Cloudflare

Cloudflare Patches Bug That Leaked Data From Uber, Fitbit And Others

... your web or app request would go through Cloudflare’s servers in Singapore versus contacting Uber’s servers in the United States directly. What Travis found is that secure requests through Cloudflare’s network were corrupted, making user details, including passwords, publicly available. Even more disturbingly, the details were made so available that the data was cached by Google and other search engines. Cloudflare is downplaying the incident, saying that despite the fact that data was cached by Google and others, the data was only available in “some unusual circumstances.”. The company blamed the security issue on three minor Cloudflare features that were using the same HTML parser chain that was causing the leakage: email obfuscation, server-side excludes, and automatic HTTPS rewrites. Although the good ...

The Recently Discovered Cloudflare Bug Could Affect Bitcoin Users

... , a company that many bitcoin companies use for Do S protection and other services. The severity of the bug is considered very bad, and security credentials for many bitcoin accounts should be changed. The Bitcoin Exchange Thefts You May Have Forgotten. Cloudbleed Vulnerability May Affect Bitcoin Users. The Cloudflare system has reportedly been leaking significant amounts of uninitialized memory which could contain sensitive data, including two-factor authentication (2 FA) secrets and passwords.  According to many reports including the person who found the bug, this may have been happening for months, and the data may have been spraying onto the open web. The leak could possibly lead to people’s accounts being compromised on many bitcoin websites and services. Bitcoin websites that could be affected include Coinbase, Localbitcoins, Poloniex, Kraken, Bitfinex, Bittrex, Bitstamp, Reddit, and many more. Many people in the bitcoin community are warning others to reset their 2 FAs and change passwords immediately. Alongside this, bitcoin companies who may have been affected are ...

F5 Networks Gear Found To Contain Ssl Bug By Cloudflare Engineers

... which can help test for the vulnerability. Is your organisation affected by this? Let us know in the comments. A researcher has discovered an SSL bug affecting Big-IP appliances from F 5 Networks and dubbed it “Ticketbleed” for its similarities to the 2014  Heartbleed  bug. According to  Cloudflare's Filippo Valsorda, the bug strikes when virtual servers running on Big-IP appliances are configured with a Client SSL profile that has the non-default Session Tickets option enabled. The server can be tricked into leaking 31 bytes of memory at a time. Internet scans conducted by the researcher showed that 949 of the Alexa top one million websites were vulnerable, including 15 in the top 10,000 sites. Of the top one million hosts on Cisco's Umbrella cloud security platform, over 1,600 were found to be affected. Valsorda claims he and a colleague discovered the bug while trying to resolve a Cloudflare customer issue with Session Tickets, to try and resolve what looked like an incompatibility between F 5 TLS and Go TLS. The researcher  said  that after collecting a number of stack traces: “It looks like the client offers a Session Ticket, the server accepts it, but ...

The Pirate Bay Blocked By Congent, Cloudflare Puts Pirate Sites On New Ip Addresses To Avoid Block

... order which required the company to block access to one or more websites, which remain unknown. The real target was accessible through the IP-addresses 104.31.18.30 and 104.31.19.30. Cloud Flare is the hero again. Like every time, Cloudflare emerged as the hero for the torrent websites. As soon as the Cogent block was announced it moved most of the affected sites to a new location, effectively unblocking them. If the Cogent action was against a different target, The Pirate Bay and other torrent websites don’t have to worry about the block for now. “As a company, Cloudflare believes strongly in an open, free, and secure Internet. And it is also our policy to fully comply with the legitimate court process, This can be challenging at times, especially when courts target backbone providers and don’t understand fully how they work. Cloudflare takes steps to make sure those court orders don’t lead to unintended ...

Cloudflare Makes Online Ads 5x Faster, Safer With Firebolt

... When ad blockers are used, or even when the ads are loaded slowly and users simply leave the page, advertisers and publishers lose out on crucial impressions. Cloudflare’s Firebolt fixes these problems to benefit publishers, advertisers, and end users by making ads load faster, serving them over secure connections, and verifying that they are malware-free. “Slow, malware-ridden ads drive end users to install ad blockers, and unfortunately, that means publishers lose the ability to make money off broadly accessible content,” explained Matthew Prince, co-founder and CEO of Cloudflare. “Cloudflare's Firebolt addresses the end user concerns of slow, unsafe online advertising , helping ensure that publishers can get paid for their content while still making it available to the broad Internet.”. Key features include. Faster Ad Load Times: Cloudflare's global network of 102 data centers in 50 countries, combined with routing and performance technologies, makes the delivery of online ads to any device up to six times faster. Increased Security: Firebolt takes an in-depth approach to preventing the spread of malvertising ...

A Court Order Blocked Pirate Sites That Weren’t Supposed To Be Blocked

... were being blocked by Cogent Communications, an Internet backbone provider. The block had been in place for more than a week and appeared to “appl[y] to the company’s entire global network,” affecting customers of ISPs "from all over the world" that send traffic through Cogent. Though most Internet users were unaffected, anyone "attempting to pass requests through Cogent’s network are unable to access [the sites]," the article said. Cogent CEO Dave Schaeffer yesterday confirmed to Ars that the company is complying with a court order issued recently in Spain. But The Pirate Bay was not the subject of the court order, Schaeffer also confirmed. Schaeffer would not say which site or sites the order was intended to block, but the incident demonstrates how court orders to block websites can have unintended effects. (We have not been able to track down the specific court order at this time.). The Pirate Bay is a customer of Cloudflare, which operates a global network that improves performance of websites and protects them from DDo S attacks and other security threats. That means when Internet users try to reach __link__, their queries are ...

Password Management Made Easy As News Of Cloudflare Leak Surfaces

... them several times a day. For those who aren't familiar, a password manager is software that acts as a storage area for all your login credentials and passwords. They're great because they free you from having to remember your username, password, and other information. They often also provide additional functionality like password generation, secure form fills, and the facility to have a shared folder for passwords you may want to share with trusted friends—like your Wi-Fi password or shared business accounts. Many great open source password managers are available, such as Kee Pass X , Padlock , and Passbolt. Choosing a password. Now, like a toothbrush, simply using a password manager isn't enough. You need toothpaste. Something that cleans, fluorides, and gives you nice breath. In this case, that means a ...

This Week's Top Stories

... summarized their key findings earlier this week. New Cross-Browser Fingerprinting Method Enables More Pervasive Tracking. A pair of researchers from Leigh University in Pennsylvania have developed a new cross-browser fingerprinting method. Cross-browser fingerprinting is the act of uniquely identifying you via your web browser by comparing a large set of features and settings. Usually the combination of operating system, fonts, extensions, and other features creates a unique profile known as a “fingerprint.”. Browser fingerprinting can be used to track your activity across websites. It is a method regularly used to target you with tailored advertising. People who wanted to preserve some anonymity could split up their activity by browser. For instance, keep all personal browsing to Chrome and all work-related browsing to Firefox. What sets this new cross-browser fingerprinting method apart is that it identifies your computer, not your browser, which defeats this compartmentalization. Using Java Script, this cross-browser fingerprinting method tests how your computer renders 3 D graphics through the Web GL ...

Cloudflare Puts Pirate Sites On New Ip Addresses, Avoids Cogent Blockade

... Bay. As a result of this action, people from all over the world were unable to get to their favorite download or streaming portals. The blocking intervention is quite controversial, not least because the IP-addresses in question don’t belong to the sites themselves, but to the popular CDN provider Cloudflare. While Cloudflare hasn’t publicly commented on the issue yet, it now appears to have taken countermeasures. A little while ago the company moved The Pirate Bay and many other sites such as Primewire, __link__, and Torrentz.cd to a new set of IP-addresses. As of yesterday, the sites in question have been assigned the IP-addresses 104.31.16.3 and 104.31.17.3, still grouped together. Most, if not all of the sites, are blocked by court order in the UK so this is presumably done to prevent ISP overblocking of ‘regular’ Cloudflare subscribers. TPB accessible on the new Cloudflare IP-address. Since Cogent hasn’t blackholed the new addresses, yet, the ...