team for their informing us of the issue quickly, I'm troubled that they went ahead with disclosure before Google crawl team could complete the refresh of their own cache. We have continued to escalate this within Google to get the crawl team to prioritize the clearing of their caches as that is the highest priority remaining remediation step.
- deleted 10y ago[deleted]
- obituary_latte 10y ago
- Retr0spectrum 10y agohttps://webcache.googleusercontent.com/search?q=cache:lw4K9G2F1WgJ:lightnetwork.ph/ofw-family-day-december-1/&num=1&hl=en&gl=uk&strip=0&vwsrc=1 https://webcache.googleusercontent.com/search?q=cache:lw4K9G... Internal Upstream Server Certificate ... /C=US/ST=California/L=San Francisco/O=Cloudflare Inc./OU=Cloudflare Services - nginx-cache/CN=Internal Upstream Server Certificate That really doesn't look good.
- sfeng 10y agoJust to point out, this is apparently a cert used for communicating between Cloudflare's services which has (presumably) been replaced. Cloudflare customer's certs weren't exposed.
- tlrobinson 10y agoThe first couple I looked at were requests to Uber and Fitbit...
- emmelaich 10y agoOne of my Uber rides two weeks ago went completely nuts. Both my and my drivers app screwed up at the same time and I was never picked up and then seconds later the app claimed I reached my destination. You have to wonder whether something like this is implicated.
- SteveNuts 10y agoProbably not. If someone knew about this exploit they're not going to be messing with people's Uber rides for lulz.
- emmelaich 10y agoI wasn't implying intention.
- Twirrim 10y agoThat's one phenomenal leap of logic there. Why would you think that?
- emmelaich 10y agoMerely that both my and the drivers app screwed up at the same time, and have a good chance of hitting the same Uber end-point. Apps that consume APIs would be more sensitive to unexpected junk than browsers.
- deleted 10y ago[deleted]
- fletchowns 10y agoBut there are so many other much more likely reasons why something like that would have happened, it is quite a leap to think that it is somehow related to this issue.
- toyg 10y agoLol, Google just purged that search. EDIT: but there's still plenty of fish: http://webcache.googleusercontent.com/search?q=cache:lw4K9G2F1WgJ:lightnetwork.ph/ofw-family-day-december-1/&num=1&hl=en&gl=uk&strip=0&vwsrc=1 http://webcache.googleusercontent.com/search?q=cache:lw4K9G2... This will take weeks to clean, and that's just for Google. EDIT2: found other oauth tokens, lots of fitbit calls... And this just by searching for typical CF internal headers on Google and Bing. There is no way to know what else is out there. What a mess.
- danielweber 10y agoGood. They're trying to clean up all the private data leaked everywhere. I tempted to say "why couldn't they figure out this google dork themselves" but they've probably been slammed for the past 7 days cleaning up a bunch of stuff anyway.
- taviso 10y agoYou have no idea.
- danielweber 10y agoYour hard work is appreciated.
- mintplant 10y agoFYI, I'm seeing some more of these results show up (with active caches) for the following searches: "CF-RAY" "CF-Force-Miss-TS" "X-SSL-Server-Name" "Internal Upstream Server Certificate0"
- jdewald 10y agoCF-RAY isn't internal and will show up in any CloudFlare hosted site's response headers.
- 10y ago
- mintplant 10y agoThe "well-known chat service" mentioned by Tavis appears to be Discord, for the record. edit: Uber also seems to be affected.
- Edmond 10y agomore results from duckduckgo: https://duckduckgo.com/?q=+%7B%22scheme%22%3A%22http%22%7D+CF-Host-Origin-IP&t=h_&ia=web https://duckduckgo.com/?q=+%7B%22scheme%22%3A%22http%22%7D+C...
- alinspired 10y agothis is quite bad. i hope google can put some effort in clearing it's cache too
- deleted 10y ago[deleted]
- djKianoosh 10y agoI searched for "CF-Host-Origin-IP:" token .... uhm is that what I think I'm seeing???
- chrissnell 10y agoIt seems like the reasonable thing for Google to do is to clear their entire cache. The whole thing. This is the one thing that they could do to be certain that they aren't caching any of this.
- callahad 10y agoWhat about Bing, Baidu, Yandex, The Internet Archive, and Common Crawl? What about caches that are surely maintained by the NSA, ФСБ, and 3PLA?
- chrissnell 10y agoOf course. Google dumping their cache puts only a small dent into the problem, but I feel that it's their responsibility to the innocent site operators caught in the middle of this.
- hueving 10y agoCloudflare's incompetence isn't Google's responsibility, particularly when Google wiping out their caches and damaging their own search results doesn't fix the problem. Hackers know how to use more than one search engine.
- nv-vn 10y agoThat only gives them an excuse to do nothing about this. All those companies should immediately go ahead and update any data that could have possibly leaked + inform their customers.
- meowface 10y agoThat might be a bit too extreme. But they should do something quickly to try to find all of these.
- wapz 10y agoI would say cloudflare should hire them to try to find them. It's really not on google IMO (unless caching has some implications regarding storing sensitive data).
- ikeboy 10y ago>It is a snapshot of the page as it appeared on Feb 21, 2017 20:20:45 GMT So the issue wasn't fully fixed on Feb 19, or Google's cache date isn't accurate?
- scurvy 10y agoTime to find out where various "booter" sites are actually hiding.
- lesterwelsh28 10y agoAny thing