Weather System Moving in That Bleeds Your Data from the Cloud and Shows it to Strangers

If you aren’t getting enough weather at the moment, how about a cloudbleed? Not really a weather term, but it’s referencing an issue with some code that is operated by Cloudflare, a web infrastructure company that provides webhosting services for some of the most well known websites. These include Uber, Yelp, Fitbit, and for online daters who haven’t been victims of security incidents enough already, online dating site OKCupid.

The name is a “shout out” to Heartbleed, which happened back in 2014 and lingers on to this day. In fact, as of the beginning of this year, close to 200,000 systems still had not been patched to resolve that issue. The Cloudbleed issue, found by Google Project Zero’s Tavis Ormandy (who also found several serious vulnerabilities with Symantec products last year) wrote in a blog that this issue allows data from one Cloudflare hosted site to “bleed” over into other Cloudflare hosted sites. For example someone may be looking for where to get good grub on Yelp and suddenly see some dialogue from other users who were chatting on the OKCupid site. Though it might be a savory conversation, it’s not likely the information the Yelp user intends to find, nor is it meant for strangers to see.

There is a website called doesitusecloudflare.com where a site can be entered and it will display if it uses Cloudflare services. If you find one that you regularly visit does use it, it’s recommended that you immediately change your password. Always use unique passwords for each online account and use a minimum of eight characters that combines upper and lower case letters, numbers, and special characters.  In addition, if a site you use offers multifactor authentication (MFA) of any kind take advantage of it. This will prevent a cybercriminal from succeeding in accessing your account or reusing any of your passwords on other sites. This applies whether it’s a Cloudflare site or not.  These steps will not guarantee damage has not already been done in this particular case, but it does help lower your risk.

Ormandy found the vulnerability in the middle of February, but said it’s likely that it has been leaking data since September of last year. According to Cloudflare, the peak activity was between February 13 and 18. No malicious activity has been traced back to this, but it’s difficult to know what was done in the five months that no one knew about it. Ormandy said he saw chat conversations, private messages from dating sites, frames from adult video sites, and hotel bookings among other things that people would probably like to keep private.

Cloudflare worked quickly and resolved the issue with seven hours. So, if you’re snowed in for the day or it’s just too hot to be outside, go through and make those password changes to pass the time.