A global assessment of third-party connection tampering
Sep 5, 2024Ram Sundara Raman, Luke Valenta, Marwan Fayed
Summary
This post introduces a significant new dimension to website security by detailing Cloudflare's research into global connection tampering. It quantifies the prevalence of such tampering (20% of connections), identifies signature patterns indicative of third-party intervention (censorship, ISP blocking, enterprise security), and provides global insights into these practices through new dashboards and APIs on Cloudflare Radar. The post also explains the technical underpinnings of connection tampering, particularly related to the SNI field in TLS, and uses telephone call analogies to make the concept accessible.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack