4 ms·

Does Cloudflare have complete logs to rule out that someone noticed this before taviso and used it to massively exfiltrate data by visiting one of the vulnerabl

by mhils 10y ago

Does Cloudflare have complete logs to rule out that someone noticed this before taviso and used it to massively exfiltrate data by visiting one of the vulnerable sites repeatedly? If they can't tell, someone may now be sitting on a lot of very juicy data, far beyond what may be left in these caches.

cjbprime 10y ago
I haven't seen an attempt by Cloudflare at claiming that this definitely didn't happen. They may still be working on it. It's possible that the question is basically unanswerable even with logs. As you say, in the presence of uncertainty it's most prudent to assume that this actually happened.
- int_19h 10y ago
  They seem to be presenting some dubious calculations made to imply that it was highly unlikely to happen. The reason why I consider them dubious is that anyone simply searching the name of some HTTP headers in Google et all could have stumbled into this. I don't find it at all unlikely to happen in a timespan of 5 months.
  - Lazare 10y ago
    The odds that Google had the first team of researchers to trip over the bug is low. But we know that they were the first team to disclose the vulnerability, and the only reason not to disclose it is if you wanted to exploit it. So the key question really isn't "how likely was someone to find this", but "how likely is it that Project Zero was the first". I think it's hard to estimate odds, but I'd be surprised if it was even as high as 50%; there's too many teams, individuals, freelancers, state actors, etc. actively engaged in looking for this kind of thing.
    - true_religion 10y ago
      Many people probably tripped over the bug but didn't know what it was. The data it reveals isn't guaranteed to be obviously private and exploitable. It can just look like a valid but useless response, or a invalid and corrupted response depending on what you were looking for in the first place.
- tazjin 10y ago
  At this point we can mostly disregard what they claim did or did not happen, considering that they also claimed that all leaked memory had been purged from search engine caches.
talklittle 10y ago
> by visiting one of the vulnerable sites repeatedly I mean, how could CloudFlare, or anyone, possibly differentiate this from normal scraping/polling/ manual F5 refresh behavior? This sounds like a PhD thesis. I guess you are asking CloudFlare to quantify the amount of distinct bytes of unauthorized data sent to any particular user agent? But then, any sophisticated attacker would rotate IPs, UA identifiers, and probably even between vulnerable websites, if they had known about this vulnerability. I don't think it's reasonably possible to rule this out, even with a massive dedication of investigative resources. Like the other commenter said, it's wisest to assume it happened.
- Rapzid 10y ago
  It should be possible to show statistical significance in access pattern changes from before, during, and after the window to the sites that were leaking data.
  - edraferi 10y ago
    Yeah, particularly because the specific HTML that causes the problem is known. If you have perfect information about what resources were requested when, you can look for a spike in queries for vulnerable resources. Once you see that, you know there was an intentional exploit and can start to look at who drove that spike, what was leaked, etc. The problem is that we're talking about l huge amounts of data. I'm skeptical that CF has lots of sufficient length and detail to conduct this analysis, but have no real knowledge about their forensic capabilities.
    - shawnz 10y ago
      But the specific HTML that causes the problem is a common error that can be seen on plenty of pages, and the window which the vulnerability was active for was huge. How could you know that someone is intentionally using that erroring page to exploit the vulnerability?
kakarot 10y ago
We should just assume that all entities with both the resources and motivation to discover and exploit massive security vulnerabilities now have a database of every object in their NGNIX modules' memory since the leak sprung roughly 4 months ago. Right now they'll be querying for political blackmail and insider material, then they will turn to Joe Schmoe who only gets his news from the television, where no doubt this will never be discussed. They will effortlessly and listlessly categorize the data largely as an automated process. If we expect anything less, it's possible we are underestimating our adversaries. Better to overestimate them and feel embarrassed later when you later find out you were just being paranoid.

by mhils 10y ago

cjbprime 10y ago

I haven't seen an attempt by Cloudflare at claiming that this definitely didn't happen. They may still be working on it. It's possible that the question is basically unanswerable even with logs. As you say, in the presence of uncertainty it's most prudent to assume that this actually happened.

int_19h 10y ago
They seem to be presenting some dubious calculations made to imply that it was highly unlikely to happen. The reason why I consider them dubious is that anyone simply searching the name of some HTTP headers in Google et all could have stumbled into this. I don't find it at all unlikely to happen in a timespan of 5 months.
- Lazare 10y ago
  The odds that Google had the first team of researchers to trip over the bug is low. But we know that they were the first team to disclose the vulnerability, and the only reason not to disclose it is if you wanted to exploit it. So the key question really isn't "how likely was someone to find this", but "how likely is it that Project Zero was the first". I think it's hard to estimate odds, but I'd be surprised if it was even as high as 50%; there's too many teams, individuals, freelancers, state actors, etc. actively engaged in looking for this kind of thing.
  - true_religion 10y ago
    Many people probably tripped over the bug but didn't know what it was. The data it reveals isn't guaranteed to be obviously private and exploitable. It can just look like a valid but useless response, or a invalid and corrupted response depending on what you were looking for in the first place.
tazjin 10y ago
At this point we can mostly disregard what they claim did or did not happen, considering that they also claimed that all leaked memory had been purged from search engine caches.

talklittle 10y ago

> by visiting one of the vulnerable sites repeatedly I mean, how could CloudFlare, or anyone, possibly differentiate this from normal scraping/polling/ manual F5 refresh behavior? This sounds like a PhD thesis. I guess you are asking CloudFlare to quantify the amount of distinct bytes of unauthorized data sent to any particular user agent? But then, any sophisticated attacker would rotate IPs, UA identifiers, and probably even between vulnerable websites, if they had known about this vulnerability. I don't think it's reasonably possible to rule this out, even with a massive dedication of investigative resources. Like the other commenter said, it's wisest to assume it happened.

Rapzid 10y ago
It should be possible to show statistical significance in access pattern changes from before, during, and after the window to the sites that were leaking data.
- edraferi 10y ago
  Yeah, particularly because the specific HTML that causes the problem is known. If you have perfect information about what resources were requested when, you can look for a spike in queries for vulnerable resources. Once you see that, you know there was an intentional exploit and can start to look at who drove that spike, what was leaked, etc. The problem is that we're talking about l huge amounts of data. I'm skeptical that CF has lots of sufficient length and detail to conduct this analysis, but have no real knowledge about their forensic capabilities.
  - shawnz 10y ago
    But the specific HTML that causes the problem is a common error that can be seen on plenty of pages, and the window which the vulnerability was active for was huge. How could you know that someone is intentionally using that erroring page to exploit the vulnerability?

kakarot 10y ago

We should just assume that all entities with both the resources and motivation to discover and exploit massive security vulnerabilities now have a database of every object in their NGNIX modules' memory since the leak sprung roughly 4 months ago. Right now they'll be querying for political blackmail and insider material, then they will turn to Joe Schmoe who only gets his news from the television, where no doubt this will never be discussed. They will effortlessly and listlessly categorize the data largely as an automated process. If we expect anything less, it's possible we are underestimating our adversaries. Better to overestimate them and feel embarrassed later when you later find out you were just being paranoid.