The little bug that couldn’t: Securing OpenSSL
Software security doesn’t end at the boundaries of your own code. The moment a library dependency is introduced, you’re adopting other people’s code and any bugs that come with it.…
Hello from GitHub’s new Chief Security Officer
The world runs on software, and a large portion of it, especially the open source software that’s part of everything we experience, is built by millions of developers on GitHub…
Avoiding npm substitution attacks
Supply chain attacks are a reality in modern software development. Thankfully, you can reduce the attack surface by taking precautions and being thoughtful about how you manage your dependencies. We…
WordPress 5.7: Big ol' jQuery Update
WordPress core is making the jump from jQuery 1.12.4 to jQuery 3.5.1! This is a big deal for lots of reasons — like modern features, better DX, and security
2020 U.S. Election: Cybersecurity Analysis
As we protect many entities in the election space, we have the ability to identify, learn and analyze attack trends targeted at these sites that provide authoritative election information.
Using CWE and CVSS scores to get more context on a security advisory
Security vulnerabilities can be unpleasant to address, and that only gets worse the more you have. When you’re dealing with a large volume of vulnerabilities, you need to be able…
Data Privacy Day 2021 - Looking ahead at the always on, always secure, always private Internet
2020 was a big year for data protection, so what does 2021 have in store? On Data Privacy Day, we talk about the role data localization and encryption technologies play in data protection.
Count yourself in for a vaccine phish: new phishing campaign exploits concern over COVID-19 vaccine availability
Area 1 has uncovered a coronavirus vaccine-themed campaign spoofing the CDC. The attack, which originally bypassed Office 365’s email security, uses a number of techniques to bypass normal anti-spoofing and email authentication methods.
Managing Google Cloud Platform Project-Wide SSH Keys - Shopify
As a member of the Infrastructure Security team, Cailyn set out to create an application to silently and effectively manage SSH keys that persist inside of Shopify's Google Cloud Platform project-wide metadata.
Network-layer DDoS attack trends for Q4 2020
DDoS attack trends in the final quarter of 2020 defied norms in many ways. For the first time in 2020, Cloudflare observed an increase in the number of large DDoS attacks. Specifically, the number of attacks over 500Mbps and 50K pps saw a massive uptick.
Women in Security at Slack
Since its inception, Slack has fostered a culture of inclusion and diversity. The Security organization at Slack is a prime example of how women can thrive in the security space, transitioning to security from different backgrounds and expertises. With Slack’s strong commitment to diversity, it should not be a surprise that nearly a third of…
KEMTLS: Post-quantum TLS without signatures
The TLS 1.3 protocol has been around for quite some time, but it will be broken once quantum computers arrive. What can we do? In this blog post, we will examine a technique for achieving full post-quantum security for TLS 1.3 in the face of quantum computers: KEMTLS.
Soar: Simulation for Observability, reliAbility, and secuRity
In this article, we will discuss one of the techniques we use to fight such software complexity: simulations. Simulations are basically system tests that run with synthesized customer traffic and applications.
Untangling Compliance: Working Toward a Global Framework
As part of Cloudflare’s recent Privacy Week we hosted a series of fireside chats on security, privacy, and compliance. Many of these conversations touched on the intricate legal debate being held in Europe around data sovereignty. Here are some of the highlights.
GitHub security features: highlights from 2020
We’ve made huge advances in our security features at GitHub in 2020, with launches for code scanning, secret scanning, Dependabot version updates, dependency review, and more.
Ransom DDoS attacks target a Fortune Global 500 company
In late 2020, a major Fortune Global 500 company was targeted by a Ransom DDoS (RDDoS) attack by a group claiming to be the Lazarus Group. Cloudflare quickly onboarded them to the Magic Transit service and protected them against the lingering threat.
REST Servers in Go: Part 6 - authentication - Eli Bendersky's website
Go socket servers with TLS - Eli Bendersky's website
Go HTTPS servers with TLS - Eli Bendersky's website
Holiday Season Update from Lisbon
Cloudflare Lisbon has come a long way. We now have 74 incredibly talented people working or joining in areas such as Engineering, Security, Infrastructure, Customer Support, People, Places, Product Management, Emerging Technologies or Accounting, and growing fast.
Beat - An Acoustics Inspired DDoS Attack
On the week of Black Friday, Cloudflare automatically detected and mitigated “Beat” - an acoustics inspired DDoS attacks that targeted a Magic Transit customer.
Happy anniversary GitHub Security Lab!
Last year at GitHub Universe, we introduced the GitHub Security Lab, which is committed to contributing resources, tooling, bounties, and security research to secure the open source ecosystem. We know…
Shifting supply chain security left with dependency review
Dependency review allows you to easily understand your dependencies before you introduce them to your environment. As part of a pull request, you can see what dependencies you’re introducing, changing, or removing, and information about their vulnerabilities, age, usage, and license.
Token authentication requirements for Git operations
In July 2020, we announced our intent to require the use of token-based authentication (for example, a personal access, OAuth, or GitHub App installation token) for all authenticated Git operations.…
Encrypting your WAF Payloads with Hybrid Public Key Encryption (HPKE)
Allowing logging for payloads that trigger the Web Application Firewall has always led to end-user privacy concerns. We built encrypted matched payload logging to solve this!
Cloudflare Certifications
We think trust is fundamental to building a better Internet. Cloudflare adheres to industry-standard security compliance certifications and regulations to help our customers earn their users’ trust.
Good-bye ESNI, hello ECH!
A deep dive into the Encrypted Client Hello, a standard that encrypts privacy-sensitive parameters sent by the client, as part of the TLS handshake.
OPAQUE & PAKE Protocols
OPAQUE is a PAKE protocol that allows for password authentication without revealing the actual password to a server. Learn more about the OPAQUE protocol.
Introducing the Cloudflare Data Localization Suite
The Data Localization Suite helps businesses get the performance and security benefits of Cloudflare’s global network while making it easy to set rules and controls at the edge about where their data is stored and protected.
Now you C me, now you don’t, part two: exploiting the in-between
Aimed at developers, in this series we introduce and explore the memory unsafe attack surface of interpreted languages.
Applying DevSecOps to your software supply chain
To best apply DevSecOps principles to improve the security of your supply chain, you should ask your developers to declare your dependencies in code; and in turn provide your developers with maintained ‘golden’ artifacts and automated downstream actions so they can focus on code.
Securing the fight against COVID-19 through open source
This blog describes a security vulnerability in the infrastructure that supports Germany’s COVID-19 contact tracing efforts. The mobile (Android/iOS) apps are not affected by the vulnerability and do not collect and/or transmit any personal data other than the device’s IP address. The infrastructure takes active measures to disassociate true positives from client IP addresses.
Network-layer DDoS attack trends for Q3 2020
In Q3 ‘20, Cloudflare observed a surge in DDoS attacks, with double the number of DDoS attacks and more attack vectors deployed than ever — with a notable surge in protocol-specific DDoS attacks such as mDNS, Memcached, and Jenkins amplification floods.
Anchoring Trust: A Hardware Secure Boot Story
As a security company, we pride ourselves on finding innovative ways to protect our platform to, in turn, protect the data of our customers. Part of this approach is implementing progressive methods in protecting our hardware at scale.
When trusted relationships are formed, everyone wins!
Monday Mornings with Customer Success: A monthly series brought to you by our Customer Success Team. This month's post is all about how building trusted relationships resulted in an improved security posture and better solution for one of our customers.
SAD DNS Explained
Researchers from UC Riverside and Tsinghua University found a new way to revive a decade-old DNS cache poisoning attack. Read our deep dive into how the SAD DNS attack on DNS resolvers works, how we protect against this attack in 1.1.1.1, and what the future holds for DNS cache poisoning attacks.
Authenticating React Apps With Auth0 — Smashing Magazine
An important aspect of app development is ensuring that only verified users have access to our apps. This can be tedious and costly do, especially when you add alternative methods of logging in outside emails and passwords. Auth0 is a service that provides authentication functionalities to developers out of the box. In this article, we’ll learn how to authenticate our React apps using Auth0. We wi
What is an Integrated Email Security solution? And is it right for your organization?
Gartner has named Area 1 Security as a Representative Vendor for IESS. We believe, Area 1 Security, as an IESS, provides the core functionalities of a SEG, but has the advantage of being very quick and easy to deploy, without requiring changes to the email flow at the gateway.
How to get root on Ubuntu 20.04 by pretending nobody’s /home
Ubuntu 20.04 local privilege escalation using vulnerabilities in gdm3 and accountsservice (CVE-2020-16125, CVE-2020-16126, CVE-2020-16127)
Phishing campaign threatens job security, drops Bazar and Buer Malware
A phishing campaign is threatening targets with false claims of employment termination. The goal of the attacker is to intimidate employees into clicking on a link that will ultimately lead to Bazar or Buer malware infections by way of Trickbot.
Announcing Spectrum DDoS Analytics and DDoS Insights & Trends
We’re excited to announce the expansion of the Network Analytics dashboard to Spectrum customers on the Enterprise plan. Additionally, this announcement introduces two major dashboard improvements for easier reporting and investigation.
ShiftLeft on Refactoring a Live SaaS Environment - High Scalability -
This is guest a post by Preetam Jinka, Senior Infrastructure Engineer at ShiftLeft. Originally published here. ShiftLeft NextGen Static Analysis (NG SAST) is a software-as-a-service static analysis solution that allows developers to scan every pull request for security issues. Earlier this year we released Secrets, Security Insights, and a v4 API. Secrets and Security Insights are two new types of
Code Scanning a GitHub Repository using GitHub Advanced Security within an Azure DevOps Pipeline
In this blog post we demonstrate how to integrate the GitHub Advanced Security code scanning capability into our Azure DevOps Pipelines. We provide code snippets and examples that can guide you or your developers working to integrate Code Scanning into any 3rd Party CI tool.
Exploiting a textbook use-after-free security vulnerability in Chrome
In this post I’ll give details about how to exploit CVE-2020-6449, a use-after-free (UAF) in the WebAudio module of Chrome that I discovered in March 2020. I’ll give an outline of the general strategy to exploit this type of UAF to achieve a sandboxed RCE in Chrome by a single click (and perhaps a 2 minute wait) on a malicious website.
Authentication In Vue.js — Smashing Magazine
Every web application that handles user-specific data needs to implement authentication. Knowing how to do this is important for Vue developers, and that’s what this article aims to shed the spotlight on. Today, Precious Ndubueze brings you a tutorial that will prove to be useful for beginner developers who want to learn about authentication in Vue. In order to be able to follow along, you’ll need
How To Overcome Data Onboarding Challenges For Software Products — Smashing Magazine
Data onboarding with a custom-built solution can be a difficult and error-prone process. Now imagine what happens when you increase the complexity, allowing for different file types, more users, varying sources and a greater need for security and compliance. It shouldn’t be up to your software end users to work out the kinks of your data onboarding, nor should your team have to do it. In this post
A Virtual Product Management Internship Experience
In July 2020, I joined Cloudflare as a Product Management Intern on the DDoS (Distributed Denial of Service) team to enhance the benefits that Network Analytics brings to our customers. This is my experience.
Bot Attack trends for Jan-Jul 2020
Automated traffic makes up almost 40% of total Internet traffic. Let’s take a look at how bots behaved over 2020 so far.
With 14 days to go, we haven’t nailed the basics: election security risks from expired domains
Failure for any organization to properly register their domains poses several key risks. For example, anyone who might register an election-sensitive domain would be able to assume the identity of elections officials and send phishing emails.
One more (Zero Trust) thing: Cloudflare Intrusion Detection System
We’re very excited to announce our plans for Cloudflare Intrusion Detection System, a new product that monitors your network and alerts when an attack is suspected.
Spike in Amazon phishing for Prime Day: a new day of deals means new phishing campaigns
Cyber criminals target Amazon Prime members. 2020 Prime Day phishing attacks attempt to steal credit card details, PII data.
Introducing Cloudflare One
Today we’re announcing Cloudflare One. It provides secure, fast, reliable, cost-effective network services, integrated with leading identity management and endpoint security providers.
What is Cloudflare One?
Today, we’re excited to share Cloudflare One™, our vision to tackle the intractable job of corporate security and networking. Run your network on Cloudflare and keep it secure.
Announcing third-party code scanning tools: infrastructure as code and container scanning
Last week we launched code scanning out of beta and have since announced integrations with static analysis and developer security training solutions. By expanding our GitHub security ecosystem, developers can…
PAC spoof drops Emotet: phishing campaign leverages stolen PAC content to drop Emotet
President Donald Trump, election fundraising, Microsoft Office 365 used to send Emotet malware in fake Political Action Committee phishing email.
Know When You’ve Been DDoS’d
Today we’re announcing the availability of DDoS attack alerts. The alerts are available for free for all Cloudflare’s customers on paid plans. Learn how to create an alert.
Announcing third-party code scanning tools: static analysis & developer security training
Last week, we launched code scanning for all open source and enterprise developers, and we promised we’d share more on our extensibility capabilities and the GitHub security ecosystem. Today, we’re…
NTS is now an RFC
After much hard work, NTS finally becomes an official RFC.This means that Network Time Security (NTS) is officially part of the collection of protocols that makes the Internet work.
Announcing support for gRPC
Today we're excited to announce beta support for proxying gRPC, a next-generation protocol that allows you to build APIs at scale. With gRPC on Cloudflare, you get access to the security, reliability and performance features that you're used to having at your fingertips for traditional APIs.
Speeding up HTTPS and HTTP/3 negotiation with... DNS
A look at a new DNS resource record intended to speed-up negotiation of HTTP security and performance features and how it will help make the web faster.
