New threat for bitcoin comes from Cloudbleed data leak

Same as Betterment, the capital market startup, Cloudflare was also launched in 2010 at that year’s TechCrunch Disrupt conference. Since then, the company has grown rapidly, garnering numerous awards in technology and acquiring plenty of funding. There has now been a Cloudbleed data leak that is affecting more than just the company.

At the moment, they have thousands of websites using their services, with some big names like Uber signed up. Their service helps to protect the websites of their clients by, in layman terms, adding an extra layer on top of the usual DNS lookup web browsers use to acquire websites’ IP address. In so doing, they prevent the website from receiving unnecessary requests, which is how attackers slow down a website’s speed.

What about Cloudbleed?

Considering that Cloudflare’s business is about security and the kind of clientele they have, the latest bug in the system is worrying. The bug is being named Cloudbleed because data from Cloudflare leaked from websites managed by Cloudflare into people’s browsers. Furthermore, it wasn’t just the website content that leaked, but sensitive data about the websites. Sensitive data could include passwords, names and even the addresses of people using a different website.

Understanding the effect of the Cloudbleed data leak

For example, imagine you’re browsing the Uber website; it’s unusual, I know because Uber is mainly used on phones, but they do have a website. So, you were on the Uber website and personal details from OkCupid were displayed at the bottom of the Uber website.

PS: both Uber and OkCupid were using Cloudflare services.

You can see how this could be insecure, that you, on the Uber website, could perhaps have received personal details of someone on OkCupid. Worse still, Cloudflare has thousands of websites signed up, so the number of leaks is potentially enormous. Furthermore, the Cloudbleed data leak was happening ever since the 22^nd of September 2016 to the 18^th of February 2017 before it was discovered. By that time, there were 1,242,071 leaks.

Now, you may be asking yourself why you didn’t notice any such thing, but that’s because, fortunately, leaked data would only be found in the website’s source code. The website’s source code is the page with all the underlying HTML, CSS, etc. codes. Most people don’t bother with this, and so it went undetected for so long.

Search engines, though, did not fail to cache this data. As you may know, search engines like Google are able to show results because they constantly browse websites for content then stores it. So, these search engines collected this personal data and kept a cache of it. This might explain why a researcher from Google was first to notice the Cloudbleed data leak and alert Cloudflare. Besides search engines, hackers who noticed the leak before it was discovered may have already kept people’s personal information.

What effect does this have on bitcoin?

Among the websites signed onto Cloudflare were bitcoin companies like Coinbase, BitPay, LocalBitcoins and much more. To be clear, the Cloudbleed data leak didn’t affect blockchain or bitcoin in any way. However, to transact bitcoin in these websites, you have to provide your personal details, including your credit cards and so on. Cookies may also have been leaked, and they are the ones that allow you to enter websites you frequent without having to re-enter your password. If an attacker has the cookies, then they can easily log into your accounts.

If these have leaked, then the users of these bitcoin services may be at risk. This is why Cloudflare is encouraging people to change their passwords, but many people may become worried about the security of their bitcoins. If enough people choose to sell their bitcoins, this may cause its value to drop, and that is a new threat.