Code scanning is now available!
Now available, code scanning is a developer-first, GitHub-native approach to easily find security vulnerabilities before they reach production.
Phishing Resistant SMS Autofill
We recently shipped support for the origin-bound draft standard for security codes delivered via SMS. This standard ensures security codes are entered in a phishing-resistant manner. It accomplishes this by binding an SMS with…
A Year Later: Reflections on the ANZ Security Landscape
It’s been one year since I joined Cloudflare as Head of Australia and New Zealand. Our team has been even more humbled by our mission to help build a better Internet and help organisations face the increased security threats COVID-19 has triggered.
Are you GDPR-compliant? New phishing message harvests credentials with GDPR lure
Credential harvesting phishing emails leverage GDPR compliance and exploits cloud-based services, Virtual Private Servers, to target sales executives.
GitHub Enterprise Server 2.22 is here
GitHub Enterprise Server 2.22 is now here with GitHub Actions, Packages and Advanced Security Code Scanning available for the very first time.
The grey area of software security: Whose responsibility is it?
Security is a complex area. One software component may break the assumptions made by another component and it is not always clear who should fix the code to remediate the security implications.
Join us for OctogatosConf
A free two-day single track conference live on September 24 – 25, 2020 in celebration of our culture and LatinX heritage month. You will join a live stream of interactive talks by industry experts in both Spanish, Portuguese and English, with live captioning and translation. Topics will include software development, security, technical project management, civic tech, open source, professional deve
Moobot vs. Gatebot: Cloudflare Automatically Blocks Botnet DDoS Attack Topping At 654 Gbps
On July 3, Cloudflare’s global DDoS protection system, Gatebot, automatically detected and mitigated a UDP-based DDoS attack that peaked at 654 Gbps. The attack was part of a ten-day multi-vector DDoS campaign targeting a Magic Transit customer and was mitigated without any human intervention.
Secondary DNS - Deep Dive
The goal of Cloudflare operated Secondary DNS is to allow our customers with custom DNS solutions, be it on-premise or some other DNS provider, to be able to take advantage of Cloudflare's DNS performance and more recently, through Secondary Override, our proxying and security capabilities too.
Latest SBA phishing attempt: stealthy social engineering phish using newly registered domains attempts to gain bank details
Area 1 blocks social engineering, COVID-19 phishing emails impersonating Small Business Administration, using Newly Registered Domains, PDF attachments.
Smart Interface Design Patterns In Your Pocket: Checklist Cards PDF — Smashing Magazine
Meet our Smart Interface Design Patterns Checklist Cards, a deck of 100 cards with questions to ask when designing and building any interface component — carousel, hamburger, table, date picker, autocomplete, slider, onboarding, pricing plans, authentication, web forms and many others. Check the preview (PDF) and jump to description ↓
State of Jamstack 2020: Data Deep Dive
The Jamstack, a modern approach to building websites and apps, delivers better performance, higher security, lower cost of scaling, and a better developer
How we threat model
At GitHub, we spend a lot of time thinking about and building secure products—and one key facet of that is threat modeling. This practice involves bringing security and engineering teams…
Secure at every step: What is software supply chain security and why does it matter?
The most important way to protect supply chain threats? Scan code for security vulnerabilities, learn how to find vulnerabilities in code, and quickly patch them with dynamic code analysis tools.
How Argo Tunnel engineering uses Argo Tunnel
Argo Tunnel provides remote access to development environments by creating secure outbound-only connections to Cloudflare’s edge network from a resource exposing it to the Internet. That model helps protect servers and resources from being vulnerable to attack by an exposed IP address.
“Face mask manufacturer” supplies Agent Tesla Malware: campaign employs Covid-19 lures and sophisticated evasion techniques
Covid-19 phishing attack exploits need for face masks, thermometers to launch Agent Tesla malware (advanced Remote Access Trojan); bypasses gateways, DMARC.
Secure at every step: Putting DevSecOps into practice with code scanning
Integrating static analysis security testing into the developer workflow is hard. We discuss the challenges and how to overcome them
Now you C me, now you don’t: An introduction to the hidden attack surface of interpreted languages
Aimed at developers, in this series we introduce and explore the memory unsafe attack surface of interpreted languages.
How Cloudflare uses Cloudflare Spectrum: A look into an intern’s project at Cloudflare
As part of my onboarding as an intern on the Spectrum (a layer 4 reverse proxy) team, I learned that many internal services dogfood Spectrum, as they are exposed to the Internet and benefit from layer 4 DDoS protection.
How to Have an Impactful Internship… Virtually
The start of any internship brings a wide range of emotions, from excitement to nervousness. After months of anticipating our first day at Slack, reality sunk in that this summer would be extremely different from any other. Due to the pandemic, our entire experience would be virtual. As the two interns for the Product Security…
July bonus Microsoft spear phishing
The creators of two Microsoft phishing campaigns, that Area 1 has dubbed “Summer Bonus”, are attempting to lure unsuspecting employees into divulging their Microsoft credentials.
Secure at every step: A guide to DevSecOps, shifting left, and GitOps
When developers share the responsibility of security, perform security testing earlier in your development lifecycle, and use Git as a source of truth, you can help your development teams find and remediate security issues faster.
DELF: Safeguarding deletion correctness in online social networks
What the research is: DELF is a new framework to help developers implement data deletion in modern applications. Traditional methods for implementing deletion require application developers to write repetitive, error-prone code. DELF’s main novelty lies in enabling developers to implement deletion in every product they build with minimal effort, which takes the form of annotations […]
Pysa: An open source static analysis tool to detect and prevent security issues in Python code
Today, we are sharing details about Pysa, an open source static analysis tool we’ve built to detect and prevent security and privacy issues in Python code. Last year, we shared how we built Zoncolan, a static analysis tool that helps us analyze more than 100 million lines of Hack code and has helped engineers prevent […]
Achieving DevSecOps maturity with a developer-first, community-driven approach
GitHub provides the security capabilities to achieve Level 1 of the OWASP DevSecOps Maturity Model. In this post, we explore the principles of DSOMM Level 1 and how you can implement secret scanning, SCA, SAST and DAST using native tooling on GitHub.
Network-layer DDoS attack trends for Q2 2020
This quarter, we saw an increasing number of large scale attacks; both in terms of packet rate and bit rate. In fact, 88% of all DDoS attacks in 2020 that peaked above 100 Gbps were launched after shelter-in-place went into effect in March.
Secure at every step: How GitHub’s dependency graph is generated
GitHub’s dependency graph identifies all upstream dependencies and public downstream dependents of a repository or package by parsing manifest files, so that you can better manage the security and compliance of your dependencies.
GitHub joins the Open Source Security Foundation
We are happy to announce that GitHub is joining the Open Source Security Foundation (OpenSSF) as a founding member, alongside Google, IBM, JPMorgan Chase, Microsoft, NCC Group, OWASP Foundation, Red Hat, and others.
Token authentication requirements for API and Git operations
As previously announced, beginning November 13th, 2020, we will no longer accept account passwords when authenticating with the REST API and will require the use of token-based authentication (e.g., a…
Mitigating Spectre and Other Security Threats: The Cloudflare Workers Security Model
Cloudflare is a security company, and the heart of Workers is, in my view, a security project. Running code written by third parties is always a scary proposition, and the primary concern of the Workers team is to make that safe.
New Area 1 security study shows that U.S. State & local election administrators remain vulnerable to phish
With only 100 days until Election Day, Area 1 Security’s new “Phishing Election Administrators” report assesses the depth of current email security controls used by 10,000 U.S. state and local election administrators.
Secure at every step: Show your dependencies some love with updates
Keep dependencies up to date, to make sure you can quickly apply a patch when it really matters – when there’s a critical security vulnerability.
Hardening your GitHub Enterprise Server
GitHub stores your source code, releases, and a vast amount of invaluable information in issues and pull requests. While GitHub Enterprise Server (GHES), our self hosted solution, provides great security by default, administrators can take additional steps to further harden their appliance. This post will guide you through the most important settings.
Securing your open source dependencies with GitHub dependency insights
GitHub dependency insights helps both developers and security teams manage their open source security with confidence—automatically compiling relevant CVE information, aiding in OSS license compliance, and helping them better understand their OSS dependency versions.
flowtrackd: DDoS Protection with Unidirectional TCP Flow Tracking
flowtrackd is a software-defined DDoS protection system that significantly improves our ability to automatically detect and mitigate even the most complex TCP-based DDoS attacks. If you are a Magic Transit customer, this feature will be enabled by default at no additional cost on July 29, 2020.
Mitigating a 754 Million PPS DDoS Attack Automatically
On June 20, Cloudflare automatically mitigated a highly volumetric DDoS attack that peaked above 754 million packets per second. The attack was part of an organized four day campaign starting on June 18 and ending on June 21.
CVE-2020-5902: Helping to protect against the F5 TMUI RCE vulnerability
Cloudflare has deployed a new managed rule protecting customers against a remote code execution vulnerability that has been found in F5 BIG-IP’s web-based Traffic Management User Interface (TMUI).
Bean Stalking: Growing Java beans into Remote Code Execution
In this post I’ll show how input validation which should be used to prevent malformed inputs to enter our applications, open up the doors to Remote Code Execution (RCE).
Git Credential Manager Core: Building a universal authentication experience
Authentication is a critical component to your daily development. When working in open source, you need to prove that you have rights to update a branch with git push. Additionally…
Making the WAF 40% faster
As with all Cloudflare security products, the WAF is designed to not sacrifice performance for security, but there is always room for improvement. This blog post provides a brief overview of the latest performance improvements that were rolled out to our customers.
Looking back on the GitHub Security Lab Capture The Flag: CodeQL and chill
One year ago, the security research team at Semmle launched its first Capture the Flag (CTF), as part of the Hack In The Box (HITB) Amsterdam conference. We wanted to…
How Dropbox Security builds tools for threat detection and incident response
GitHub Enterprise Server 2.21 is here
GitHub Enterprise Server 2.21 is now available with updates to simplify collaboration, increase reliability and improve security.
The App Sandbox
Batten down the hatches! The app sandbox is now enabled for all web content. This is a fancy way of saying we’ve dialed up the security of the app. It wasn’t unsafe before, but it’s double safe now. What is the “app sandbox,” what is it protecting against, and why does it matter? This post…
Using data science and machine learning for improved customer support
In this blog post we’ll explore three tricks that can be used for data science that helped us solve real problems for our customer support group and our customers. Two for natural language processing in a customer support context and one for identifying attack Internet attack traffic.
The Octopus Scanner Malware: Attacking the open source supply chain
This post details how an open source supply chain malware spread through build artifacts. 26 open source projects were backdoored by this malware and were actively serving backdoored code.
Tanium’s endpoint security meets Cloudflare for Teams
Deploy comprehensive zero-trust security by integrating Tanium with Cloudflare for Teams.
Giving credit for Security Advisories
Saying thanks is now a core part of the Security Advisory workflow.
Tackling Authentication With Vue Using RESTful APIs
Authentication (logging in!) is a crucial part of many websites. Let’s look at how to go about it on a site using Vue, in the same way it can be done with any
A Brief History of TLS Certificates at Shopify - Shopify
In this post, we’ll cover Shopify’s journey from manually provisioning TLS certificates to the fully automated system that supports over 1M businesses.
Hot lava: A case study in hunting for network integer arithmetic flaws
We examine the dangers of network integer arithmetic based on a case study of security vulnerabilities reported to the ntop project.
Capture the Flag 4—CodeQL and chill
Join our Capture the Flag challenge to use your CodeQL skills or learn new ones.
A single dashboard for Cloudflare for Teams
Cloudflare Access is now available in the Cloudflare for Teams UI. You can now manage application and threat security for your organization in a single dashboard.
DDoS attacks have evolved, and so should your DDoS protection
Building a modern DDoS solution that is truly effective in thwarting ever-evolving DDoS attacks, to protect all of our customers has been a core tenet for us - enabling us to be an industry leader.
Triggering garbage collection with rejected promises to cause use-after-free in Chrome
In this post I’ll show how garbage collections (GC) in Chrome may be triggered with small memory allocations in unexpected places, which was then used to cause a use-after-free bug.
How to build an effective DevSecOps culture
By prioritizing secure development alongside speed, DevSecOps helps you ship safer applications by making security part of your current DevOps pipeline.
Deploying Gateway using a Raspberry Pi, DNS over HTTPS and Pi-hole
Like many, I work remotely and want to show how to deploy Cloudflare Gateway from home. Its DNS filtering protects networks from malware, phishing, ransomware, and other security threats effectively.
Dropping hashes: an idiom used to demonstrate provenance of documents
There exists an idiom called “dropping a hash” which is widely understood in the security community and not widely understood elsewhere. Somewhat surprisingly, there does not appear to be a canonical explanation. I have dropped hashes before and wrote this up to explain the significance of it to non-specialists.
Git credential helper vulnerability announced (Update)
Learn more about the security vulnerabilities affecting Git 2.26.1 and older.
Sawfish phishing campaign targets GitHub users
A phishing campaign targeting our customers lures GitHub users into providing their credentials (including two-factor authentication codes). Learn more about the threat and what you can do to protect yourself.
