[193894] in North American Network Operators' Group
Re: Serious Cloudflare bug exposed a potpourri of secret customer data
daemon@ATHENA.MIT.EDU (Mike Goodwin)
Thu Mar 2 09:13:57 2017
X-Original-To: nanog@nanog.org
From: Mike Goodwin <mike.goodwin@sep2.co.uk>
To: "nanog@nanog.org" <nanog@nanog.org>
Date: Sat, 25 Feb 2017 07:21:48 +0000
In-Reply-To: <20170224222852.GA644@gsp.org>
Errors-To: nanog-bounces@nanog.org
VXNlZnVsIGluZm9ybWF0aW9uIG9uIHBvdGVudGlhbGx5IGNvbXByb21pc2VkIHNpdGVzIGR1ZSB0
byB0aGlzOg0KDQpodHRwczovL2dpdGh1Yi5jb20vcGlyYXRlL3NpdGVzLXVzaW5nLWNsb3VkZmxh
cmUNCg0KTWlrZQ0KDQpPbiAyNCBGZWIgMjAxNywgYXQgMTA6MzEgcG0sIFJpY2ggS3VsYXdpZWMg
PHJza0Bnc3Aub3JnPG1haWx0bzpyc2tAZ3NwLm9yZz4+IHdyb3RlOg0KDQooaC90IHRvIFJpY2hh
cmQgRm9ybm8pDQoNCkFmdGVyIHlvdSdyZSBkb25lIHJlYWRpbmcgdGhlIEFycyBUZWNobmljYSBh
cnRpY2xlIGV4Y2VycHRlZCBhbmQgbGlua2VkDQpiZWxvdywgeW91IG1heSBhbHNvIHdhbnQgdG8g
cmVhZDoNCg0KICAgQ2xvdWRmbGFyZSBSZXZlcnNlIFByb3hpZXMgQXJlIER1bXBpbmcgVW5pbml0
aWFsaXplZCBNZW1vcnkNCiAgIGh0dHBzOi8vbmV3cy55Y29tYmluYXRvci5jb20vaXRlbT9pZD0x
MzcxODc1Mg0KDQphbmQsIGFzIGJhY2tncm91bmQ6DQoNCiAgIENsb3VkRmxhcmUsIFdlIEhhdmUg
QSBQcm9ibGVtDQogICBodHRwOi8vY3J5dG8ubmV0L35qb2VwaWU5MS9ibG9nLzIwMTYvMDcvMTQv
Y2xvdWRmbGFyZS13ZS1oYXZlLWEtcHJvYmxlbS8NCg0KYW5kIHRoZW4gcGVyaGFwcyBjb25zaWRl
ciB0aGlzIGNvbW1lbnQgZnJvbSB0aGUgWWNvbWJpbmF0b3IgdGhyZWFkOg0KDQogICBXaGVyZSB3
b3VsZCB5b3UgZXZlbiBzdGFydCB0byBhZGRyZXNzIHRoaXM/IEV2ZXJ5dGhpbmcgeW91J3ZlDQog
ICBiZWVuIHNlcnZpbmcgaXMgcG90ZW50aWFsbHkgY29tcHJvbWlzZWQsIEFQSSBrZXlzLCBzZXNz
aW9ucywNCiAgIHBlcnNvbmFsIGluZm9ybWF0aW9uLCB1c2VyIHBhc3N3b3JkcywgdGhlIHdvcmtz
Lg0KDQogICBZb3UndmUgZ290IG5vIGlkZWEgd2hhdCBoYXMgYmVlbiBsZWFrZWQuIFNob3VsZCB5
b3UgcmVzZXQgYWxsDQogICB5b3VyIHVzZXIgcGFzc3dvcmRzLCBjeWNsZSBhbGwgb3IgeW91ciBr
ZXlzLCBub3RpZnkgYWxsIHlvdXINCiAgIGN1c3RvbWVycyB0aGF0IHRoZXJlIGRhdGEgbWF5IGhh
dmUgYmVlbiBzdG9sZW4/DQoNCiAgIE15IHNlY29uZCB0aG91Z2h0IGFmdGVyIHJlbGllZiB3YXMg
dGhlIHJlYWxpemF0aW9uIHRoYXQgZXZlbg0KICAgYXMgYSBjb25zdW1lciBJJ20gYWZmZWN0ZWQg
YnkgdGhpcywgbXkgcGFzc3dvcmQgbWFuYWdlciBoYXMgPiAxMDANCiAgIGVudHJpZXMgd2hhdCBw
ZXJjZW50YWdlIG9mIHRoZW0gYXJlIHVzaW5nIENsb3VkRmxhcmU/IFNob3VsZA0KICAgSSBjaGFu
Z2UgYWxsIG15IHBhc3N3b3Jkcz8NCg0KDQotLS1yc2sNCg0KDQotLS0tLSBGb3J3YXJkZWQgbWVz
c2FnZSBmcm9tIFJpY2hhcmQgRm9ybm8gPHJmb3Jub0BpbmZvd2Fycmlvci5vcmc8bWFpbHRvOnJm
b3Jub0BpbmZvd2Fycmlvci5vcmc+PiAtLS0tLQ0KDQpGcm9tOiBSaWNoYXJkIEZvcm5vIDxyZm9y
bm9AaW5mb3dhcnJpb3Iub3JnPG1haWx0bzpyZm9ybm9AaW5mb3dhcnJpb3Iub3JnPj4NCkRhdGU6
IEZyaSwgMjQgRmViIDIwMTcgMDc6MzA6MjEgLTA1MDANClRvOiBJbmZvd2FycmlvciBMaXN0IDxp
bmZvd2FycmlvckBhdHRyaXRpb24ub3JnPG1haWx0bzppbmZvd2FycmlvckBhdHRyaXRpb24ub3Jn
Pj4NClN1YmplY3Q6IFtJbmZvd2Fycmlvcl0gLSBTZXJpb3VzIENsb3VkZmxhcmUgYnVnIGV4cG9z
ZWQgYSBwb3Rwb3Vycmkgb2YNCiAgIHNlY3JldCBjdXN0b21lciBkYXRhDQoNClNlcmlvdXMgQ2xv
dWRmbGFyZSBidWcgZXhwb3NlZCBhIHBvdHBvdXJyaSBvZiBzZWNyZXQgY3VzdG9tZXIgZGF0YQ0K
DQpTZXJ2aWNlIHVzZWQgYnkgNS41IG1pbGxpb24gd2Vic2l0ZXMgbWF5IGhhdmUgbGVha2VkIHBh
c3N3b3JkcyBhbmQgYXV0aGVudGljYXRpb24gdG9rZW5zLg0KDQpEYW4gR29vZGluIC0gMi8yMy8y
MDE3LCA4OjM1IFBNDQoNCkNsb3VkZmxhcmUsIGEgc2VydmljZSB0aGF0IGhlbHBzIG9wdGltaXpl
IHRoZSBzZWN1cml0eSBhbmQgcGVyZm9ybWFuY2Ugb2YNCm1vcmUgdGhhbiA1LjUgbWlsbGlvbiB3
ZWJzaXRlcywgd2FybmVkIGN1c3RvbWVycyB0b2RheSB0aGF0IGEgcmVjZW50bHkNCmZpeGVkIHNv
ZnR3YXJlIGJ1ZyBleHBvc2VkIGEgcmFuZ2Ugb2Ygc2Vuc2l0aXZlIGluZm9ybWF0aW9uIHRoYXQg
Y291bGQNCmhhdmUgaW5jbHVkZWQgcGFzc3dvcmRzLCBhbmQgY29va2llcyBhbmQgdG9rZW5zIHVz
ZWQgdG8gYXV0aGVudGljYXRlDQp1c2Vycy4NCg0KQSBjb21iaW5hdGlvbiBvZiBmYWN0b3JzIG1h
ZGUgdGhlIGJ1ZyBwYXJ0aWN1bGFybHkgc2V2ZXJlLiBGaXJzdCwgdGhlDQpsZWFrYWdlIG1heSBo
YXZlIGJlZW4gYWN0aXZlIHNpbmNlIFNlcHRlbWJlciAyMiwgbmVhcmx5IGZpdmUgbW9udGhzDQpi
ZWZvcmUgaXQgd2FzIGRpc2NvdmVyZWQsIGFsdGhvdWdoIHRoZSBncmVhdGVzdCBwZXJpb2Qgb2Yg
aW1wYWN0IHdhcw0KZnJvbSBGZWJydWFyeSAxMyBhbmQgRmVicnVhcnkgMTguIFNlY29uZCwgc29t
ZSBvZiB0aGUgaGlnaGx5IHNlbnNpdGl2ZQ0KZGF0YSB0aGF0IHdhcyBsZWFrZWQgd2FzIGNhY2hl
ZCBieSBHb29nbGUgYW5kIG90aGVyIHNlYXJjaCBlbmdpbmVzLiBUaGUNCnJlc3VsdCB3YXMgdGhh
dCBmb3IgdGhlIGVudGlyZSB0aW1lIHRoZSBidWcgd2FzIGFjdGl2ZSwgaGFja2VycyBoYWQNCnRo
ZSBhYmlsaXR5IHRvIGFjY2VzcyB0aGUgZGF0YSBpbiByZWFsLXRpbWUsIGJ5IG1ha2luZyBXZWIg
cmVxdWVzdHMNCnRvIGFmZmVjdGVkIHdlYnNpdGVzLCBhbmQgdG8gYWNjZXNzIHNvbWUgb2YgdGhl
IGxlYWtlZCBkYXRhIGxhdGVyIGJ5DQpjcmFmdGluZyBxdWVyaWVzIG9uIHNlYXJjaCBlbmdpbmVz
Lg0KDQoiVGhlIGJ1ZyB3YXMgc2VyaW91cyBiZWNhdXNlIHRoZSBsZWFrZWQgbWVtb3J5IGNvdWxk
IGNvbnRhaW4gcHJpdmF0ZQ0KaW5mb3JtYXRpb24gYW5kIGJlY2F1c2UgaXQgaGFkIGJlZW4gY2Fj
aGVkIGJ5IHNlYXJjaCBlbmdpbmVzLCIgQ2xvdWRmbGFyZQ0KQ1RPIEpvaG4gR3JhaGFtLUN1bW1p
bmcgd3JvdGUgaW4gYSBibG9nIHBvc3QgcHVibGlzaGVkIFRodXJzZGF5LiAiV2UNCmFyZSBkaXNj
bG9zaW5nIHRoaXMgcHJvYmxlbSBub3cgYXMgd2UgYXJlIHNhdGlzZmllZCB0aGF0IHNlYXJjaCBl
bmdpbmUNCmNhY2hlcyBoYXZlIG5vdyBiZWVuIGNsZWFyZWQgb2Ygc2Vuc2l0aXZlIGluZm9ybWF0
aW9uLiBXZSBoYXZlIGFsc28NCm5vdCBkaXNjb3ZlcmVkIGFueSBldmlkZW5jZSBvZiBtYWxpY2lv
dXMgZXhwbG9pdHMgb2YgdGhlIGJ1ZyBvciBvdGhlcg0KcmVwb3J0cyBvZiBpdHMgZXhpc3RlbmNl
LiINCg0KVGhlIGxlYWthZ2Ugd2FzIHRoZSByZXN1bHQgb2YgYSBidWcgaW4gYW4gSFRNTCBwYXJz
ZXIgY2hhaW4gQ2xvdWRmbGFyZQ0KdXNlcyB0byBtb2RpZnkgV2ViIHBhZ2VzIGFzIHRoZXkgcGFz
cyB0aHJvdWdoIHRoZSBzZXJ2aWNlJ3MgZWRnZQ0Kc2VydmVycy4gVGhlIHBhcnNlciBwZXJmb3Jt
cyBhIHZhcmlldHkgb2YgdGFza3MsIHN1Y2ggYXMgaW5zZXJ0aW5nIEdvb2dsZQ0KQW5hbHl0aWNz
IHRhZ3MsIGNvbnZlcnRpbmcgSFRUUCBsaW5rcyB0byB0aGUgbW9yZSBzZWN1cmUgSFRUUFMgdmFy
aWV0eSwNCm9iZnVzY2F0aW5nIGVtYWlsIGFkZHJlc3NlcywgYW5kIGV4Y2x1ZGluZyBwYXJ0cyBv
ZiBhIHBhZ2UgZnJvbSBtYWxpY2lvdXMNCldlYiBib3RzLiBXaGVuIHRoZSBwYXJzZXIgd2FzIHVz
ZWQgaW4gY29tYmluYXRpb24gd2l0aCB0aHJlZSBDbG91ZGZsYXJlDQpmZWF0dXJlcz8/P2UtbWFp
bCBvYmZ1c2NhdGlvbiwgc2VydmVyLXNpZGUgQ3VzZXhjbHVkZXMsIGFuZCBBdXRvbWF0aWMNCkhU
VFBTIFJld3JpdGVzPz8/aXQgY2F1c2VkIENsb3VkZmxhcmUgZWRnZSBzZXJ2ZXJzIHRvIGxlYWsg
cHNldWRvIHJhbmRvbQ0KbWVtb3J5IGNvbnRlbnRzIGludG8gY2VydGFpbiBIVFRQIHJlc3BvbnNl
cy4NCjwgLSA+DQoNCmh0dHBzOi8vYXJzdGVjaG5pY2EuY29tL3NlY3VyaXR5LzIwMTcvMDIvc2Vy
aW91cy1jbG91ZGZsYXJlLWJ1Zy1leHBvc2VkLWEtcG90cG91cnJpLW9mLXNlY3JldC1jdXN0b21l
ci1kYXRhLw0KDQpUaGlzIGVtYWlsIGFuZCBhbnkgYXR0YWNobWVudCB0byBpdCBhcmUgY29uZmlk
ZW50aWFsLiBVbmxlc3MgeW91IGFyZSB0aGUgaW50ZW5kZWQgcmVjaXBpZW50LCB5b3UgbWF5IG5v
dCB1c2UsIGNvcHkgb3IgZGlzY2xvc2UgZWl0aGVyIHRoZSBtZXNzYWdlIG9yIGFueSBpbmZvcm1h
dGlvbiBjb250YWluZWQgaW4gdGhlIG1lc3NhZ2UuDQpJZiB5b3UgYXJlIG5vdCB0aGUgaW50ZW5k
ZWQgcmVjaXBpZW50LCB5b3Ugc2hvdWxkIGRlbGV0ZSB0aGlzIGVtYWlsIGFuZCBub3RpZnkgdGhl
IHNlbmRlciBpbW1lZGlhdGVseS4gQW55IHZpZXdzIG9yIG9waW5pb25zIGV4cHJlc3NlZCBpbiB0
aGlzIGVtYWlsIGFyZSB0aG9zZSBvZiB0aGUgc2VuZGVyIG9ubHksIHVubGVzcyBvdGhlcndpc2Ug
c3RhdGVkLiBBbGwgY29weXJpZ2h0IGluIGFueSBzZXAyIG1hdGVyaWFsIGluIHRoaXMgZW1haWwg
aXMgcmVzZXJ2ZWQuDQpBbGwgZW1haWxzLCBpbmNvbWluZyBhbmQgb3V0Z29pbmcsIG1heSBiZSBy
ZWNvcmRlZCBieSBzZXAyIGFuZCBtb25pdG9yZWQgZm9yIGxlZ2l0aW1hdGUgYnVzaW5lc3MgcHVy
cG9zZXMuDQpzZXAyIGV4Y2x1ZGUgYWxsIGxpYWJpbGl0eSBmb3IgYW55IGxvc3Mgb3IgZGFtYWdl
IGFyaXNpbmcgb3IgcmVzdWx0aW5nIGZyb20gdGhlIHJlY2VpcHQsIHVzZSBvciB0cmFuc21pc3Np
b24gb2YgdGhpcyBlbWFpbCB0byB0aGUgZnVsbGVzdCBleHRlbnQgcGVybWl0dGVkIGJ5IGxhdy4N
CnNlcDIgbGltaXRlZCBpcyBSZWdpc3RlcmVkIGluIEVuZ2xhbmQgbnVtYmVyIDA5OTg4ODcwLCBy
ZWdpc3RlcmVkIG9mZmljZSBzZXAyIGxpbWl0ZWQsIFN3YWxlIFN1aXRlLCAybmQgRmxvb3IsIDUg
WW9yayBQbGFjZSwgTGVlZHMgTFMxIDJEUg0K
