https://www.crowdpondent.com/2017/02/24/cloudbleed-cloudflare-bug-data-leak-unexploited/

Cloudflare is an internet firm that filters out hack attacks by routing web traffic through its network. Cloudflare offers protection to banks, governments, shopping and dating sites. Cloudflare offers performance and security services to over 6 million customers. The bug responsible for the leak was discovered by Google vulnerability researcher Tavis Ormandy while updating their software (Tavis Ormandy is a part of Google’s project Zero).

Cloudflare took immediate steps to fix the problem minutes after the discovery of the bug – Cloudbleed. The flaw was patched in some hours and the company is working with Google and other search engines to erase caches and snippets of exposed data.

The Chief operating officer John Graham-Cumming had told the BBC that there was not yet evidence of a malicious use of the data leak. However, Ryan Lackey a former Cloudflare employee advises users to update passwords and enable two-factor authentication for online accounts as a precautionary measure.

The bug is may have been active from September 22 until it was discovered on February 17. According to John Graham-Cumming, 120,000 web pages had been leaking information daily before the discovery. One of the major problems of this data leak is identifying affected customers. John Graham-Cumming has released a report giving details of the data leak and how it was fixed.

Internet security researchers have voiced concerns that Cloudbleed may be more serious than the company has described. A bug of this nature if exploited by hackers could cause great damage. Millions of internet users could be at risk if the Cloudflare data leak is not completely dealt with.