INFRA
INFRA
INFRA
Cloudflare patches bug that leaked data from Uber, Fitbit and others
Content delivery network provider Cloudflare Inc. has patched a software bug that exposed sensitive information including passwords, cookies and tokens used to authenticate users from the websites of its 5.5 million users, including those of Uber Technologies Inc., OK Cupid and Fitbit Inc.
The discovery of the security flaw was first made by Google Project Zero security researcher Tavis Ormandy last week, and involved a flaw that is believed to have dated back to September that involved corrupted web pages being returned by some HTTP requests run through Cloudflare.
“I’m finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings,” Ormandy wrote. “We’re talking full HTTPS requests, client IP addresses, full responses, cookies, passwords, keys, data, everything.”
Cloudflare operates as a CDN, a system of distributed servers that delivers web pages and other web content to a user based on geographic location. It’s used by companies to distribute their services across the globe. For example, if you’re in Southeast Asia and contacting Uber your web or app request would go through Cloudflare’s servers in Singapore versus contacting Uber’s servers in the United States directly.
What Travis found is that secure requests through Cloudflare’s network were corrupted, making user details, including passwords, publicly available. Even more disturbingly, the details were made so available that the data was cached by Google and other search engines.
Cloudflare is downplaying the incident, saying that despite the fact that data was cached by Google and others, the data was only available in “some unusual circumstances.”
The company blamed the security issue on three minor Cloudflare features that were using the same HTML parser chain that was causing the leakage: email obfuscation, server-side excludes, and automatic HTTPS rewrites.
Although the good news is that Cloudflare has now patched their service, the extent of leaked data is of deep concern to some. Privacy New Online called it the “worst privacy leak in recent Internet history.”
Image: wongo888/Flickr
Since you’re here …
… We’d like to tell you about our mission and how you can help us fulfill it. SiliconANGLE Media Inc.’s business model is based on the intrinsic value of the content, not advertising. Unlike many online publications, we don’t have a paywall or run banner advertising, because we want to keep our journalism open, without influence or the need to chase traffic.The journalism, reporting and commentary on SiliconANGLE — along with live, unscripted video from our Silicon Valley studio and globe-trotting video teams at theCUBE — take a lot of hard work, time and money. Keeping the quality high requires the support of sponsors who are aligned with our vision of ad-free journalism content.
If you like the reporting, video interviews and other ad-free content here, please take a moment to check out a sample of the video content supported by our sponsors, tweet your support, and keep coming back to SiliconANGLE.
