12 ms·

> The infosec team worked to identify URIs in search engine caches that had leaked memory and get them purged. With the help of Google, Yahoo, Bing and others,

> The infosec team worked to identify URIs in search engine caches that had leaked memory and get them purged. With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory. Those 770 unique URIs covered 161 unique domains. The leaked memory has been purged with the help of the search engines. So I tried it too, and there's still data cached there. Am I misunderstanding something - that above statement must be wrong, surely? They can't have found everything even in the big search engines if it's still showing up in Google's cache, let alone the infinity other caches around the place. EDIT: If the cloudflare team sees I see leaked credentials for these domains: android-cdn-api.fitbit.com iphone-cdn-client.fitbit.com api-v2launch.trakt.tv

toyg 10y ago
> that above statement must be wrong, surely? Either they believe it's right, which means they're not competent enough to really assess the scope of the leak; or they don't believe it, but they went "fuck it, that's the best we can do". In either case, it doesn't really inspire trust in their service.
- blibble 10y ago
  you missed one possibility: that they're deliberately attempting to downplay the severity to make themselves look less incompetent
sikhnerd 10y ago
jgrahamc: can you list which public caches you worked with to attempt to address this? It does not inspire confidence when even google is still showing obvious results
- eastdakota 10y ago
  Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team. I agree it's troubling that Google is taking so long. We were working with them to coordinate disclosure after their caches were cleared. While I am thankful to the Project Zero team for their informing us of the issue quickly, I'm troubled that they went ahead with disclosure before Google crawl team could complete the refresh of their own cache. We have continued to escalate this within Google to get the crawl team to prioritize the clearing of their caches as that is the highest priority remaining remediation step.
  - deleted 10y ago
    [deleted]
  - obituary_latte 10y ago
    >I'm troubled that they went ahead with disclosure before Google crawl team could complete the refresh of their own cache. It sounded like they (cf) were under a lot of pressure to disclose ASAP from project zero and their 7 day requirement...
    - cesarb 10y ago
      eastdakota is one of the cloudflare guys, so "they" in that sentence can only refer to Google (see also the previous paragraph/sentences, where eastdakota used "we" for cloudflare).
      - jgrahamc 10y ago
        He's the CEO
    - Twirrim 10y ago
      With something this drastic, 7 days was generous.
  - taviso 10y ago
    Matthew, with all due respect, you don't know what you're talking about. view-source:http://cc.bingj.com/cache.aspx?q=&d=4857656909960944&w=rj9cgKJZJYOhAbxPoQ4RPcxV_spLZkc2 http://cc.bingj.com/cache.aspx?q=&d=4857656909960944&w=rj9cg... view-source:http://cc.bingj.com/cache.aspx?q=&d=4901023173710126&w=n3mEZSOo0Ye0unl8ctnPq60S3jw6FUOL http://cc.bingj.com/cache.aspx?q=&d=4901023173710126&w=n3mEZ... view-source:http://cc.bingj.com/cache.aspx?q=&d=4558611265887320&w=urwoWdnZYEgZBEywdX8DopbtRj22Loty http://cc.bingj.com/cache.aspx?q=&d=4558611265887320&w=urwoW... view-source:http://cc.bingj.com/cache.aspx?q=&d=4592983872701813&w=GhwddjoJYL0opajOudQpo4_EcD1Bb1tS http://cc.bingj.com/cache.aspx?q=&d=4592983872701813&w=Ghwdd... view-source:http://cc.bingj.com/cache.aspx?q=&d=4997243316273666&w=wdpFHreZbW_ge4UnFi51WMykOFS0jzqW http://cc.bingj.com/cache.aspx?q=&d=4997243316273666&w=wdpFH... Not as simple as you thought?
infinity0 10y ago
Could someone enlighten me on why malloc and free don't automatically zero memory by default? Someone pointed me to MALLOC_PERTURB_ and I've just run a few test programs with it set - including a stage1 GCC compile, which granted may not be the best test - and it really doesn't dent performance by much. (edit: noticeably, at all, in fact) People who prefer extreme performance over prudent security should be the ones forced to mess about with extra settings, anyway.
- Kalium 10y ago
  > Could someone enlighten me on why malloc and free don't automatically zero memory by default? The computational cost of doing so, I suspect.
  - Terr_ 10y ago
    Just like why most filesystems don't zero deleted files.
    - infinity0 10y ago
      Neither of these are good reasons: I already talked about MALLOC_PERTURB_ (man mallopt) in my post and my naive performance tests, and we rarely get bad security holes based on data from deleted files left on filesystems.
      - jackmott 10y ago
        they aren't good reasons now. They were good reasons ~20 years ago. language spec should probably now default to zeroing memory unless you specifically ask it not to....and maybe that should be a verbose option :)
      - kjksf 10y ago
        You asked for a reason, not for a good reason. malloc/free were designed around 1972. That was a time where performance was much more important and security concerns didn't really exists. Modern systems, like Go, do zero-out newly allocated memory because they do consider a bit more security to be more important than a bit more performance. But changing the defaults of malloc/free is not really an option and it would probably break stuff. Especially on Linux, where, I believe, malloc returns uncommitted pages, which increases the perf advantage in some cases. Security conscious programmers can use calloc() or write their own wrappers over malloc/free.
vengefulduck 10y ago
I'm also seeing a ton from cn-dc1.uber.com with oauth, cookies and even geolocation info. https://webcache.googleusercontent.com/search?q=cache:VlVylTZMmhAJ:www.hebeicy.com/supplyinfo/supply_detail.aspx%3Fpid%3D1529&num=1&hl=en&gl=us&strip=0&vwsrc=1 https://webcache.googleusercontent.com/search?q=cache:VlVylT...
- sneak 10y ago
  That's terrifying. Thanks to Uber now requiring location services on Always instead of just when hailing a car, my and others' personal location history even outside of Uber usage could have been compromised. Sweet.
  - jedberg 10y ago
    To be fair, you were kind of a fool if you actually let Uber have your location at all times. As soon as they announced that I blocked Uber from my location. I only allow it when I take an Uber (which is almost never now).
    - ejanus 10y ago
      Not a fool but ...
    - sneak 10y ago
      Sometimes I'm in a rush and forget to turn it back to Never. That doesn't make me a fool, it makes me human. Don't be a jerk. It's a dark pattern for a reason.
      - Dylan16807 10y ago
        If you only sometimes forget, then that's not letting them have your location at all times, and you weren't called a fool.
- Animats 10y ago
  At least the location isn't embarrassing.[1] [1] https://goo.gl/maps/FjQVttcZCpH2 https://goo.gl/maps/FjQVttcZCpH2

toyg 10y ago

> that above statement must be wrong, surely? Either they believe it's right, which means they're not competent enough to really assess the scope of the leak; or they don't believe it, but they went "fuck it, that's the best we can do". In either case, it doesn't really inspire trust in their service.

blibble 10y ago
you missed one possibility: that they're deliberately attempting to downplay the severity to make themselves look less incompetent

sikhnerd 10y ago

jgrahamc: can you list which public caches you worked with to attempt to address this? It does not inspire confidence when even google is still showing obvious results

eastdakota 10y ago
Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team. I agree it's troubling that Google is taking so long. We were working with them to coordinate disclosure after their caches were cleared. While I am thankful to the Project Zero team for their informing us of the issue quickly, I'm troubled that they went ahead with disclosure before Google crawl team could complete the refresh of their own cache. We have continued to escalate this within Google to get the crawl team to prioritize the clearing of their caches as that is the highest priority remaining remediation step.
- deleted 10y ago
  [deleted]
- obituary_latte 10y ago
  >I'm troubled that they went ahead with disclosure before Google crawl team could complete the refresh of their own cache. It sounded like they (cf) were under a lot of pressure to disclose ASAP from project zero and their 7 day requirement...
  - cesarb 10y ago
    eastdakota is one of the cloudflare guys, so "they" in that sentence can only refer to Google (see also the previous paragraph/sentences, where eastdakota used "we" for cloudflare).
    - jgrahamc 10y ago
      He's the CEO
  - Twirrim 10y ago
    With something this drastic, 7 days was generous.
- taviso 10y ago
  Matthew, with all due respect, you don't know what you're talking about. view-source:http://cc.bingj.com/cache.aspx?q=&d=4857656909960944&w=rj9cgKJZJYOhAbxPoQ4RPcxV_spLZkc2 http://cc.bingj.com/cache.aspx?q=&d=4857656909960944&w=rj9cg... view-source:http://cc.bingj.com/cache.aspx?q=&d=4901023173710126&w=n3mEZSOo0Ye0unl8ctnPq60S3jw6FUOL http://cc.bingj.com/cache.aspx?q=&d=4901023173710126&w=n3mEZ... view-source:http://cc.bingj.com/cache.aspx?q=&d=4558611265887320&w=urwoWdnZYEgZBEywdX8DopbtRj22Loty http://cc.bingj.com/cache.aspx?q=&d=4558611265887320&w=urwoW... view-source:http://cc.bingj.com/cache.aspx?q=&d=4592983872701813&w=GhwddjoJYL0opajOudQpo4_EcD1Bb1tS http://cc.bingj.com/cache.aspx?q=&d=4592983872701813&w=Ghwdd... view-source:http://cc.bingj.com/cache.aspx?q=&d=4997243316273666&w=wdpFHreZbW_ge4UnFi51WMykOFS0jzqW http://cc.bingj.com/cache.aspx?q=&d=4997243316273666&w=wdpFH... Not as simple as you thought?

infinity0 10y ago

Could someone enlighten me on why malloc and free don't automatically zero memory by default? Someone pointed me to MALLOC_PERTURB_ and I've just run a few test programs with it set - including a stage1 GCC compile, which granted may not be the best test - and it really doesn't dent performance by much. (edit: noticeably, at all, in fact) People who prefer extreme performance over prudent security should be the ones forced to mess about with extra settings, anyway.

Kalium 10y ago
> Could someone enlighten me on why malloc and free don't automatically zero memory by default? The computational cost of doing so, I suspect.
- Terr_ 10y ago
  Just like why most filesystems don't zero deleted files.
  - infinity0 10y ago
    Neither of these are good reasons: I already talked about MALLOC_PERTURB_ (man mallopt) in my post and my naive performance tests, and we rarely get bad security holes based on data from deleted files left on filesystems.
    - jackmott 10y ago
      they aren't good reasons now. They were good reasons ~20 years ago. language spec should probably now default to zeroing memory unless you specifically ask it not to....and maybe that should be a verbose option :)
    - kjksf 10y ago
      You asked for a reason, not for a good reason. malloc/free were designed around 1972. That was a time where performance was much more important and security concerns didn't really exists. Modern systems, like Go, do zero-out newly allocated memory because they do consider a bit more security to be more important than a bit more performance. But changing the defaults of malloc/free is not really an option and it would probably break stuff. Especially on Linux, where, I believe, malloc returns uncommitted pages, which increases the perf advantage in some cases. Security conscious programmers can use calloc() or write their own wrappers over malloc/free.

vengefulduck 10y ago

I'm also seeing a ton from cn-dc1.uber.com with oauth, cookies and even geolocation info. https://webcache.googleusercontent.com/search?q=cache:VlVylTZMmhAJ:www.hebeicy.com/supplyinfo/supply_detail.aspx%3Fpid%3D1529&num=1&hl=en&gl=us&strip=0&vwsrc=1 https://webcache.googleusercontent.com/search?q=cache:VlVylT...

sneak 10y ago
That's terrifying. Thanks to Uber now requiring location services on Always instead of just when hailing a car, my and others' personal location history even outside of Uber usage could have been compromised. Sweet.
- jedberg 10y ago
  To be fair, you were kind of a fool if you actually let Uber have your location at all times. As soon as they announced that I blocked Uber from my location. I only allow it when I take an Uber (which is almost never now).
  - ejanus 10y ago
    Not a fool but ...
  - sneak 10y ago
    Sometimes I'm in a rush and forget to turn it back to Never. That doesn't make me a fool, it makes me human. Don't be a jerk. It's a dark pattern for a reason.
    - Dylan16807 10y ago
      If you only sometimes forget, then that's not letting them have your location at all times, and you weren't called a fool.
Animats 10y ago
At least the location isn't embarrassing.[1] [1] https://goo.gl/maps/FjQVttcZCpH2 https://goo.gl/maps/FjQVttcZCpH2