- NANOG - lists.nanog.org

Fwd: Serious Cloudflare bug exposed a potpourri of secret customer data
by Rich Kulawiec 03 Mar '17

03 Mar '17

(h/t to Richard Forno) After you're done reading the Ars Technica article excerpted and linked below, you may also want to read: Cloudflare Reverse Proxies Are Dumping Uninitialized Memory https://news.ycombinator.com/item?id=13718752 and, as background: CloudFlare, We Have A Problem http://cryto.net/~joepie91/blog/2016/07/14/cloudflare-we-have-a-problem/ and then perhaps consider this comment from the Ycombinator thread: Where would you even start to address this? Everything you've been serving is potentially compromised, API keys, sessions, personal information, user passwords, the works. You've got no idea what has been leaked. Should you reset all your user passwords, cycle all or your keys, notify all your customers that there data may have been stolen? My second thought after relief was the realization that even as a consumer I'm affected by this, my password manager has > 100 entries what percentage of them are using CloudFlare? Should I change all my passwords? ---rsk ----- Forwarded message from Richard Forno <rforno(a)infowarrior.org> ----- > From: Richard Forno <rforno(a)infowarrior.org> > Date: Fri, 24 Feb 2017 07:30:21 -0500 > To: Infowarrior List <infowarrior(a)attrition.org> > Subject: [Infowarrior] - Serious Cloudflare bug exposed a potpourri of > secret customer data > > Serious Cloudflare bug exposed a potpourri of secret customer data > > Service used by 5.5 million websites may have leaked passwords and authentication tokens. > > Dan Goodin - 2/23/2017, 8:35 PM > > Cloudflare, a service that helps optimize the security and performance of > more than 5.5 million websites, warned customers today that a recently > fixed software bug exposed a range of sensitive information that could > have included passwords, and cookies and tokens used to authenticate > users. > > A combination of factors made the bug particularly severe. First, the > leakage may have been active since September 22, nearly five months > before it was discovered, although the greatest period of impact was > from February 13 and February 18. Second, some of the highly sensitive > data that was leaked was cached by Google and other search engines. The > result was that for the entire time the bug was active, hackers had > the ability to access the data in real-time, by making Web requests > to affected websites, and to access some of the leaked data later by > crafting queries on search engines. > > "The bug was serious because the leaked memory could contain private > information and because it had been cached by search engines," Cloudflare > CTO John Graham-Cumming wrote in a blog post published Thursday. "We > are disclosing this problem now as we are satisfied that search engine > caches have now been cleared of sensitive information. We have also > not discovered any evidence of malicious exploits of the bug or other > reports of its existence." > > The leakage was the result of a bug in an HTML parser chain Cloudflare > uses to modify Web pages as they pass through the service's edge > servers. The parser performs a variety of tasks, such as inserting Google > Analytics tags, converting HTTP links to the more secure HTTPS variety, > obfuscating email addresses, and excluding parts of a page from malicious > Web bots. When the parser was used in combination with three Cloudflare > features???e-mail obfuscation, server-side Cusexcludes, and Automatic > HTTPS Rewrites???it caused Cloudflare edge servers to leak pseudo random > memory contents into certain HTTP responses. > < - > > > https://arstechnica.com/security/2017/02/serious-cloudflare-bug-exposed-a-p… >

4 3

SHA1 collisions proven possisble
by Grant Ridder 02 Mar '17

02 Mar '17

Coworker passed this on to me. Looks like SHA1 hash collisions are now achievable in a reasonable time period https://shattered.io/ -Grant

25 51

Re: Consumer networking head scratcher
by Oliver O'Boyle 02 Mar '17

02 Mar '17

Next --> On March 1, 2017, at 9:31 PM, Ryan Pugatch <rpug(a)lp0.org> wrote: On Wed, Mar 1, 2017, at 09:29 PM, Oliver O'Boyle wrote: Each device associated with the AP consumes memory. Small low-end routers don't typically come with much memory. If you've got a lot of devices associated with the AP you will run out of memory. I'm not sure how many devices you're connecting, though. Three will not cause this problem. 30 might. O. Currently, I have 3 devices connected. :)

5 4

Call for Presentations - CHI-NOG 07 (May 18th)
by Tom Kacprzynski 02 Mar '17

02 Mar '17

CHI-NOG 07 – (Chicago Network Operators Group) May 18th 2017, Chicago, IL The Chicago Network Operators Group (CHI-NOG) is a vendor neutral organization. Our goal is to create a regional community of network professionals by presenting the latest technology trends, enabling collaboration and providing networking opportunities. CHI-NOG will be hosting its seventh annual conference on May 18th, 2017 in downtown Chicago. For more information on the conference please see event’s page (http://chinog.org/meetings/chi-nog-07/) The CHI-NOG Program Committee is seeking proposals for presentations on relevant networking technologies with a focus on the following topics: * Network Automation/ DevOps * Interconnection/Peering * Low Latency Networks/Financial Networks * Network Security * Academic Research in Networking and Related Infrastructure Fields. * Internet Monitoring * Advanced BGP/MPLS Technologies * Optical Networking/Data Center Interconnect * Content Delivery Networks (CDNs) * Software Defined Networking * Cloud Networking Technologies * Network Traffic Engineering * Open Source Networking Tools * Data Center Fabric * Wireless * IPv6 Session Format Each presentation is 30 minutes, which includes a question and answer time. The duration can be extended per individual request to 60 minutes and will be considered by the program committee. Presentations should not contain any marketing material and should avoid discussion of commercial products but rather focus on the underlying technology. Key Dates 3/24/2017 - Presentation Abstract Submission Deadline 3/31/2017 - Abstract Selection 4/15/2017 - Full Presentation Slides Submission Deadline 5/18/2017 - Conference Submission Please submit presentation’s abstract proposal by filling out the submission form at http://chinog.org/meetings/chi-nog-07/abstract-submission/ . Once your presentation is selected please provide the program committee with your photo and a short bio for web publication. All accepted speakers will receive complimentary tickets to the conference. For past presentation please see the archives at http://chinog.org/presentation-archive/. The program committee is looking forward to your submission and attendance.

1 0

Re: Consumer networking head scratcher
by Ryan Pugatch 02 Mar '17

02 Mar '17

On Thu, Mar 2, 2017, at 10:32 AM, Dann Schuler wrote: > Just a quick sanity check here since I know we can occasionally overlook > the simple things. You have updated the firmware to the latest available > version correct? Have you checked for any odd services like QoS, > parental controls or an IDS? Have you tried wiping it to factory default > and reconfiguring it? > > What happens if you give the affected machine a new IP? Could it be some > service on the device affecting that specific IP? > Yes, I've done all of these. It was running the latest version of code and I even tried rolling back. Disabled SPI firewalls, ipv6, verified QoS and parental controls are off, etc. The issue impacts multiple device so doesn't appear specific to one IP. Thanks

1 0

Consumer networking head scratcher
by Ryan Pugatch 02 Mar '17

02 Mar '17

Hi everyone, I've got a real head scratcher that I have come across after replacing the router on my home network. I thought I'd share because it is a fascinating issue to me. At random times, my Windows machines (Win 7 and Win 10, attached to the network via WiFi, 5GHz) lose connectivity to the Internet. They can continue to access internal resources, such as the router's admin interface. Other devices including Macs, iPhones, Android phones, and Rokus never have this issue. I realized that on the Windows machines, when the connection drops, if I run a traceroute, it dies at a certain hop every time (out in Comcast's network, who is my ISP) even though a Mac sitting right next to it is able to go all the way through to the destination. The even stranger thing I discovered last night is that if I trace to the hop before the hop that it dies at, it then dies at the hop before that (and as I trace to closer and closer hops, it dies the hop before that!) This is illustrated in the traces I've captured here: http://pastebin.com/raw/R1UHLi0U For what it's worth, the router is a Linksys EA7300 that I just picked up. I can't even imagine what would cause this issue at this point. If anyone has any thoughts, I'd love to hear them! I'm going to start studying some packet captures to see if I can spot an issue. Best, Ryan

9 13

Re: Consumer networking head scratcher
by Ryan Pugatch 02 Mar '17

02 Mar '17

On Wed, Mar 1, 2017, at 06:35 PM, Jean-Francois Mezei wrote: > On 2017-03-01 11:28, Ryan Pugatch wrote: > > > At random times, my Windows machines (Win 7 and Win 10, attached to the > > network via WiFi, 5GHz) lose connectivity to the Internet. > > > For what it's worth, the router is a Linksys EA7300 that I just picked > > up. > > > Way back when, I have a netgear router. It ended having a limit on its > NAT translation table, and when I had too many connections going at same > time (or not yet timed out), I would lose connection. There was an > unofficial patch to the firmware (litterally a patch in code that > defined table size) to increase that table to 1000- as I recall. > > Does the Linksys have a means to display the NAT translation table and > see if maybe connections are lost when that table is full and lots of > connections have not yet timed out ? > It doesn't seem to provide visibility into the NAT tables. However, I'm starting to think you might be on to something. The issue actually happened to my Mac tonight, and sure enough the traceroute dies at the same time. So, it isn't just the Windows machines impacted. I did a packet capture on my end, and on a server somewhere that I control and sent pings from my laptop to the server. The server received my ICMP packets and responded, but those responses never made it back to my laptop. Meanwhile, my Roku is actively streaming from the Internet, so it's not like the Internet was down.

2 2

Re: Consumer networking head scratcher
by Ryan Pugatch 01 Mar '17

01 Mar '17

On Wed, Mar 1, 2017, at 03:58 PM, iamzam(a)gmail.com wrote: > On many non-windows OS (Mac OSX, Linux, FreeBSD etc.) you can specify > ICMP > traceroute using -I: > > traceroute -I google.com > > I wonder if this would replicate your experience with Windows tracert Definitely on my list to test. Thanks.

1 0

IRR database for local usage
by Nagarjun Govindraj 01 Mar '17

01 Mar '17

Hi nanog, Is it possible to maintian an IRR database locally for quering route objects from various RIR's and do a regular sync like what RPKI validator does for ROA's. - Nagarjun

3 2

Research project and survey: Network filtering and IP spoofing
by Franziska Lichtblau 01 Mar '17

01 Mar '17

Hi, we are a team of researchers from TU Berlin [1] working on a measurement project to assess the ramifications of traffic with spoofed source IP addresses in the Internet. To better understand the operational challenges that you as network operators face when deploying (or not deploying) source IP address filtering techniques, we'd like to invite you to participate in our survey. If you could spare 5 minutes of your time, we'd be delighted if you could fill out our survey form and tell us about your current practices regarding network filtering. To participate, please visit: [2] http://filteringsurvey.inet.tu-berlin.de/ If you have any concerns or questions, you can reply on-list or contact us via [3] filtering-survey(a)inet.tu-berlin.de. We will only publish anonymized results of this study and once we've analyzed your feedback we'll publish a digest of the results on-list if you're interested. As you are probably subscribed to more network operator lists you might encounter this mail multiple times. We apologize for cross-posting, but in order to get results that will give us meaningful insights we need the widest coverage we can get. Thank you very much for your support! Franziska Lichtblau [1] www.inet.tu-berlin.de [2] http://filteringsurvey.inet.tu-berlin.de/ [3] filtering-survey(a)inet.tu-berlin.de -- Franziska Lichtblau, M.A. building MAR, 4th floor, room 4.004 Fachgebiet INET - Sekr. MAR 4-4 phone: +49 30 314 757 33 Technische Universität Berlin gpg-fp: 4FA0 F1BC 8B9A 7F64 797C Marchstrasse 23 - 10587 Berlin 221C C6C6 2786 91EC 5CD5

1 0