6 ms·

Are you guys planning to release the list so we can all change our passwords on affected services? Or are you planning on letting those services handle the comm

by wilde 10y ago

Are you guys planning to release the list so we can all change our passwords on affected services? Or are you planning on letting those services handle the communication?

tlrobinson 10y ago
If I'm understanding correctly, that list would include not only the 3,438 domains with content that triggered the bug, but every Cloudflare customer between 2016-09-22 and 2017-02-18.
- Xorlev 10y ago
  Can we trust it was only those domains?
  - gog 10y ago
    Not really. If a site is using Cloudflare protection for only some of their subdomains they do not show on this list even if the site itself is in the alexa top 10k sites. And of course all other sites that are not in alexa 10k are not in this list (if they are not on some other lists used, you can see the source of lists in the README of the Github repo).
- dbmnt 10y ago
  No. Only Cloudflare customers using a subset of features of the SSL proxy service are impacted. Cloudflare has a lot of customers who only use the free DNS service, for example.
  - tptacek 10y ago
    Careful. It appears that any Cloudflare client who was sending HTTP/S traffic through their proxies is affected. A small subset of their customers had the specific problem that triggered the bug, but once triggered, the bug disclosed secrets from all their web customers. You're not exposed if you never sent traffic through their proxies; for instance, if you somehow only used them for DNS.
    - dbmnt 10y ago
      I suspect there are a large number of Cloudflare customers that only use their DNS. I have a couple of domains in this category. The DNS service is essentially free. It's an upgrade from most registrars' built-in DNS. It's a pretty robust solution, really -- global footprint, DNSSEC, fully working IPv6, etc. My point is, the actual number of impacted customers was much smaller than the entire set of Cloudflare customers. There are lists in this thread that still reference hundreds of thousands (millions?) of sites, and that's just wrong. (I agree on your first point though; I was confused about the nature of the proxy bug at first).
pepve 10y ago
That list contains domains where the bug was triggered. The information exposed through the bug though can be from any domain that uses Cloudflare. So: all services that have one or more domains served through Cloudflare may be affected. The consensus seem to be that no one discovered this before now, and no bad guys have been scraping this leak for valuable data (passwords, OAuth tokens, PII, other secrets). But the data still was saved all over the world in web caches. So the bad guys are now probably after those. Though I don't know how much 'useful' data they would be able to extract, and what the risks for an average internet user are.
- jimmaswell 10y ago
  Myself and 4 other people I know all happened to get their reddit accounts temporarily locked due to a "possible compromise" in the past week or so, which has never happened to any of us before. Anyone else?
  - mirimir 10y ago
    My reddit password failed a week ago, and I had to do an email reset. And I use a password manager.
    - jimmaswell 10y ago
      In that case I'm even more inclined to think it might be because of Cloudbleed.
  - gooeyblob 10y ago
    That would be unrelated to this. We haven't taken any action on any accounts because of this issue and have no plans to, as we (reddit.com) were unaffected.
    - rand77763 10y ago
      Happened to me as well. If it's not related to CloudBleed, can you tell us specifically what happened? It's making me not trust Reddit.
nikisweeting 10y ago
I've compiled a list of 7,385,121 domains that use Cloudflare here: https://github.com/pirate/sites-using-cloudflare https://github.com/pirate/sites-using-cloudflare
- nikisweeting 10y ago
  (whoops forgot to remove dupes, it's only 4,287,625) https://github.com/pirate/sites-using-cloudflare/raw/master/sorted_unique.zip https://github.com/pirate/sites-using-cloudflare/raw/master/...
- dbmnt 10y ago
  This list is misguided. It's just a dump of sites using Cloudflare's DNS, a hugely popular and (mostly) free service. The vulnerability only affected customers using Cloudflare's paid SSL proxy (CDN) service. The latter is a much smaller subset. Even then, only a subset of the SSL proxy users, those with certain options enabled that caused traffic to go through a vulnerable parser, were really impacted. I'm not sure a list as broad as this is helpful.
  - aidos 10y ago
    At least some of this is incorrect. The issue is NOT the pages running through the parser — the issue is the traffic running through the same nginx instance as vulnerable pages.
    - asdfaoeu 10y ago
      You are right in that other sites are affected but only the sites running through the parser would have leaked content in their cached pages.
  - ThePhysicist 10y ago
    This is not correct in my understanding: The sites with certain options enabled produced the erroneous behavior, but the data that would get leaked through this behavior could be from any site that uses Cloudflare SSL (as this requires Cloudflare to tunnel SSL traffic through their servers, decrypt it and re-encrypt it with their wildcard certificate). So if I understand correctly anyone using the (free) Cloudflare SSL service in combination with their DNS is affected.

by wilde 10y ago

Are you guys planning to release the list so we can all change our passwords on affected services? Or are you planning on letting those services handle the communication?

tlrobinson 10y ago

If I'm understanding correctly, that list would include not only the 3,438 domains with content that triggered the bug, but every Cloudflare customer between 2016-09-22 and 2017-02-18.

Xorlev 10y ago
Can we trust it was only those domains?
- gog 10y ago
  Not really. If a site is using Cloudflare protection for only some of their subdomains they do not show on this list even if the site itself is in the alexa top 10k sites. And of course all other sites that are not in alexa 10k are not in this list (if they are not on some other lists used, you can see the source of lists in the README of the Github repo).
dbmnt 10y ago
No. Only Cloudflare customers using a subset of features of the SSL proxy service are impacted. Cloudflare has a lot of customers who only use the free DNS service, for example.
- tptacek 10y ago
  Careful. It appears that any Cloudflare client who was sending HTTP/S traffic through their proxies is affected. A small subset of their customers had the specific problem that triggered the bug, but once triggered, the bug disclosed secrets from all their web customers. You're not exposed if you never sent traffic through their proxies; for instance, if you somehow only used them for DNS.
  - dbmnt 10y ago
    I suspect there are a large number of Cloudflare customers that only use their DNS. I have a couple of domains in this category. The DNS service is essentially free. It's an upgrade from most registrars' built-in DNS. It's a pretty robust solution, really -- global footprint, DNSSEC, fully working IPv6, etc. My point is, the actual number of impacted customers was much smaller than the entire set of Cloudflare customers. There are lists in this thread that still reference hundreds of thousands (millions?) of sites, and that's just wrong. (I agree on your first point though; I was confused about the nature of the proxy bug at first).

pepve 10y ago

That list contains domains where the bug was triggered. The information exposed through the bug though can be from any domain that uses Cloudflare. So: all services that have one or more domains served through Cloudflare may be affected. The consensus seem to be that no one discovered this before now, and no bad guys have been scraping this leak for valuable data (passwords, OAuth tokens, PII, other secrets). But the data still was saved all over the world in web caches. So the bad guys are now probably after those. Though I don't know how much 'useful' data they would be able to extract, and what the risks for an average internet user are.

jimmaswell 10y ago
Myself and 4 other people I know all happened to get their reddit accounts temporarily locked due to a "possible compromise" in the past week or so, which has never happened to any of us before. Anyone else?
- mirimir 10y ago
  My reddit password failed a week ago, and I had to do an email reset. And I use a password manager.
  - jimmaswell 10y ago
    In that case I'm even more inclined to think it might be because of Cloudbleed.
- gooeyblob 10y ago
  That would be unrelated to this. We haven't taken any action on any accounts because of this issue and have no plans to, as we (reddit.com) were unaffected.
  - rand77763 10y ago
    Happened to me as well. If it's not related to CloudBleed, can you tell us specifically what happened? It's making me not trust Reddit.

nikisweeting 10y ago

I've compiled a list of 7,385,121 domains that use Cloudflare here: https://github.com/pirate/sites-using-cloudflare https://github.com/pirate/sites-using-cloudflare

nikisweeting 10y ago
(whoops forgot to remove dupes, it's only 4,287,625) https://github.com/pirate/sites-using-cloudflare/raw/master/sorted_unique.zip https://github.com/pirate/sites-using-cloudflare/raw/master/...
dbmnt 10y ago
This list is misguided. It's just a dump of sites using Cloudflare's DNS, a hugely popular and (mostly) free service. The vulnerability only affected customers using Cloudflare's paid SSL proxy (CDN) service. The latter is a much smaller subset. Even then, only a subset of the SSL proxy users, those with certain options enabled that caused traffic to go through a vulnerable parser, were really impacted. I'm not sure a list as broad as this is helpful.
- aidos 10y ago
  At least some of this is incorrect. The issue is NOT the pages running through the parser — the issue is the traffic running through the same nginx instance as vulnerable pages.
  - asdfaoeu 10y ago
    You are right in that other sites are affected but only the sites running through the parser would have leaked content in their cached pages.
- ThePhysicist 10y ago
  This is not correct in my understanding: The sites with certain options enabled produced the erroneous behavior, but the data that would get leaked through this behavior could be from any site that uses Cloudflare SSL (as this requires Cloudflare to tunnel SSL traffic through their servers, decrypt it and re-encrypt it with their wildcard certificate). So if I understand correctly anyone using the (free) Cloudflare SSL service in combination with their DNS is affected.