Change Your Passwords. Now.

[aggiesal]

Source: Gizmodo

A massive memory leak from web services and security company Cloudflare may have exposed user data for thousands of sites using the service. In other words: its time to change your passwords.

Theres lots left to discover about the impact of the leakagewhich is being called Cloudbleed, similar to the Heartbleed bug back in 2014. What we do know that makes this so worrisome is that some of the memory leaks, which may have included user data, was able to be cached by search engines. Once indexed, nefarious types may have scraped and stored that data.

Cloudbleed was discovered by Tavis Ormandy of Googles security analysist team Project Zero on February 18th. How it was found and patched, and what exactly was causing these leaks is exhaustively detailed by Cloudflare in a blog post. According to Cloudflare, the greatest period of impact was from February 13 and February 18 with around 1 in every 3,300,000 HTTP requests through Cloudflare potentially resulting in memory leakage.

...

Read more: http://gizmodo.com/cloudbleed-password-memory-leak-cloudflare-1792709635

---

The list is large.
There is a link in the story that you can select, but here is
the link
https://github.com/pirate/sites-using-cloudflare

DemocraticUnderground.com is NOT on the list.

Some notables that ARE ON the list:
glassdoor.com
fitbit.com
change.org
uber.com
yelp.com

just to name a few

[dalton99a]

1. Kick.

[klook]

2. Thank you.

Good time to get a password management app for those who don't already have one. I use 1Password from AgileBits (Mac/iOS app), and have hundreds of strong passwords stored in an encrypted database on my hard drive.

I'm going to devote some quality time today and over the weekend updating them all - prioritizing the financial and other personal ones first.

[aggiesal]

10. I use KEEPER, myself n/t

[dhill926]

3. rawstory.com on there as well...

[Liberalagogo]

9. Rawstory

Rawstory doesn't use passwords to read, but it does uses Disqus to comment. But Disqus isn't on the list.
But Rawstory is, I 'm just not sure why.

[dhill926]

11. yep, just saw it there....

of course there are a lot of porn sites, so raw story....haha, who knows....

[Ligyron]

4. Oh no,not this again

I've got to get an password managing app - but aren't those then hackable too?

Anyway, thanks for the warning

[sarcasmo]

7. Keep my passwords in my phone contacts, guess I could loose the phone.

Nothing is safe online.

[Ligyron]

15. You could get one of those thumbprint ID phones.

Don't even know if they're out yet.

Then they'd have to rob you in person...

[Hekate]

5. Aargh. KnR

[Wounded Bear]

6. K & R ......for visibility..nt

[randome]

8. Oh, please, this is all a little hyperbolic.

A researcher discovered a vulnerability, which is different than finding evidence of a data theft. The vulnerable data was in random memory chunks so the odds are vastly against any specific person's identifying info being compromised.
[hr][font color="blue"][center]The truth doesn’t always set you free.
Sometimes it builds a bigger cage around the one you’re already in.[/center][/font][hr]

[LanternWaste]

13. Your concern for our idiocy is a bright light of yellow spectrum trickling down on all of us.

Ashley Madison was a fluke. No need to concern ourselves with site vulnerability. Saying anything else is mere melodrama by another, trendier word.


Right. Your concern for our idiocy is a bright light of yellow spectrum trickling down on all of us.

[randome]

14. Who said not to be concerned? Identify the vulnerability and fix it. Just another day in the week.

There will never be a 100% safe means of making information available world-wide.
[hr][font color="blue"][center]The truth doesn’t always set you free.
Sometimes it builds a bigger cage around the one you’re already in.[/center][/font][hr]

[haele]

12. Interesting - a lot of bitcoin sites are on the list, along with gaming sites.

I suspect I know what the major target might have been...

Haele

[sinkingfeeling]

16. If Google and DU aren't on the list, I'm safe.

[klook]

17. Just so people understand this a little better...

Cloudflare is a provider of internet content optimization and security used very widely on many web sites. Among their services is protection from Distributed Denial of Service (DDOS) attacks. I've used Cloudflare myself on WordPress sites I've built. It's good for speeding up content delivery and giving administrators peace of mind. A lot of data passes from users through Cloudflare to web sites and back.

Assessment from the company's Chief Technology Officer:

“With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory,” said John Graham-Cumming, Cloudflare’s CTO, in a blog post. “Those 770 unique URIs covered 161 unique domains.” A URI (Uniform Resource Identifier) is a character string that identifies a resource on the web, and is sometimes used interchangeably with the term URL (Universal Resource Locator).

(PC World article - see link below)

Here are some other articles about this bug:

• Cloudflare bug data leak exposed (BBC)


• Serious Cloudflare bug revealed secret user data from major websites (PC World)


• Cloudflare bug exposed passwords, other sensitive data from websites (IT World)


• Cloudflare found leaking customer HTTPS sessions for months (ZDNet)


• Massive Bug May Have Leaked User Data From Millions of Sites. So … Change Your Passwords (Wired)


• Serious Cloudflare bug exposed a potpourri of secret customer data (Ars Technica)


• Cloudbleed: Big web brands leaked crypto keys, personal secrets thanks to Cloudflare bug (The Register)


• Major Cloudflare bug leaked sensitive data from customers’ websites (TechCrunch)

[JudyM]

18. A handful more sites folks might use include moveon.com, runnersworld.com, thisoldhouse.com,

womenshealthmag.co
Spin.com
Udemy.com
Zenhabits.net

And washingtontimes.com