Abro hilo para comentar este tema.
Noticia:
https://www.engadget.com/2017/02/24/server-bug-leaks-user-data-for-thousands-of-popular-websites/?sr_
Páginas afectadas:
https://github.com/pirate/sites-using-cloudflare/blob/master/README.md
Impact
Between 2016-09-22 - 2017-02-18 passwords, private messages, API keys,
and other sensitive data were leaked by Cloudflare to random requesters.
Data was cached by search engines, and may have been collected by random
adversaries over the past few months.
"The greatest period of impact was from February 13 and February 18 with
around 1 in every 3,300,000 HTTP requests through Cloudflare potentially
resulting in memory leakage (that’s about 0.00003% of requests),
potential of 100k-200k paged with private data leaked every day" -- source
You can see some of the leaked data yourself in search engine caches:
https://duckduckgo.com/?q=+%7B%22scheme%22%3A%22http%22%7D+CF-Host-Origin-IP&t=h_&ia=web
Affected domains found in the wild:
http://doma.io/2017/02/24/list-of-affected-cloudbleed-domains.html
What should I do?
Check your password managers and change all your passwords, especially
those on these affected sites. Rotate API keys & secrets, and confirm
you have 2-FA set up for important accounts. Theoretically sites not in
this list can also be affected (because an affected site could have made
an API request to a non-affected one), so to be safe you should probably
change all your important passwords.
