1,037 articles on Security.
We’re excited to announce the expansion of the Network Analytics dashboard to Spectrum customers on the Enterprise plan. Additionally, this announcement introduces two major dashboard improvements for easier reporting and investigation.
This is guest a post by Preetam Jinka, Senior Infrastructure Engineer at ShiftLeft. Originally published here. ShiftLeft NextGen Static Analysis (NG SAST) is a software-as-a-service static analysis solution that allows developers to scan every pull request for security issues. Earlier this year we released Secrets, Security Insights, and a v4 API. Secrets and Security Insights are two new types of
In this blog post we demonstrate how to integrate the GitHub Advanced Security code scanning capability into our Azure DevOps Pipelines. We provide code snippets and examples that can guide you or your developers working to integrate Code Scanning into any 3rd Party CI tool.
In this post I’ll give details about how to exploit CVE-2020-6449, a use-after-free (UAF) in the WebAudio module of Chrome that I discovered in March 2020. I’ll give an outline of the general strategy to exploit this type of UAF to achieve a sandboxed RCE in Chrome by a single click (and perhaps a 2 minute wait) on a malicious website.
Every web application that handles user-specific data needs to implement authentication. Knowing how to do this is important for Vue developers, and that’s what this article aims to shed the spotlight on. Today, Precious Ndubueze brings you a tutorial that will prove to be useful for beginner developers who want to learn about authentication in Vue. In order to be able to follow along, you’ll need
Data onboarding with a custom-built solution can be a difficult and error-prone process. Now imagine what happens when you increase the complexity, allowing for different file types, more users, varying sources and a greater need for security and compliance. It shouldn’t be up to your software end users to work out the kinks of your data onboarding, nor should your team have to do it. In this post
In July 2020, I joined Cloudflare as a Product Management Intern on the DDoS (Distributed Denial of Service) team to enhance the benefits that Network Analytics brings to our customers. This is my experience.
Automated traffic makes up almost 40% of total Internet traffic. Let’s take a look at how bots behaved over 2020 so far.
Failure for any organization to properly register their domains poses several key risks. For example, anyone who might register an election-sensitive domain would be able to assume the identity of elections officials and send phishing emails.
We’re very excited to announce our plans for Cloudflare Intrusion Detection System, a new product that monitors your network and alerts when an attack is suspected.
Cyber criminals target Amazon Prime members. 2020 Prime Day phishing attacks attempt to steal credit card details, PII data.
Today we’re announcing Cloudflare One. It provides secure, fast, reliable, cost-effective network services, integrated with leading identity management and endpoint security providers.
Today, we’re excited to share Cloudflare One™, our vision to tackle the intractable job of corporate security and networking. Run your network on Cloudflare and keep it secure.
Last week we launched code scanning out of beta and have since announced integrations with static analysis and developer security training solutions. By expanding our GitHub security ecosystem, developers can…
President Donald Trump, election fundraising, Microsoft Office 365 used to send Emotet malware in fake Political Action Committee phishing email.
Today we’re announcing the availability of DDoS attack alerts. The alerts are available for free for all Cloudflare’s customers on paid plans. Learn how to create an alert.
Last week, we launched code scanning for all open source and enterprise developers, and we promised we’d share more on our extensibility capabilities and the GitHub security ecosystem. Today, we’re…
After much hard work, NTS finally becomes an official RFC.This means that Network Time Security (NTS) is officially part of the collection of protocols that makes the Internet work.
Today we're excited to announce beta support for proxying gRPC, a next-generation protocol that allows you to build APIs at scale. With gRPC on Cloudflare, you get access to the security, reliability and performance features that you're used to having at your fingertips for traditional APIs.
A look at a new DNS resource record intended to speed-up negotiation of HTTP security and performance features and how it will help make the web faster.
Now available, code scanning is a developer-first, GitHub-native approach to easily find security vulnerabilities before they reach production.
We recently shipped support for the origin-bound draft standard for security codes delivered via SMS. This standard ensures security codes are entered in a phishing-resistant manner. It accomplishes this by binding an SMS with…
It’s been one year since I joined Cloudflare as Head of Australia and New Zealand. Our team has been even more humbled by our mission to help build a better Internet and help organisations face the increased security threats COVID-19 has triggered.
Credential harvesting phishing emails leverage GDPR compliance and exploits cloud-based services, Virtual Private Servers, to target sales executives.
GitHub Enterprise Server 2.22 is now here with GitHub Actions, Packages and Advanced Security Code Scanning available for the very first time.
Security is a complex area. One software component may break the assumptions made by another component and it is not always clear who should fix the code to remediate the security implications.
A free two-day single track conference live on September 24 – 25, 2020 in celebration of our culture and LatinX heritage month. You will join a live stream of interactive talks by industry experts in both Spanish, Portuguese and English, with live captioning and translation. Topics will include software development, security, technical project management, civic tech, open source, professional deve
On July 3, Cloudflare’s global DDoS protection system, Gatebot, automatically detected and mitigated a UDP-based DDoS attack that peaked at 654 Gbps. The attack was part of a ten-day multi-vector DDoS campaign targeting a Magic Transit customer and was mitigated without any human intervention.
The goal of Cloudflare operated Secondary DNS is to allow our customers with custom DNS solutions, be it on-premise or some other DNS provider, to be able to take advantage of Cloudflare's DNS performance and more recently, through Secondary Override, our proxying and security capabilities too.
Area 1 blocks social engineering, COVID-19 phishing emails impersonating Small Business Administration, using Newly Registered Domains, PDF attachments.
Meet our Smart Interface Design Patterns Checklist Cards, a deck of 100 cards with questions to ask when designing and building any interface component — carousel, hamburger, table, date picker, autocomplete, slider, onboarding, pricing plans, authentication, web forms and many others. Check the preview (PDF) and jump to description ↓
The Jamstack, a modern approach to building websites and apps, delivers better performance, higher security, lower cost of scaling, and a better developer
At GitHub, we spend a lot of time thinking about and building secure products—and one key facet of that is threat modeling. This practice involves bringing security and engineering teams…
The most important way to protect supply chain threats? Scan code for security vulnerabilities, learn how to find vulnerabilities in code, and quickly patch them with dynamic code analysis tools.
Argo Tunnel provides remote access to development environments by creating secure outbound-only connections to Cloudflare’s edge network from a resource exposing it to the Internet. That model helps protect servers and resources from being vulnerable to attack by an exposed IP address.
Covid-19 phishing attack exploits need for face masks, thermometers to launch Agent Tesla malware (advanced Remote Access Trojan); bypasses gateways, DMARC.
Integrating static analysis security testing into the developer workflow is hard. We discuss the challenges and how to overcome them
Aimed at developers, in this series we introduce and explore the memory unsafe attack surface of interpreted languages.
As part of my onboarding as an intern on the Spectrum (a layer 4 reverse proxy) team, I learned that many internal services dogfood Spectrum, as they are exposed to the Internet and benefit from layer 4 DDoS protection.
The start of any internship brings a wide range of emotions, from excitement to nervousness. After months of anticipating our first day at Slack, reality sunk in that this summer would be extremely different from any other. Due to the pandemic, our entire experience would be virtual. As the two interns for the Product Security…
The creators of two Microsoft phishing campaigns, that Area 1 has dubbed “Summer Bonus”, are attempting to lure unsuspecting employees into divulging their Microsoft credentials.
When developers share the responsibility of security, perform security testing earlier in your development lifecycle, and use Git as a source of truth, you can help your development teams find and remediate security issues faster.
What the research is: DELF is a new framework to help developers implement data deletion in modern applications. Traditional methods for implementing deletion require application developers to write repetitive, error-prone code. DELF’s main novelty lies in enabling developers to implement deletion in every product they build with minimal effort, which takes the form of annotations […]
Today, we are sharing details about Pysa, an open source static analysis tool we’ve built to detect and prevent security and privacy issues in Python code. Last year, we shared how we built Zoncolan, a static analysis tool that helps us analyze more than 100 million lines of Hack code and has helped engineers prevent […]
GitHub provides the security capabilities to achieve Level 1 of the OWASP DevSecOps Maturity Model. In this post, we explore the principles of DSOMM Level 1 and how you can implement secret scanning, SCA, SAST and DAST using native tooling on GitHub.
This quarter, we saw an increasing number of large scale attacks; both in terms of packet rate and bit rate. In fact, 88% of all DDoS attacks in 2020 that peaked above 100 Gbps were launched after shelter-in-place went into effect in March.
GitHub’s dependency graph identifies all upstream dependencies and public downstream dependents of a repository or package by parsing manifest files, so that you can better manage the security and compliance of your dependencies.
We are happy to announce that GitHub is joining the Open Source Security Foundation (OpenSSF) as a founding member, alongside Google, IBM, JPMorgan Chase, Microsoft, NCC Group, OWASP Foundation, Red Hat, and others.
As previously announced, beginning November 13th, 2020, we will no longer accept account passwords when authenticating with the REST API and will require the use of token-based authentication (e.g., a…
Cloudflare is a security company, and the heart of Workers is, in my view, a security project. Running code written by third parties is always a scary proposition, and the primary concern of the Workers team is to make that safe.
With only 100 days until Election Day, Area 1 Security’s new “Phishing Election Administrators” report assesses the depth of current email security controls used by 10,000 U.S. state and local election administrators.
Keep dependencies up to date, to make sure you can quickly apply a patch when it really matters – when there’s a critical security vulnerability.
GitHub stores your source code, releases, and a vast amount of invaluable information in issues and pull requests. While GitHub Enterprise Server (GHES), our self hosted solution, provides great security by default, administrators can take additional steps to further harden their appliance. This post will guide you through the most important settings.
GitHub dependency insights helps both developers and security teams manage their open source security with confidence—automatically compiling relevant CVE information, aiding in OSS license compliance, and helping them better understand their OSS dependency versions.
flowtrackd is a software-defined DDoS protection system that significantly improves our ability to automatically detect and mitigate even the most complex TCP-based DDoS attacks. If you are a Magic Transit customer, this feature will be enabled by default at no additional cost on July 29, 2020.
On June 20, Cloudflare automatically mitigated a highly volumetric DDoS attack that peaked above 754 million packets per second. The attack was part of an organized four day campaign starting on June 18 and ending on June 21.
Cloudflare has deployed a new managed rule protecting customers against a remote code execution vulnerability that has been found in F5 BIG-IP’s web-based Traffic Management User Interface (TMUI).
In this post I’ll show how input validation which should be used to prevent malformed inputs to enter our applications, open up the doors to Remote Code Execution (RCE).
Authentication is a critical component to your daily development. When working in open source, you need to prove that you have rights to update a branch with git push. Additionally…
As with all Cloudflare security products, the WAF is designed to not sacrifice performance for security, but there is always room for improvement. This blog post provides a brief overview of the latest performance improvements that were rolled out to our customers.
