One can, since last month on Chrome, browser-to-operator encrypt data, with xwing as a KEM, AES-GCM as an AEAD, without any system in the middle ever knowing anything cleartext and any attacker needing to crack both x25519 and MLKEM to get the symmetric key... or crack AES.

Like pgp on steroids and reasonably protected against capture-now-decrypt-later.

I'm assuming a self-hosted CRM of some kind was using a cloudflare key for mail, so attacker scooped the db and key and was able to use both. 

I've never used a Cloudflare anything but I imagine a mail api key can be IP-bound, so presumably the attacker would have used the CRM box to hit the API endpoint as well. 

The mention of Cloudflare being completely irrelevant in this context, CRM was pwned along with whatever method it used to send mail.

These CRM DB's being WAN accessible systems seems to be a root factor in all of these, now i'll be thought exercising how shipping details can be encrypted to a militarized box...

justin_shocknet

I don't even understand how you can escalate from a self hosted app to cloudflare privilege, but that is probably because I'm a dumdum that doesn't like zero-button CD.