A security researcher made a tool that let them quickly check which of Cloudflare's data centers had cached an image, which allowed them to figure out what city a Discord, Signal, or Twitter/X user might be in.

cross-posted from: https://lemmy.ca/post/37638868 [email protected]

This affects Signal too

An issue with Cloudflare allows an attacker to find which Cloudflare data center a messaging app used to cache an image, meaning an attacker can obtain the approximate location of Signal, Discord, Twitter/X, and likely other chat app users. In some cases an attacker only needs to send an image across the app, with the target not clicking it, to obtain their location.

https://gist.github.com/hackermondev/45a3cdfa52246f1d1201c1e8cdef6117?ref=404media.co

Signal, an open-source encrypted messaging service, is widely used by journalists and activists for its privacy features. Internally, the app utilizes two CDNs for serving content: cdn.signal.org (powered by CloudFront) for profile avatars and cdn2.signal.org (powered by Cloudflare) for message attachments.

  • knighthawk0811@lemmy.mlEnglish
    32·
    1 day ago

    i think this would be true of basically any large service that had multiple data centers. whichever one catches your data is the one closest to you.

    the difficulty is accessing that data even if you can’t read it you still have the closest location.

    sounds to me like the Internet working as intended. if you want true privacy you need to take extra steps

    • KairuByte@lemmy.dbzer0.comEnglish
      8·
      1 day ago

      Not even guaranteed to be the closest data center. It’s not completely out of the ordinary for there to be a faster route available to a data center farther away.

    • Telorand@reddthat.comEnglish
      11·
      1 day ago

      Agreed. Privacy is always a balance between your threat model and useability. If your general location is enough to put you in danger, hopefully you’re already aware of how your data is being sent over the various networks and have measures in place to stay safe.

      For most people, knowing very generally where they are isn’t especially useful information to anyone with an interest in surveillance.

    • azertyfun@sh.itjust.worksEnglish
      2·
      22 hours ago

      On the one hand, deanonimization attacks are never entirely avoidable on unhardened targets and this one isn’t particularly sophisticated and leaks relatively little information.

      On the other hand deanonimization attacks are always bad and it’s a good reminder to people of the risks they are taking. This is also slightly non-obvious behavior, even if it makes sense to the technically competent, as something like an IP grabber normally requires user interaction such as clicking a link. It’s also a vector that CF might be able to mitigate by patching the ability to query a given cache directly.

  • boaratio@lemmy.worldEnglish
    104·
    1 day ago

    I don’t want to be a contrairian, but your cellphone carrier does this non stop. Cloudflare is not a good company, but this is the least of your problems.

      • boaratio@lemmy.worldEnglish
        5·
        20 hours ago

        I’m not trying to wear a tinfoil hat, but Snowden clearly revealed that the government is easily able to purchase cellphone location data based on GPS and tower data more easily than they can go through the FISA courts.

        • ByteOnBikes@slrpnk.netEnglish
          2·
          16 hours ago

          Ah, thought you meant though metadata. Like a end user snooping through some obscure meta data method (even after cleaning) let’s you triangulate something.

        • Danitos@reddthat.comEnglish
          3·
          20 hours ago

          Your cellphone provider very likely already sells this data.

          I know mine does, because I attended a webinar of a buying company where they explicitly mentioned this.

    • melroy@kbin.melroy.org
      122·
      1 day ago

      Fully agreed, sorry to see people down voting you. But the Internet was not meant to be run by a single company called Cloudflare, it’s a dangerous prospective. Since the more people depend on Cloudflare the more powerful it become and the more depend people will become. We need alternative solutions to protect against DoS and more.

    • theunknownmuncher@lemmy.worldEnglish
      172·
      1 day ago

      I support this because most all cloudflare websites require browser fingerprinting otherwise they will not serve you the page. The moment I enable the jShelter addon, I am cut off from a significant portion of the internet

              • melroy@kbin.melroy.org
                31·
                1 day ago

                So Unbound is actually a very powerful validating, recursive and caching DNS resolver. So without relaying on Google DNS or ISP DNS, you can host your own Unbound recursive DNS server, which can do request to other DNS servers and even root-dns servers. You can even setup your own stub zones and forward zones (sorry this is too much details I know). And like I said it also has caching feature. I will soon create a blog post about Unbound as well on my https://blog.melroy.org/ site be sure to subscribe.

                Here is a snipped of part of my config, feel free to use it however you want:

                        # Serve stale data
        serve-expired: yes
        serve-expired-ttl: 86400           # one day, in seconds
        serve-expired-client-timeout: 500  # 500ms

        # Increase caches for better performance
        msg-cache-slabs: 4
        rrset-cache-slabs: 4
        infra-cache-slabs: 4
        key-cache-slabs: 4

        rrset-cache-size: 300m
        msg-cache-size: 150m

        outgoing-range: 200
        num-queries-per-thread: 100
              • Hellmo_luciferrari@lemm.eeEnglish
                2·
                1 day ago

                You can use both. Unbound is a validating, recursive, caching DNS resolver.

                You can setup Unbound to be a self hosted DNS solution, and point PiHole to use your Unbound.

                Source: Unbound

  • melroy@kbin.melroy.org
    75·
    1 day ago

    Another reason to not use Cloudflare. Not that long ago they also “lost the log records” (this incident happened on November 14, 2024). I strongly believe the internet can become better without Cloudflare, especially now basically the whole world is depending on it.

    • melroy@kbin.melroy.org
      2·
      2 hours ago

      Sorry to see so many people still down vote me. What is wrong with you? The internet has become a joke. Moving all to cloudflare will only make the problem worse.

    • sunzu2@thebrainbin.org
      7·
      23 hours ago

      It is impossible to use most of corpo internet if you block cloudflare. Shit is wild.

      Not sure who is down voting you lol

      I wish people would respond with a rebuttal so we can move convo forward.

      • melroy@kbin.melroy.org
        2·
        2 hours ago

        I also have no idea why is down voting me lol. But you are 100% right. Could you imagine in the year 2000 that everything needs to behind Cloudflare in 2025 in order to have a functional internet? This shit is indeed wild.

        • ganymede@lemmy.mlEnglish
          1·
          4 minutes ago

          fuck me lemmy is turning into an absolute reddit-esque cesspool shithole.

          i do not understand why people are in here simping for cloudflare (presumably unpaid) do they have money in cloudflare? clearly they don’t have a fucking clue whats really going on in the world, but what makes them think they need to actively enforce (ie. downvote people) for pointing out issues with cloudflare??

          this is beyond weird.