Post: #1

A scary looking exploit has been found that affects sites protected by cloudflare ,which is basically 1/3 of the web (does that include rok/rvf?). You can read cloudflare's disclosure here:

https://blog.cloudflare.com/incident-rep...arser-bug/

and a more frank discussion of the exploit here:

https://bugs.chromium.org/p/project-zero...il?id=1139

some highlights from the discussion:

Quote:It became clear after a while we were looking at chunks of uninitialized memory interspersed with valid data. The program that this uninitialized data was coming from just happened to have the data I wanted in memory at the time. That solved the mystery, but some of the nearby memory had strings and objects that really seemed like they could be from a reverse proxy operated by cloudflare - a major cdn service.

Quote: It looked like that if an html page hosted behind cloudflare had a specific combination of unbalanced tags, the proxy would intersperse pages of uninitialized memory into the output (kinda like heartbleed, but cloudflare specific and worse for reasons I'll explain later). My working theory was that this was related to their "ScrapeShield" feature which parses and obfuscates html - but because reverse proxies are shared between customers, it would affect *all* Cloudflare customers

Quote:We fetched a few live samples, and we observed encryption keys, cookies, passwords, chunks of POST data and even HTTPS requests for other major cloudflare-hosted sites from other users.

Quote:We've been trying to help clean up cached pages inadvertently crawled at Google. This is just a bandaid, but we're doing what we can. Cloudflare customers are going to need to decide if they need to rotate secrets and notify their users based on the facts we know.

Quote:We keep finding more sensitive data that we need to cleanup. I didn't realize how much of the internet was sitting behind a Cloudflare CDN until this incident.

Quote:The examples we're finding are so bad, I cancelled some weekend plans to go into the office on Sunday to help build some tools to cleanup. I've informed cloudflare what I'm working on. I'm finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings. We're talking full https requests, client IP addresses, full responses, cookies, passwords, keys, data, everything.

What I get from this is that tons of sites use cloudflare, and your private shit on any of them may have been grabbed. They patched the hole but a lot of it got cached on google and god knows where else. I'm resetting all my passwords, and it looks like any of your private conversations on any cloudflare hosted site could have been leaked by this exploit, scary scary shit. I guess this is why we keep our private conversations outside of the forum.

Post: #2

While troubling, it should go without saying that you should:

1. Never use a real email address for this forum (get a burner).
2. Never share personal info over PM (or if you do delete it immediately)
3. Use a different password for forums and one for your email, banking, etc.

There's very little to be gained by hacking the forum for other than for a troll job.

Post: #3

I didn't read the entire article but it sounds like just standard HTTP clear text data was leaked, and RVF uses HTTPS all the time so I'm not worried any of our data here was leaked. The report says SSL private keys were not compromised.

   

Post: #4

RVF uses a secure certificate. ROK and Rooshv.com does not, but almost no private information is being transmitted. I'll keep an eye out on things.

Post: #5

Never hurts to pre-emptively change your passwords on sites every so many months. This is good security practice in case a hack or leak is made, but the public isn't notified till a lot later. Yahoo, for instance, was hit multiple times, but didn't notify the public until much later. Thanks for the heads up regarding this bug!

Post: #6

(02-24-2017 04:40 PM)DJ-Matt Wrote:  I didn't read the entire article but it sounds like just standard HTTP clear text data was leaked, and RVF uses HTTPS all the time so I'm not worried any of our data here was leaked.

(02-24-2017 07:41 PM)Roosh Wrote:  RVF uses a secure certificate. ROK and Rooshv.com does not, but almost no private information is being transmitted. I'll keep an eye out on things.

https sites are also compromised (ive bolded parts for emphasis):
https://bugs.chromium.org/p/project-zero...il?id=1139

Quote: The examples we're finding are so bad, I cancelled some
weekend plans to go into the office on Sunday to help
build some tools to cleanup. I've informed cloudflare
what I'm working on. I'm finding private messages from
major dating sites, full messages from a well-known
chat service, online password manager data, frames from
adult video sites, hotel bookings. We're talking full
https requests, client IP addresses, full responses,
cookies, passwords, keys, data, everything.

Cloudflare pointed out their bug bounty program, but I
noticed it has a top-tier reward of a t-shirt.

Cloudflare did finally send me a draft. It contains an
excellent postmortem, but severely downplays the risk
to customers.

so this forum is also potentially compromised

everyone on this forum should change their passwords.