It's a nice write up, but am I crazy for finding nothing novel here? We've known about rough geolocation via CDNs and VPNs for years, and that's pretty much where the story ends. I guess the...
It's a nice write up, but am I crazy for finding nothing novel here? We've known about rough geolocation via CDNs and VPNs for years, and that's pretty much where the story ends. I guess the awareness of platforms' push notifications and attitudes is always helpful though.
for me, the most eyebrow raising thing is this part: the technical meat may not be surprising to people in the know, but this circular buck-passing is, at least to me.
for me, the most eyebrow raising thing is this part:
Cloudflare's final statement about this says they do not consider the deanonymization attack to be a vulnerability in their own systems and it is up to their consumers to disable caching for resources they wish to protect.
There's clearly a problem here as Cloudflare says consumers are responsible for protecting themselves against these types of attacks, while consumers (ex. Discord) are putting the blame on Cloudflare.
the technical meat may not be surprising to people in the know, but this circular buck-passing is, at least to me.
I read it as less of a novel attack with high impact and more as an interesting chaining of flaws/functionality that allows for gathering of information that can be undesirable in some situations....
I read it as less of a novel attack with high impact and more as an interesting chaining of flaws/functionality that allows for gathering of information that can be undesirable in some situations. While I think the author is trying to make it look worse than it is, there's likely cases as he mentions that a journalist for instance does not want it known that they're in a specific country/region.
It's also interesting to learn of the jump from a theoretical attack (As you mentioned we know about these things) to actually executing it.
You can always brute force a check on which caches are hot, which doesn't require a resource you own, although it's a pretty terrible attack, presumably requiring many rounds with different resources.
You can always brute force a check on which caches are hot, which doesn't require a resource you own, although it's a pretty terrible attack, presumably requiring many rounds with different resources.
It's true that there's nothing particularly novel and the author indulges in a bit of hype. Definitely this is not what people usually mean when they talk about a zero click vulnerability. However...
It's true that there's nothing particularly novel and the author indulges in a bit of hype. Definitely this is not what people usually mean when they talk about a zero click vulnerability.
However this is a key part of it imo:
hi, i'm daniel. i'm a 15-year-old high school junior
The logic and persistence is impressive and all things considered it's a great writeup. I'd have probably hyped it even worse at 15. Hard to blame him for being excited.
So here's the thing. If you're on the web, you're broadcasting your IP address to others constantly. Just that information can be used to geolocate you with MUCH greater accuracy than this...
So here's the thing. If you're on the web, you're broadcasting your IP address to others constantly. Just that information can be used to geolocate you with MUCH greater accuracy than this GeoGuesser thing that finds the midpoint between Cloudflare datacenters and draws a Venn diagram of the radii to infer a broad region where you might be located.
So use a VPN. Now the basic geolocation risk is squelched, and Cloudflare is going to serve you content from endpoints nearer to wherever it thinks you're coming from (determined via that same basic geolocation data).
I applaud the kid for his detailed write-up and overall savvy... I wasn't doing anything at this level at age 15, and I think he's got a bright future ahead of him. But this particular "attack" is really a non-issue.
It's a nice write up, but am I crazy for finding nothing novel here? We've known about rough geolocation via CDNs and VPNs for years, and that's pretty much where the story ends. I guess the awareness of platforms' push notifications and attitudes is always helpful though.
for me, the most eyebrow raising thing is this part:
the technical meat may not be surprising to people in the know, but this circular buck-passing is, at least to me.
How would cloudflare fix this, though? It's not really a bug, exactly.
I read it as less of a novel attack with high impact and more as an interesting chaining of flaws/functionality that allows for gathering of information that can be undesirable in some situations. While I think the author is trying to make it look worse than it is, there's likely cases as he mentions that a journalist for instance does not want it known that they're in a specific country/region.
It's also interesting to learn of the jump from a theoretical attack (As you mentioned we know about these things) to actually executing it.
You can always brute force a check on which caches are hot, which doesn't require a resource you own, although it's a pretty terrible attack, presumably requiring many rounds with different resources.
It's true that there's nothing particularly novel and the author indulges in a bit of hype. Definitely this is not what people usually mean when they talk about a zero click vulnerability.
However this is a key part of it imo:
The logic and persistence is impressive and all things considered it's a great writeup. I'd have probably hyped it even worse at 15. Hard to blame him for being excited.
For sure - kid is definitely going places. He has the security mindset for sure.
So here's the thing. If you're on the web, you're broadcasting your IP address to others constantly. Just that information can be used to geolocate you with MUCH greater accuracy than this GeoGuesser thing that finds the midpoint between Cloudflare datacenters and draws a Venn diagram of the radii to infer a broad region where you might be located.
So use a VPN. Now the basic geolocation risk is squelched, and Cloudflare is going to serve you content from endpoints nearer to wherever it thinks you're coming from (determined via that same basic geolocation data).
I applaud the kid for his detailed write-up and overall savvy... I wasn't doing anything at this level at age 15, and I think he's got a bright future ahead of him. But this particular "attack" is really a non-issue.