Bringing OAuth 2.0 to Wrangler
In this blog, we will look into what the OAuth 2.0 protocol is, and how it can help improve the authorization process in the command-line interface tool Wrangler used to manage your Cloudflare Workers.
Announcing npm’s new access token format
npm access tokens will now follow the established format of GitHub authentication tokens.
GitHub Advisory Database now supports Rust
We’re excited to announce that the GitHub Advisory Database now includes curated security advisories on the Rust ecosystem!
Apache Dubbo: All roads lead to RCE
During an audit of Apache Dubbo v2.7.8 source code, I found multiple vulnerabilities enabling attackers to compromise and run arbitrary system commands on both Dubbo consumers and providers. In this blog post I detailed how I leveraged CodeQL as an audit oracle to help me find these issues.
How to customize your HTTP DDoS protection settings
We’re excited to announce the availability of the HTTP DDoS Managed Ruleset. This new feature allows Cloudflare customers to independently tailor their HTTP DDoS protection settings.
How WhatsApp is enabling end-to-end encrypted backups
For years, in order to safeguard the privacy of people’s messages, WhatsApp has provided end-to-end encryption by default so messages can be seen only by the sender and recipient, and no one in between. Now, we’re planning to give people the option to protect their WhatsApp backups using end-to-end encryption as well. People can already […]
GitHub Enterprise Server 3.2 brings new color modes and added security capabilities
GitHub Enterprise Server 3.2 is available today as a release candidate.
An analysis on developer-security researcher interactions in the vulnerability disclosure process
We put out a call to open source developers and security researchers to talk about the security vulnerability disclosure process. Here’s what we found.
How Cloudflare helped mitigate the Atlassian Confluence OGNL vulnerability before the PoC was released
On August 25, 2021, Atlassian released a security advisory affecting their Confluence application. The Cloudflare WAF soon after started mitigating an increase in malicious traffic to vulnerable endpoints ensuring customers remained protected.
GitHub security update: Vulnerabilities in tar and @npmcli/arborist
Between July 21, 2021 and August 13, 2021 we received reports through one of our private security bug bounty programs from researchers regarding vulnerabilities in tar and @npmcli/arborist.
What’s new with Cloudflare for SaaS?
Today, we’re excited to announce all the customizations that our team has been working on for our Enterprise customers — for both Cloudflare for SaaS and SSL for SaaS.
Increasing developer happiness with GitHub code scanning
How GitHub uses code scanning to increase developer happiness, and how you can too.
Inside Figma: getting out of the (secure) shell
Tips from the Figma security team to help other teams secure Systems Manager and protect their most sensitive data
Improving Git protocol security on GitHub
We’re changing which keys are supported in SSH and removing unencrypted Git protocol. Only users connecting via SSH or git:// will be affected. If your Git remotes start with https://, nothing in this post will affect you. If you’re an SSH user, read on for the details and timeline.
Making Magic Transit health checks faster and more responsive
Magic Transit advertises our customer’s IP prefixes directly from our edge network, applying DDoS mitigation and firewall policies to all traffic destined for the customer’s network.
The npm registry is deprecating TLS 1.0 and TLS 1.1
Beginning October 4, 2021, all connections to npm websites and the npm registry, including for package installation, must use TLS 1.2 or higher.
Cloudflare thwarts 17.2M rps DDoS attack — the largest ever reported
Earlier this summer, Cloudflare’s autonomous edge DDoS protection systems automatically detected and mitigated a 17.2 million request-per-second (rps) DDoS attack, an attack almost three times larger than any previous one that we're aware of.
Securing your GitHub account with two-factor authentication
The benefits of multifactor authentication are widely documented, and there are a number of options for using 2FA on GitHub.
Introducing Zero-Knowledge Proofs for Private Web Attestation with Cross/Multi-Vendor Hardware
In Cryptographic Attestation of Personhood the server sends a message to the browser that the hardware security signs, demonstrating its authenticity.
Handling Mounting And Unmounting Of Navigation Routes In React Native — Smashing Magazine
Often you need two different sets of navigation stacks for pre and post user authentication. Usually, to see more content, you have to be authenticated in some way. In many Apps, authentication is one of the most important parts because it confirms that the person trying to gain access to protected content has the right to access the information. Learning how to do it right is an important step in
Open sourcing Winterfell: A STARK prover and verifier
We are releasing Winterfell, our implementation of a STARK prover/verifier to Crates.io Winterfell is an easy to use open source implementation of STARKs for security and privacy applications. One potential application for Winterfell’s zero-knowledge proofs is blockchain privacy and scalability. “Any sufficiently advanced technology is indistinguishable from magic.” —Clarke’s Third Law What if the
Cloudflare's Athenian Project Expands Internationally
Due to the growing trend of cyberattacks targeting election infrastructure, election security is not a US-specific issue. Today, we are extending our security tools to a range of election entities
15+ new code scanning integrations with open source security tools
Today, we’re happy to announce more than 15 new integrations with open source security tools that broaden our language coverage to include PHP, Swift, Kotlin, Ruby, and more.
Cloudflare's Handling of an RCE Vulnerability in cdnjs
Recently, a RCE vulnerability in the way cdnjs’ backend is automatically keeping web resources up to date has been disclosed. Read about how Cloudflare handled the security incident and what will prevent similar exploits in the future.
Upgrading the Cloudflare China Network: better performance and security through product innovation and partnership
Cloudflare and our strategic partner in China have created a global network that offers a fast experience for visitors inside and outside of China — with DDoS mitigation, web application firewall (WAF), and other security services built in.
GitHub brings supply chain security features to the Go community
GitHub’s supply chain security features are now available for Go modules, which will help the Go community discover, report, and prevent security vulnerabilities.
DDoS attack trends for 2021 Q2
The DDoS attack trends observed over Cloudflare’s network in 2021 Q2 paint a picture that reflects the overall global cyber threat landscape. Here are some highlights of DDoS attack trends observed in 2021 Q2.
How WhatsApp enables multi-device capability
For years, people have been asking us to create a true multi-device experience that allows people to use WhatsApp on other devices without requiring a smartphone connection. Today, we’re announcing the rollout of a limited public beta test for WhatsApp’s updated multi-device capability. With this new capability, you can now use WhatsApp on your phone […]
Enforcing encryption at scale
Our infrastructure supports thousands of services that handle billions of requests per second. We’ve previously discussed how we built our service encryption infrastructure to keep these globally distributed services operating securely and performantly. This post discusses the system we designed to enforce encryption policies within our network and shares some of the lessons we learned […] Read Mo
Seven years of the GitHub Security Bug Bounty program
GitHub’s bug bounty program is now a mature component of how we improve product security. We’re excited to highlight some achievements (and interesting vulnerabilities)!
Privilege escalation with polkit: How to get root on Linux with a seven-year-old bug
polkit is a system service installed by default on many Linux distributions. It’s used by systemd, so any Linux distribution that uses systemd also uses polkit.
Securing the open source supply chain by scanning for package registry credentials
GitHub secret scanning has been securing our users’ code by scanning for and revoking secrets since 2015. Recently, we’ve focused on scanning for package registry credentials as well—a significant and…
Some Articles About Accessibility I’ve Saved Recently II
Show/Hide password accessibility and password hints tutorial — Nicolas Steenhout goes deep on <input type="password"> accessibility. For one thing,
Updates to our policies regarding exploits, malware, and vulnerability research
One month ago, we started a discussion with the community about proposed revisions to clarify GitHub’s policies on security research, malware, and exploits with the goal to enable, welcome, and…
Cloudflare’s SOC as a Service
Cloudflare SOC as a Service combines our best-in-class security products and a team of cybersecurity experts within Cloudflare that augment your security and network teams
How To Implement Authentication In Next.js With Auth0 — Smashing Magazine
At the moment of adding authentication and authorization to our web applications, there are some things that we should evaluate, e.g. whether we need to create our own security platform or whether we can rely on an existing third-party service. Let’s see how we can implement authentication and authorization in Next.js apps, with Auth0.
Designing the new Cloudflare Web Application Firewall
The Cloudflare Web Application Firewall (WAF) protects websites and applications from malicious traffic attempting to exploit vulnerabilities in server software. It’s a critical piece of the broader security posture of your application.
Security keys are now supported for SSH Git operations
GitHub has been at the forefront of security key adoption for many years. We were an early adopter of Universal 2nd Factor (“U2F”) and were also one of the first…
Cloudflare obtains new ISO/IEC 27701:2019 privacy certification and what that means for you
Cloudflare is one of the first organisations in our industry to have achieved ISO/IEC 27701:2019 certification, and the first web performance & security company to be certified to the new ISO privacy standard as both a data processor and controller.
Announcing Cloudflare for SaaS for Everyone
Before today, SSL for SaaS was only available to Enterprise customers. Today, we are excited to announce that our SaaS solution is available to everyone. And to reflect the evolution of the product since it was first released, we’re changing the name: Cloudflare for SaaS.
Implementing least privilege for secrets in GitHub Actions
GitHub Actions provide a powerful, extensible way to automate software development workflows. When access to outside resources is required, GitHub provides the ability to store encrypted secrets used by GitHub…
Developers, Developers, Developers: Welcome to Developer Week 2021
This week, like we have done in previous Innovation Weeks (such as Security Week or Privacy Week), we will be making many (about 20) announcements of products and features to make developers’ lives easier.
Hackers Spill the Wine: Lockdown Led to Rise in Wine Domains and Wine Scammers
Area 1 Security and Recorded Future researchers report a significant increase in the number of new wine-themed phishing domains registered starting in April 2020, and continuing through at least March 2021.
Behind GitHub’s new authentication token formats
We’re excited to share a deep dive into how our new authentication token formats are built and how these improvements are keeping your tokens more secure. As we continue to…
Area 1 Security Announces the Most Spoofed Brand of 2020
The COVID-19 pandemic’s influence on phishing and cyberattack lures is clear. Area 1 Security identified over 2 million phishing spoofs that exploited the World Health Organization between May 2020 and February 2021.
Nour Daoud Bösing: Security Engineer
These days, I don’t need an alarm clock – I get woken up bright and early by my daughter! I live in Jersey City, just across the river from the Spotify NY office, and often used to take the ferry into work. But now, there’s no need to commute – instead, I squeeze in an hour of yoga whilst Leya is entertained by her dad.
Annual March Hackness 2021: The Not-So-Sweet 16 —The Pandemic’s Phishing Influence
The COVID-19 pandemic influenced which brands attackers exploited for phishing campaigns in 2021. For example, the World Health Organization and DocuSign made Area 1 Security’s 2021 March Hackness “Not-so-Sweet 16.”
End User Security: Account Takeover Protections with Cloudflare
End-user account security is always a top priority, but a hard problem to solve. In this post, we provide a summary of all the Cloudflare features that can help.
Fuzzing sockets: Apache HTTP, Part 2: Custom Interceptors
In this second installment, I will focus on how to build our own custom ASAN interceptors in order to catch memory bugs when custom memory pools are implemented and also on how to intercept file system syscalls to detect logic errors in the target application.
GitHub Advanced Security: Introducing security overview beta and general availability of secret scanning for private repositories
GitHub Advanced Security helps you create secure applications with a community-driven, developer-first approach. Today, we are excited to announce two updates: Beta of the new security overview for organizations and…
Keyless SSL now supports FIPS 140-2 L3 hardware security module (HSM) offerings from all major cloud providers
Private encryption keys stored in hardware security module offerings from all major cloud providers can now be used to secure HTTPS connections at Cloudflare’s global edge.
Heartbleed Revisited
TLS key compromise is a risk for all web services. Taking lessons from Heartbleed, Cloudflare offers the latest features that make key compromise less of a risk.
Page Shield: Protect User Data In-Browser
We're excited to introduce Page Shield, a client-side security product customers can use to detect attacks in end-user browsers.
Using Cloudflare for Data Loss Prevention
The increased use of cloud-based SaaS providers to store and access sensitive data introduces a swath of security risks as management of these resources can be unwieldy. The risk of data loss can be managed by using Cloudflare Access, API Shield, and Browser Isolation.
One day short of a full chain: Real world exploit chains explained
When it comes to security research, the path from bug to vulnerability to exploit can be a long one. Security researchers often end their research journey at the “Proof of…
One day short of a full chain: Part 3 – Chrome renderer RCE
In this last post of the series, I’ll exploit a use-after-free in the Chrome renderer (CVE-2020-15972), a bug that I reported in September 2020 but turned out to be a duplicate, to gain remote code execution in the sandboxed renderer process in Chrome.
New device security partnerships for Cloudflare One
Cloudflare launches new integrations with CrowdStrike, SentinelOne, and VMware Carbon Black. Cloudflare for Teams customers can now restrict access to their applications based on security signals from their devices.
Announcing antivirus in Cloudflare Gateway
We’re announcing support for malware detection and prevention directly from the Cloudflare edge, giving Gateway users an additional line of defense against security threats.
Anatomy of a Targeted Ransomware Attack
Imagine your most critical systems suddenly stop operating. And then someone demands a ransom to get your systems working again. Or someone launches a DDoS against you and demands a ransom to make it stop. That’s the world of ransomware and ransom DDoS.
Annual March Hackness: The Opener — What a Difference a Year Makes in the World of Phishing Attacks
Area 1 has been doing our own Phishing brackets over the past five years. We took a hiatus in 2020 (as did the NCAA), so today, we proudly introduce the 5th Annual March Hackness: The Phishing Tournament.