jboger

Indeed. I believe it might still be possible to arp spoof, if the arp table is leaking MAC. There seem to be no more IP packets leaking in this manner, though, which was the real concern, imo. DO has probably already remedied the rest, and if not, they most likely will shortly.

All in all, a productive communication that worked out well.

Thanks, guys!

It was, indeed, a matter of leaked packages intended for another recipient, but sent to all when not received properly. You are doing it correctly, but it should as of today no longer work. Can you try again?

jb.

I have now talked to Digitalocean, the issue has been identified and a fix has been applied.

Fast, courteous, responsive. There is something to learn here for other cloud shops.

Where do you want me to email logs?

Thank you for your reply! I will send you user-id, so you can check tickets, and I will email you a full tcp-dump from my vps.

Best Regards,

Johan Boger

I also want to point out that this entry was truncated. My full disclosure is, suitably, on full disclosure (the list). There, I explain that I consider DO one of the best cloud shops out there, and I will happily continue using them. I am not an angry customer. I am a current customer, but this is still information that people should be aware of, I believe. Anwyay, do with it as you please. Digital Ocean are aware of it and on top of it (I believe). I wanted to give customers the same chance.

As per guidelines of responsible disclosure, I contacted digitaloceans a good 10 hours before going public. I also contacted them again -before- going public, telling them I would do so, and why.

I feel I have done my best to ensure this does not harm them in any way, while making sure customers are protected.

I can confirm it is still displaying sensitive information.