Internet users on Friday were being urged to change all their passwords in the wake of a Cloudflare bug that could have leaked passwords, messages and more from Web site visits.
A Cloudflare service used by millions of Web sites to enhance security and performance said that it had fixed the flaw quickly after being alerted a week ago by Google researcher Tavis Ormandy.
“It turned out that in some unusual circumstances, our edge servers were running past the end of a buffer and returning memory that contained private information such as HTTP cookies, authentication tokens, HTTP POST bodies and other sensitive data,” Cloudflare Inc chief technology officer John Graham-Cumming said in a blog post. “And some of that data had been cached by search engines.”
Essentially, sensitive data intended to be temporarily stored overflowed “buffering” memory space and was then tucked into more exposed spots such as Web pages that could then be captured by online search engines, according to descriptions of the bug.
“We fetched a few live samples and we observed encryption keys, cookies, passwords, chunks of POST data and even HTTPS requests for other major Cloudflare-hosted sites from other users,” Ormandy said in a blog.
“This situation was unusual, [personally identifiable information] was actively being downloaded by crawlers and users during normal usage, they just didn’t understand what they were seeing,” he added.
Ormandy said in a Twitter message that Cloudflare has been leaking information for months, jeopardizing supposedly secure data at major Web sites including Uber, OKCupid, Fitbit and 1Password.
People have been urged to change all of their online passwords.
To many, Tatu City on the outskirts of Nairobi looks like a success. The first city entirely built by a private company to be operational in east Africa, with about 25,000 people living and working there, it accounts for about two-thirds of all foreign investment in Kenya. Its low-tax status has attracted more than 100 businesses including Heineken, coffee brand Dormans, and the biggest call-center and cold-chain transport firms in the region. However, to some local politicians, Tatu City has looked more like a target for extortion. A parade of governors have demanded land worth millions of dollars in exchange
An Indonesian animated movie is smashing regional box office records and could be set for wider success as it prepares to open beyond the Southeast Asian archipelago’s silver screens. Jumbo — a film based on the adventures of main character, Don, a large orphaned Indonesian boy facing bullying at school — last month became the highest-grossing Southeast Asian animated film, raking in more than US$8 million. Released at the end of March to coincide with the Eid holidays after the Islamic fasting month of Ramadan, the movie has hit 8 million ticket sales, the third-highest in Indonesian cinema history, Film
Taiwan Semiconductor Manufacturing Co’s (TSMC, 台積電) revenue jumped 48 percent last month, underscoring how electronics firms scrambled to acquire essential components before global tariffs took effect. The main chipmaker for Apple Inc and Nvidia Corp reported monthly sales of NT$349.6 billion (US$11.6 billion). That compares with the average analysts’ estimate for a 38 percent rise in second-quarter revenue. US President Donald Trump’s trade war is prompting economists to retool GDP forecasts worldwide, casting doubt over the outlook for everything from iPhone demand to computing and datacenter construction. However, TSMC — a barometer for global tech spending given its central role in the
Alchip Technologies Ltd (世芯), an application-specific integrated circuit (ASIC) designer specializing in server chips, expects revenue to decline this year due to sagging demand for 5-nanometer artificial intelligence (AI) chips from a North America-based major customer, a company executive said yesterday. That would be the first contraction in revenue for Alchip as it has been enjoying strong revenue growth over the past few years, benefiting from cloud-service providers’ moves to reduce dependence on Nvidia Corp’s expensive AI chips by building their own AI accelerator by outsourcing chip design. The 5-nanometer chip was supposed to be a new growth engine as the lifecycle
RSS