winthan Posted February 24, 2017 Share Posted February 24, 2017 (edited) There is an incident report on memory leak caused by Cloudfare.Between 2016-09-22 - 2017-02-18 passwords, private messages, API keys, and other sensitive data were leaked by Cloudflare to random requesters. Data was cached by search engines, and may have been collected by random adversaries over the past few months. In order to prevent the leaks of your information from any sites, please reset your passwords from sites which use CloudFlare. For XRP Wallets users on Gatehub, please reset the password on Gatehub too as well. Actually, all sites which are with Cloudfare should ask all of the clients to purge all session tokens and revoke authentication tokens (i.e. forcibly log everyone out). Those sites should also ask their clients to reset all passwords of active users during the above period where two-factor authentication is not enabled and a secure password reset mechanism (e.g. not sending the password through email through MTAs which don't support TLS) is available. Edited February 24, 2017 by winthan karlos, T8493, anotherscott and 5 others 8 Link to comment Share on other sites More sharing options...
T8493 Posted February 24, 2017 Share Posted February 24, 2017 https://techcrunch.com/2017/02/23/major-cloudflare-bug-leaked-sensitive-data-from-customers-websites/ Hodor and Ant 2 Link to comment Share on other sites More sharing options...
Guest Posted February 24, 2017 Share Posted February 24, 2017 thanks for this Link to comment Share on other sites More sharing options...
mulder Posted February 24, 2017 Share Posted February 24, 2017 change passwort also on kraken Link to comment Share on other sites More sharing options...
Guest Posted February 24, 2017 Share Posted February 24, 2017 this forum? Link to comment Share on other sites More sharing options...
T8493 Posted February 24, 2017 Share Posted February 24, 2017 From kraken: Quote A bug was recently discovered with Cloudflare, which Kraken and many other websites use for DoS protection and other services. Due to the nature of the bug, we recommend as a precaution that you change your Kraken security credentials: Change your password Change your two-factor authentication (remove and re-enable it) Clients who use API keys should generate a new set of keys You should similarly change your security credentials for other websites that use Cloudflare (see link below for a list of possibly affected sites). If you are using the same password for multiple sites, you should change this immediately so that you have a unique password for each site. And you should enable two-factor authentication for every site that supports it. The Cloudflare bug has now been fixed, but it caused sensitive data like passwords to be leaked during a very small percentage of HTTP requests. The peak period of leakage is thought to have occurred between Feb 13 and Feb 18 when about 0.00003% of HTTP requests were affected. Although the rate of leakage was low, the information that might have been leaked could be very sensitive, so it’s important that you take appropriate precautions to protect yourself. The problem is thought to have only started 6 months ago and 2FA or API keys generated before that time are probably not affected, but we recommend changing them anyway because the bug existed for years. Here are some links for further reading on the Cloudflare bug: TechCrunch article: https://techcrunch.com/2017/02/23/major-cloudflare-bug-leaked-sensitive-data-from-customers-websites/ List of sites possibly affected by the bug: https://github.com/pirate/sites-using-cloudflare/blob/master/README.md If you have any questions or concerns in response to this email, please contact Kraken support at: https://support.kraken.com/hc/requests/new Thank you for choosing Kraken, the trusted and secure digital assets exchange. The Kraken Team winthan 1 Link to comment Share on other sites More sharing options...
winthan Posted February 24, 2017 Author Share Posted February 24, 2017 4 minutes ago, T8493 said: From kraken: I think, @gatehub @enej should email blast for customers as well. T8493 1 Link to comment Share on other sites More sharing options...
T8493 Posted February 24, 2017 Share Posted February 24, 2017 1 minute ago, zerpdigger said: this forum? It looks like it doesn't use CloudFlare. Link to comment Share on other sites More sharing options...
kanaas Posted February 24, 2017 Share Posted February 24, 2017 list of affected sites T8493 1 Link to comment Share on other sites More sharing options...
kanaas Posted February 24, 2017 Share Posted February 24, 2017 Also, a list of some [iOS apps](https://www.nowsecure.com/blog/2017/02/23/cloudflare-cloudbleed-bugs-impact-mobile-apps) that *may* have been affected. ## Notable Sites - authy.com - coinbase.com - betterment.com - transferwise.com - prosper.com - digitalocean.com - patreon.com - bitpay.com - news.ycombinator.com - producthunt.com - medium.com - 4chan.org - yelp.com - okcupid.com - zendesk.com - uber.com - namecheap.com ([not affected](https://status.namecheap.com/archives/30660)) - poloniex.com - localbitcoins.com - kraken.com - 23andme.com - curse.com (and some other Curse sites like minecraftforum.net) - counsyl.com - tfl.gov.uk Link to comment Share on other sites More sharing options...
winthan Posted February 24, 2017 Author Share Posted February 24, 2017 11 minutes ago, kanaas said: list of affected sites This list contains all domains that use CloudFlare DNS, not just the cloudflare proxy (the affected service that leaked data). It's a broad sweeping list that includes everything. Just because a domain is on the list does not mean the site is compromised, and sites may be compromised that do not appear on this list. Link to comment Share on other sites More sharing options...
enej Posted February 24, 2017 Share Posted February 24, 2017 GateHub NOT affected. Email we received from CloudFlare: "Your domain is not one of the domains where we have discovered exposed data in any third party caches. The bug has been patched so it is no longer leaking data. However, we continue to work with these caches to review their records and help them purge any exposed data we find. If we discover any data leaked about your domains during this search, we will reach out to you directly and provide you full details of what we have found. " Zen1, Malloy, Xi195 and 3 others 6 Link to comment Share on other sites More sharing options...
winthan Posted February 24, 2017 Author Share Posted February 24, 2017 6 minutes ago, enej said: GateHub NOT affected. Email we received from CloudFlare: "Your domain is not one of the domains where we have discovered exposed data in any third party caches. The bug has been patched so it is no longer leaking data. However, we continue to work with these caches to review their records and help them purge any exposed data we find. If we discover any data leaked about your domains during this search, we will reach out to you directly and provide you full details of what we have found. " Great Link to comment Share on other sites More sharing options...
RafOlP Posted February 24, 2017 Share Posted February 24, 2017 Official from Cloudflare: https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/ Our technical team is not recommending any special actions related to this. Malloy 1 Link to comment Share on other sites More sharing options...
tulo Posted February 24, 2017 Share Posted February 24, 2017 Also Poloniex is affected... Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now