Cloudflare

Uma Falha Que Divulgou Dados Sensíveis De Milhões De Sites

... Dados que normalmente estão encriptados e são de difícil acesso. Para eliminar completamente as informações guardadas em cache, a Cloudflare teve de contactar todos os motores de busca, para que eliminassem a informação. Só depois fez o anúncio da falha. A empresa revelou que entre Setembro de 2016 e 18 de Fevereiro de 2017 foram revelados dados pessoais como o conteúdo de pedidos da Uber, dados do Fit Bit e mensagens de sites de encontro. “Estou a encontrar mensagens privadas de grandes sites de encontro, mensagens completas de um serviço de chat bem conhecido, dados de gestão de passwords online, imagens de sites de vídeos para adultos e reservas em hotéis”, escreveu Tavis Ormandy, da equipa de segurança da Google, a 19 de Fevereiro, num blog do Project Zero , projecto de segurança do Google. Ormandy disse que tinha encontrado os dados de forma inesperada e que percebeu que não devia estar a ver aquilo, uma vez que continha informação altamente sensível. “Esta situação é invulgar. [Informação pessoal identificável] estava a ser descarregada de ...

Cloudflare Patches Bug That Leaked Data From Uber, Fitbit And Others

... was first made by Google Project Zero security researcher Tavis Ormandy last week, and involved a flaw that is believed to have dated back to September that involved corrupted web pages being returned by some HTTP requests run through Cloudflare. “I’m finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings,” Ormandy wrote. “We’re talking full HTTPS requests, client IP addresses, full responses, cookies, passwords, keys, data, everything.”. Cloudflare operates as a CDN, a system of distributed servers that delivers web pages and other web content to a user based on geographic location. It’s used by companies to distribute their services across the globe. For example, if you’re in Southeast Asia and contacting Uber your web or app ...

Cloudflare Makes Online Ads 5x Faster, Safer With Firebolt

... lose the ability to make money off broadly accessible content,” explained Matthew Prince, co-founder and CEO of Cloudflare. “Cloudflare's Firebolt addresses the end user concerns of slow, unsafe online advertising , helping ensure that publishers can get paid for their content while still making it available to the broad Internet.”. Key features include. Faster Ad Load Times: Cloudflare's global network of 102 data centers in 50 countries, combined with routing and performance technologies, makes the delivery of online ads to any device up to six times faster. Increased Security: Firebolt takes an in-depth approach to preventing the spread of malvertising by automatically enabling browser security features and cryptographically signing validated AMP ads. This reduces the risk of malware and other ...

This Week's Top Stories

... security goals you have, and independent audits helps ensure that any mistakes you may have made are found. The SSL/TLS community is very familiar with the problems that bad code can cause. This week’s Ticketbleed bug is the latest example. As a bit of good news, Cloudflare announced that their TLS 1.3 implementation has been audited by the NCC Group , a well-known company that provides auditing and consulting to cyber-security companies. The Cloudflare TLS 1.3 implementation is built on top of the Go standard library “crypto/tls”. Go is a newer programming language created by Google that has been well-received as a safer alternative to C. TLS 1.3 will be a significant milestone for the industry and represents the first new protocol version in nearly a decade. It involves significant changes from TLS 1.2 and will involve wide-spread ...

How To Secure Your Data After The Cloudflare Leak

... Super Smash Borg Melee: AI takes on top players of the classic Nintendo fighting game. Cloudflare revealed yesterday that a bug in its code caused sensitive data to leak from some of the major websites that use its performance enhancement and security services. Uber, Fitbit, Ok Cupid and 1 Password are among Cloudflare’s millions of clients, and it’s possible that personal data such as passwords and cookies leaked from many client websites during the five months before the bug was discovered and reported by Tavis Ormandy, a Google researcher. Unfortunately, it’s still not entirely clear how many Cloudflare customers were affected by the bug. The leaked data was cached by search engines in some cases, making the clean-up of the leak a difficult process. Although Google, Yahoo, Bing and other search engines worked to scrub the data before Cloudflare publicly disclosed the bug, researchers reported today that they were still finding samples of ...

Several Indian Websites May Have Been Affected Due To Cloudflare's Data Breach

... list here ). Some notable Indian sites include HDFC Bank, Citibank, Infibeam, __link__, Zoho and Lenskart. The list was first spotted by Next Big What. P. S: if your site uses Cloudflare, it’s probably a good idea to reset all passwords. Other notable data breaches. Recently, a massive data breach on Yahoo carried out by unknown hackers exposed sensitive info belonging to at least 500 million users. The breach, which was carried out in 2014, includes data properties like names, email addresses, dates of birth, telephone numbers and encrypted passwords of Yahoo customers. However, the tech company later blamed “state-sponsored hackers” for stealing information from their servers. Note that Google , Twitter and Facebook earlier gave similar warnings to users stating that there could have been state-sponsored ...

Password Management Made Easy As News Of Cloudflare Leak Surfaces

... is software that acts as a storage area for all your login credentials and passwords. They're great because they free you from having to remember your username, password, and other information. They often also provide additional functionality like password generation, secure form fills, and the facility to have a shared folder for passwords you may want to share with trusted friends—like your Wi-Fi password or shared business accounts. Many great open source password managers are available, such as Kee Pass X , Padlock , and Passbolt. Choosing a password. Now, like a toothbrush, simply using a password manager isn't enough. You need toothpaste. Something that cleans, fluorides, and gives you nice breath. In this case, that means a password that has length, complexity, and individuality. Wherever possible, your passwords should be 16 digits or more to give you ...

The Pirate Bay Blocked By Congent, Cloudflare Puts Pirate Sites On New Ip Addresses To Avoid Block

... to the same IP addresses due to a court order. The TPB blockage was due to a collateral damage according to Cogent. However, now The Pirate Bay and dozens of other pirate sites that were blocked by Cogent’s Internet backbone are now accessible again. Cloudflare appears to have moved the sites in question to a new pair of IP-addresses, effectively bypassing Cogent’s blackhole. Whether Cogent has plans to block their new home as well is unknown because The Pirate Bay, Kickass Torrents, Extra Torrents and a host of other torrent websites are the most blocked websites on the Internet. When Internet backbone provider Cogent blackholed the site two weeks ago many people, therefore, assumed that it had something to do with the notorious torrent site. Ironically, however, it turns out that The Pirate Bay and dozens of other “pirate” sites linked to the same IP-addresses, were actually collateral damage following a separate action. Cogent’s actions were a direct response to a court order which required the company to block access to one ...

A Court Order Blocked Pirate Sites That Weren’t Supposed To Be Blocked

... network operators. The Cogent situation is not the first such court order, but “it’s still early in this evolution, and it gives us concern that if these sorts of orders continue to multiply, it’s going to provide additional complexity and complication,” Kramer said. “We want to be proactive about it now to make sure these court orders don’t multiply in a problematic way.”. For global network operators, it might be easier to comply with an order by blocking access to a website globally even if the order only applies to one country, Kramer said. However, Kramer said Cloudflare can "generally" help limit blocks to specific countries. Besides developing technical solutions, Kramer said Cloudflare has tried to work with courts to make sure orders are written so that they can be applied ...

Software-fehler Macht Private Nutzerdaten Öffentlich

... mit, dass die Sicherheitslücke nach Bekanntwerden innerhalb weniger Stunden geschlossen wurde. Allerdings wurden die betroffenen Seiten von anderen Diensten zwischengespeichert und indiziert, beispielsweise Suchmaschinen wie Google, Bing oder Yahoo. Cloudflare habe mit den Betreibern von Suchmaschinen zusammengearbeitet, um die zwischengespeicherten Anfragen zu löschen, teilte das Unternehmen weiter mit. Dennoch ist es möglich, dass noch immer private Informationen öffentlich im Netz zugänglich sind. SPIEGEL ONLINE ist nicht verantwortlich für die Inhalte externer Internetseiten. Mehr zum Thema. Forum - Diskutieren Sie über diesen Artikel. insgesamt 6 Beiträge. Wer Cloud-Diensten vertraut, dem ist kaum zu helfen. shloma gestern, 15:10 Uhr. 2. Das ist eine der gefährlichsten Meldungen des Jahres. Und kaum einer kapiert es. Ich habe schon eine E-Mail erhalten, dass ich mein onlinebanking Passwort ändern sollte. Die Liste der ...

Centralized Web Services Are Wonderful—until They Go Wrong

... Are Wonderful—Until They Go Wrong. When thousands of companies use a single Web services company, even small mistakes can prove catastrophic. When you centralize the Web, what happens when things go wrong. Recommended for You. Alphabet’s Nascent Ride-Sharing Service Ups the Ante Against Uber. That’s a question some companies will be asking themselves this week, after it came to light that Cloudflare—which helps many companies deliver websites to browsers—has been leaking private data. The firm had been running its services with a flaw, similar to the one that gave rise to the infamous Heartbleed bug of 2014 , that meant it occasionally published sensitive user information, such as passwords, cookies, and IP addresses, where it didn't mean to, some of which was cached by search engines. Cloudflare points out that the flaw meant that its servers leaked private information just once in every 3.3 million Web requests it dealt with. But such is the scale ...