Website Security & Threat Management

8/7/2026

This post details the Web Integrity & Trust team's strategy for managing 'agentic' internet traffic, focusing on a 'Trust' framework over simple risk assessment. It introduces the Precursor system for continuous, session-wide behavioral analysis to detect subtle bot activity and drive up the cost for bot developers. The post also announces updates to BotBase to track all known bots and the upcoming 'Adaptive Intelligence' engine for predictive bot detection. Interactive demos and advanced mitigation strategies like unpredictable responses and AI Labyrinth are discussed.

7/17/2026

This post details the deployment of two new Cloudflare WAF Managed Rules to protect against CVE-2026-60137 (SQL Injection) and CVE-2026-63030 (Unauthenticated Remote Code Execution) vulnerabilities in WordPress. It outlines the specific rule IDs, default actions (Block), and the technical mechanisms by which these rules detect and mitigate the attacks by inspecting crafted parameter values and targeting the REST API batch endpoint. The post also emphasizes that these rules are a defense-in-depth measure and not a replacement for patching the underlying WordPress software.

7/13/2026

Introduced Precursor, a client-side, session-based verification system that uses dynamically injected JavaScript to continuously collect behavioral signals (e.g., mouse movement, keyboard activity, focus changes, visibility) throughout a user session. This data is processed on the edge to distinguish human traffic from automated or agentic traffic, enhancing bot protection by analyzing behavior over time rather than just at isolated checkpoints. Precursor is designed with privacy in mind, capturing timing and rhythm of keyboard activity but not the keys pressed, and evaluating signals as aggregate patterns. It also introduces session-based views in Security Analytics to explore full visitor journeys.

7/1/2026

Introduced a new pragmatic taxonomy for classifying automated traffic into three primary AI use cases: Search, Agent, and Training. This taxonomy allows for more granular control over bot access, moving beyond a simple 'AI bot' block. New defaults will be applied on September 15, 2026, blocking Training and Agent bots on pages displaying ads by default, while allowing Search bots. Multi-purpose crawlers will be subject to the most restrictive applicable rules. Launched BotBase for Enterprise customers, providing a searchable database of known bots and their classifications, with future plans for direct control. Introduced new 'content use' settings (immediate, reference, full) to further refine bot management based on how content is stored and reused. Extended Content Signals with a new `use` signal in robots.txt.

7/1/2026

This post introduces Attribution Business Insights, a new dashboard for Cloudflare Bot Management customers. It provides granular data on AI crawler traffic, including crawl-to-referral ratios, bot operator breakdowns, and classifications of AI bots (Training, Search, Agent). This empowers website owners to understand the economic impact of AI crawlers, differentiate between beneficial and harmful bot traffic, and inform business decisions regarding content access and licensing.

6/12/2026

This post details how Cloudflare achieved a 10x increase in global scanning capacity for its Security Insights feature. It describes the technical challenges and solutions implemented, including scaling Kafka by introducing batch processing and parallel goroutines, avoiding head-of-line blocking with a 'slow lane' and 'fast lane' approach, optimizing database inserts using a hybrid UNNEST/COPY strategy, resolving API latency issues by switching to an active-passive configuration, and rethinking the scheduler with independent zone scheduling, randomized timing, and adaptive rate limiting to ensure uniform scan distribution and handle increased scanning frequency for all customers.

6/9/2026

This post details Cloudflare's architectural approach to defending against advanced cyber threats, particularly those amplified by frontier AI models. It emphasizes a layered defense strategy, including the WAF with ML-based Attack Scores, API Shield for positive security models, Bot Management for detecting automated traffic, and Zero Trust Network Access for internal applications. The post highlights the use of Cloudforce One threat intelligence and rapid WAF rule deployment, as well as the integration of IdP Federation for consistent security. The core argument is that the architecture surrounding a vulnerability is more critical than the speed of patching, especially in the face of AI-accelerated discovery and exploit generation.

6/8/2026

Introduces a new integration that allows WAF rules to be written using live threat intelligence data. This enables proactive blocking of known bad actors, threat actors targeting specific industries or countries, and specific attack types by populating specialized fields during request processing. The feature leverages an always-on detection framework and provides O(1) constant-time lookups against compressed threat intelligence datasets distributed globally. New WAF fields like `cf.intel.ip.attacker_names`, `cf.intel.ip.target_industries`, `cf.intel.ip.attacker_countries`, and `cf.intel.ip.target_countries` are exposed to the WAF engine. The post also details how these fields integrate with the WAF rule builder (API & Terraform), Security Analytics, and the Threat Events dashboard for rule creation.

5/12/2026

This post details a bug discovered in Cloudflare's quiche implementation of the CUBIC congestion control algorithm for QUIC. The bug caused the congestion window (cwnd) to become permanently pinned at its minimum after a congestion collapse event, preventing recovery. The post traces the origin of the bug to a Linux kernel optimization for handling idle periods in TCP, which was ported to quiche. It explains how the user-space nature of QUIC and a subtle difference in how idle periods were handled led to the bug, resulting in rapid oscillations between congestion avoidance and recovery states. A fix, derived from a subsequent kernel patch, is presented to resolve the issue.

5/7/2026

This post details Cloudflare's rapid response to the "Copy Fail" Linux kernel vulnerability (CVE-2026-31431). It explains the vulnerability's mechanism involving the AF_ALG socket family, scatterlists, and out-of-bounds writes to the page cache, enabling privilege escalation. Cloudflare's response involved assessing fleet exposure, validating that existing behavioral detections flagged the exploit pattern within minutes, conducting threat hunting for pre-disclosure exploitation, and engineering a runtime mitigation (bpf-lsm) while simultaneously rolling out patched Linux kernels. The post emphasizes that no customer impact occurred and highlights the effectiveness of their proactive security posture and established patching procedures.

4/30/2026

This post announces the general availability of post-quantum encryption for Cloudflare IPsec, utilizing the hybrid ML-KEM (FIPS 203) standard. It details the implementation of the new hybrid IPsec handshake, explains the four-year delay compared to TLS in adopting this standard, and highlights successful interoperability testing with Cisco and Fortinet branch connectors. The post also discusses the importance of interoperable standards for widespread adoption and contrasts post-quantum cryptography with Quantum Key Distribution (QKD).

4/21/2026

This post discusses the evolution of web protection beyond the 'bots vs. humans' dichotomy. It highlights how emerging AI clients bypass traditional browser-based interactions, disrupting the publisher-user balance. The post details the client-server model and current bot management techniques, which rely on passive and active client signals, as well as server signals. It introduces the 'rate limit trilemma' (decentralized, anonymous, accountable) and argues that the focus should shift to detecting intent and behavior rather than just identifying humans or bots, especially in light of new clients that don't exhibit traditional browser behaviors.

4/14/2026

Introduced scannable API token formats (cfk_, cfut_, cfat_) with checksums for better detection by credential scanning tools. Integrated with GitHub's Secret Scanning program for automated revocation of leaked tokens in public repositories. Extended credential leak protection to Cloudflare One customers via Credentials and Secrets DLP profile across network traffic, outbound email, and data at rest. Integrated AI Gateway with DLP profiles for scanning prompts and responses. Improved OAuth consent experience by providing visibility into requesting third-party applications, scopes, and accounts, with a new 'Connected Applications' experience for management and revocation. Expanded resource-scoped RBAC to new resources, including Access Applications, to enable fine-grained permissioning for users and agents.

4/8/2026

Introduced a novel tool leveraging symbolic execution and the Z3 theorem prover to automatically generate "magic packets" that trigger Linux malware hidden within classic BPF socket programs. This significantly reduces the manual effort required for security researchers to reverse-engineer stealthy backdoors.

3/31/2026

Introduced Programmable Flow Protection for Magic Transit customers, enabling custom DDoS mitigation logic for UDP-based protocols using eBPF. This allows customers to define 'good' and 'bad' packets based on proprietary protocol knowledge and deploy this logic across Cloudflare's global network. The system integrates with existing DDoS mitigation systems and provides stateful tracking and challenge mechanisms.

3/30/2026

Introduced an AI detection system for malicious JavaScript that uses a two-stage architecture: a Graph Neural Network (GNN) for high recall and an open-source Large Language Model (LLM) hosted on Workers AI for semantic evaluation and false positive reduction. This system is now available to self-serve customers and enhances the existing Client-Side Security offering by reducing false positives by up to 200x and enabling more aggressive detection of novel threats.

3/12/2026

Introduced Account Abuse Protection, a new suite of fraud prevention capabilities. This includes Disposable Email Check to detect throwaway email addresses, Email Risk assessment based on email patterns and infrastructure, and Hashed User IDs for per-domain identifiers generated by cryptographically hashing usernames. These features extend existing bot management and leaked credentials detection to address hybrid automated-and-human abuse.

3/11/2026

This post introduces RFC 9457-compliant structured Markdown and JSON error payloads for AI agents. This significantly enhances website security and threat management by providing machine-readable instructions instead of HTML error pages. It dramatically reduces payload size and token usage (over 98%), offering actionable guidance for agents on how to handle errors like rate limiting or access denial. This is a network-wide, automatic update for all 1xxx-class errors, with plans to extend to 4xx and 5xx errors.

3/11/2026

Introduced AI Security for Apps, a new capability to detect and mitigate threats to AI-powered applications. This includes free AI endpoint discovery for all Cloudflare customers, custom topic detection for tailored threat identification, and enhanced prompt extraction capabilities. The service integrates with the WAF rule builder for unified mitigation strategies and expands partnerships with IBM and Wiz for a comprehensive AI security posture.

3/10/2026

Introduced a revamped Security Overview dashboard with 'Security Action Items' to prioritize and surface vulnerabilities, a 'Detection Tools' module to monitor the status of security stack components, and deep-linking from Suspicious Activity cards to Security Analytics. Detailed the engineering approach using a microservices-based 'checker' architecture for scheduled and real-time analysis, and introduced 'Contextual Insights' for issues like dangling DNS records, providing target and impact context.

3/10/2026

This post announces a planned integration between Cloudflare and Mastercard's RiskRecon. The integration will allow Cloudflare Security Insights to identify and secure internet-facing blind spots, including shadow IT and forgotten subdomains, by leveraging Mastercard's attack surface intelligence. This enables users to discover and protect assets that are not yet proxied by Cloudflare, thereby improving overall security posture.

3/9/2026

Introduces a new stateful vulnerability scanner for APIs, initially focusing on BOLA detection. The scanner leverages OpenAPI schemas and Cloudflare's Workers AI to automatically build scan plans, inferring endpoint relationships and dependencies beyond what is explicitly defined in schemas. It integrates with Security Insights for a unified view of security findings.

3/9/2026

This post details the identification and patching of three HTTP/1.x request smuggling vulnerabilities (CVE-2026-2833, CVE-2026-2835, CVE-2026-2836) in the Pingora open source framework. It explains how these vulnerabilities could allow attackers to bypass security controls, desync requests, and poison caches in standalone Pingora deployments. The post outlines specific fixes for premature upgrade handling without a 101 handshake and for misinterpretations of HTTP/1.0, close-delimiting, and transfer-encoding, emphasizing that Cloudflare's CDN was not affected due to architectural differences and internal traffic handling practices.

3/5/2026

This post introduces Dynamic Path MTU Discovery (PMTUD) to the Cloudflare One Client, enhancing its resilience against 'PMTUD Black Holes'. It details how the client actively probes network paths to determine optimal packet sizes, moving beyond reliance on potentially dropped ICMP messages. This ensures stable connections for users across various network conditions, particularly benefiting mission-critical applications like those used by first responders and hybrid workers.

3/4/2026

Introduced 'Attack Signature Detection' and 'Full-Transaction Detection' as an evolution of the WAF's managed rules. Attack Signature Detection runs all detection signatures on every request, attaching metadata without impacting performance if no blocking rule is configured. Full-Transaction Detection analyzes both request and response to reduce false positives and detect more complex threats. The 'always-on' framework separates detection from mitigation, enriching analytics and enabling custom policies based on detection metadata.

3/4/2026

This post introduces the Gateway Authorization Proxy and PAC File Hosting, extending Cloudflare's identity-based security to unmanaged devices. It addresses the limitations of IP-based identification by integrating with Cloudflare Access to verify user identity, enabling granular policies and anonymous logs. The PAC File Hosting simplifies setup by allowing users to host their configuration files directly on Cloudflare.

3/3/2026

This post introduces Cloudflare's Threat Intelligence Platform (TIP), a significant evolution in their threat management capabilities. The TIP moves beyond traditional security measures by offering a centralized system for collecting, aggregating, and organizing threat data. Key contributions include the adoption of a sharded, SQLite-backed architecture for real-time, low-latency querying directly on the edge, eliminating complex ETL pipelines. It integrates global telemetry with manual investigations to provide actionable insights, correlate actors to malware, and enable automated threat response. The TIP complements SIEMs by providing specialized, long-term storage for threat events and enriching raw logs with historical context, enabling a proactive defense posture.

3/3/2026

This post introduces the 2026 Cloudflare Threat Report, detailing the evolution of the threat landscape towards high-trust exploitation and the 'Measure of Effectiveness' (MOE) metric used by attackers. It highlights eight key trends, including AI-driven operations, weaponization of cloud tooling (e.g., Google Calendar, Dropbox, GitHub, Azure Web Apps, ONLYOFFICE), token theft, and hyper-volumetric DDoS attacks. The report also details Cloudforce One's methodology, including AI self-vulnerability analysis and PhaaS analysis, and advocates for autonomous defense. This contributes to the understanding of evolving threats and the strategies to combat them, particularly concerning the misuse of legitimate cloud services and the increasing sophistication of attack vectors.

3/3/2026

This post details the integration of Large Language Models (LLMs) into Cloudflare's email security tools to proactively identify and categorize phishing threats. It describes how LLMs are used to analyze millions of emails daily, extracting nuanced threat vectors like 'Sales Outreach' and 'PrizeNotification'. This enables the creation of high-fidelity signals for analysts and the development of specialized machine learning models trained on LLM-generated tags. The post highlights a 20.4% reduction in customer-reported misses for Sales Outreach phishing in Q4 2025 due to this proactive approach, demonstrating a shift from reactive defense to proactive reinforcement.

3/3/2026

This post introduces Remediation capabilities to Cloudflare CASB, allowing users to directly fix identified security risks within SaaS applications, specifically focusing on overshared files in Microsoft 365 and Google Workspace. This moves CASB from a detection-only tool to an active control plane, enhancing its role in website security and threat management by enabling immediate risk mitigation.

2/27/2026

This post introduces the concept of 'toxic combinations' as a method for detecting security incidents by analyzing the confluence of multiple weak signals rather than relying on single strong indicators. It details how Cloudflare's network observes requests to identify these combinations by looking at bot traffic, application paths, request anomalies, and misconfigurations. The post provides examples of common toxic combinations, such as probing administrative endpoints and unauthenticated API endpoints with predictable identifiers, and offers mitigation strategies for each.

2/27/2026

This post details the redesign of Cloudflare's Turnstile widget and Challenge Pages, focusing on improving user experience and clarity for billions of daily interactions. It covers the design process, including an audit of existing inconsistencies, mapping user journeys, establishing a unified information architecture, and user research findings. Key improvements include replacing 'Send Feedback' with 'Troubleshoot' for better user guidance and aligning the UI and information hierarchy across different states and products.

2/5/2026

This post details the evolution of DDoS attacks in 2025, highlighting a 121% surge and record-breaking attack volumes. It introduces the Aisuru-Kimwolf botnet and its 'The Night Before Christmas' campaign, which utilized hyper-volumetric HTTP DDoS attacks. The post also analyzes network-layer DDoS attack growth, specific attack vectors like SYN floods and Mirai-generated attacks, and the impact on various industries and geographic locations. It emphasizes Cloudflare's autonomous DDoS defense systems' ability to automatically detect and mitigate these massive assaults.

1/19/2026

This post details a vulnerability in Cloudflare's ACME HTTP-01 challenge logic where WAF features were disabled on specific ACME-related paths, allowing requests that should have been blocked to proceed to the origin. The mitigation involved a code change that ensures security features are only disabled when a request matches a valid ACME HTTP-01 challenge token for the hostname, and Cloudflare has a challenge response to serve.

12/19/2025

This post details Cloudflare's evolving approach to addressing streaming abuse and copyright infringement. It highlights the development of new technical responses, including an API for rightsholders, feedback mechanisms on report quality, and scaled response to streaming reports. The post also discusses the increased volume of DMCA reports and takedown actions, as well as the use of this information to bolster technical tools for preventing unauthorized streaming on non-hosted services. Furthermore, it addresses the challenges of legally-mandated blocking and advocates for source-based content removal as a more effective and less damaging approach.

12/11/2025

This post details the immediate response to the React2Shell vulnerability (CVE-2025-55182) and two related RSC vulnerabilities (CVE-2025-55183, CVE-2025-55184). It describes the threat actor tactics and techniques observed during early exploitation, including the use of vulnerability intelligence, reconnaissance tools, and specific scanning methods. Cloudflare has deployed new WAF rules to block exploitation and scanning attempts for these vulnerabilities, providing specific rule IDs for both free and paid customers.

12/5/2025

This post details a significant outage caused by changes to the WAF's body parsing logic and internal testing tools. It highlights how an attempt to protect customers against a React Server Components vulnerability led to a critical error in the FL1 proxy when an internal WAF testing tool was disabled. The incident underscores the challenges of managing global configuration changes and the need for more robust deployment and error handling mechanisms, especially in the context of security-related updates. It also emphasizes the ongoing work to improve resiliency following a previous outage.

12/3/2025

This post details the deployment of new Web Application Firewall (WAF) rules to proactively protect against a Remote Code Execution (RCE) vulnerability in React Server Components (RSC) affecting React versions 19.0, 19.1, and 19.2, and Next.js versions 15 through 16. The new rules, identified by Rule ID 33aa8a8a948b48b28d40450c5fb92fba for the Managed Ruleset and 2b5d06e34a814a889bee9a0699702280 for the Free Ruleset, are deployed network-wide with a default 'Block' action. The post also notes that Cloudflare Workers are inherently immune to this exploit and recommends updating React and Next.js versions.

12/3/2025

This post details the Q3 2025 DDoS threat landscape, highlighting the unprecedented scale of attacks from the Aisuru botnet (exceeding 29.7 Tbps and 14.1 Bpps). It quantifies the surge in DDoS attacks against AI companies (347% MoM), the impact of geopolitical tensions on attacks against the Mining, Minerals & Metals and Automotive industries, and the overall increase in DDoS attacks mitigated by Cloudflare (15% QoQ, 40% YoY). It also analyzes attack characteristics, top attack sources (Indonesia leading), and top attacked industries and locations, correlating them with geopolitical events.

11/24/2025

Introduced and detailed payload logging for Cloudflare's WAF, enabling customers to see which specific fields and values within a request led to a WAF rule match. This includes improvements to the Wirefilter engine to log only matching array indices and partial matches, significantly reducing log volume and improving debugging clarity. The new payload logging also includes 'before' and 'after' context for partial matches to provide more granular debugging information.

11/18/2025

This post details a major outage on November 18, 2025, caused by a database permission change that led to an oversized Bot Management feature file. This file's size exceeded the software's limit, causing widespread failures in core CDN, security services, Turnstile, Workers KV, and Access. The incident highlighted issues with database query behavior, feature file propagation, and the impact of configuration file size limits on network stability. It also led to a temporary failure of the status page and initial misdiagnosis as a DDoS attack. The post outlines the resolution steps and commits to preventing future occurrences.

11/3/2025

This post leverages Cloudflare Radar's data on TCP resets and timeouts to corroborate reports of Turkmenistan unblocking IP addresses and potentially testing a new firewall. It analyzes historical data from mid-2024, showing a surge in requests from Turkmenistan and corresponding shifts in TCP connection anomalies, particularly in specific autonomous systems. The post highlights how analyzing network-level anomalies can provide insights into state-level internet control and tampering, complementing existing threat management capabilities.

10/31/2025

This post details a specific instance of an internal microservice communication hitting Cloudflare's HTTP/2 PING flood mitigation (ENHANCE_YOUR_CALM). It explains the underlying Go standard library behavior where calling `resp.Body.Close()` without fully reading the response body can lead to unnecessary RST_STREAM frames, which in turn can trigger PING flood detection. The post provides a solution by ensuring the response body is fully read using `io.Copy(io.Discard, resp.Body)` before closing it, and offers a more robust pattern for handling response bodies in Go clients.

10/30/2025

Introduces a registry format for bots and agents to facilitate the discovery of their public keys, extending the Web Bot Auth protocol. This format allows for the creation of lists of URLs pointing to agent keys, enabling website operators to manage trusted bots and agents more effectively. It also proposes a 'signature-agent card format' for richer metadata about agents.

10/30/2025

Introduces the concept of using anonymous credentials (AC) to rate-limit AI agents and bots without compromising user privacy. Details the development of a simple AI agent using Cloudflare Workers and Stagehand for browser automation. Discusses the challenges origins face with increased agent traffic and proposes AC as a solution for fine-grained traffic management, aligning with ongoing IETF development.

10/29/2025

This post details the identification and mitigation of two vulnerabilities (CVE-2025-4820 and CVE-2025-4821) in the quiche library related to QUIC packet acknowledgement handling. The mitigation involves enforcing ACK range validation based on the largest packets sent by the server and implementing a dynamic CWND-aware skip frequency to counter Optimistic ACK attacks, thereby preventing DDoS vectors caused by artificially expanded send rates.

10/29/2025

This post introduces Cloudflare's work on detecting Carrier-Grade NAT (CGNAT) and other large-scale IP sharing (LSS) mechanisms. It highlights the socioeconomic bias that can arise from traditional IP-based security measures when applied to shared IPs, particularly in developing regions. The post details the motivation for this work, the technical challenges of CGNAT, and Cloudflare's approach to building a supervised learning classifier using distributed traceroutes and public data sources to identify CGNAT IPs. This contributes to the broader theme of refining threat management by understanding the underlying network infrastructure and user access patterns.

10/29/2025

This post details Cloudflare's mitigation of large-scale DDoS attacks against the Moldovan Central Election Commission (CEC) and other election-related websites during the 2025 parliamentary elections. It quantifies the attacks, detailing over 898 million malicious requests mitigated against the CEC over a twelve-hour period, with peak rates exceeding 324,000 requests per second. The post also highlights the application of these protections to civic participation portals, democracy-related services, broadcasters, and news outlets, demonstrating a coordinated effort to disrupt both official processes and public information channels. The technical details include the categorization of attacks into multi-wave patterns and the real-time neutralization of these threats by Cloudflare's automated defenses.

10/28/2025

This post introduces a data-driven framework for measuring Internet resilience. It defines resilience as the measurable capability of a national or regional network ecosystem to maintain diverse and secure routing paths in the face of challenges, and to rapidly restore connectivity following a disruption. The framework analyzes metrics related to routing hygiene (RPKI, ROV), physical infrastructure (IXPs, colocation facilities), network topology, interconnection patterns, and routing behavior. It emphasizes the importance of local decisions having global impact and the challenges of data access for accurate measurement, relying on public data sources for reproducibility.

10/24/2025

Introduces and details Cloudflare Page Shield's ML-based malicious JavaScript detection capabilities, specifically highlighting its effectiveness against a recent npm supply chain attack. The post explains the use of Abstract Syntax Trees and message-passing graph convolutional networks (MPGCNs) for classifying scripts, discusses model evaluation metrics (Precision, Recall, F1), and outlines planned improvements including contextual data integration and consolidation of classifiers.

10/24/2025

This post introduces a significant advancement in website security by detailing Cloudflare's partnership with Visa and Mastercard to secure agentic commerce. It leverages the previously introduced Web Bot Auth and HTTP Message Signatures to create a framework (Trusted Agent Protocol and Agent Pay) for cryptographically authenticating AI shopping agents. This enables merchants to distinguish legitimate agents from bots, link agents to consumer identities, and manage transaction expectations, thereby enhancing security and trust in automated commerce.

10/16/2025

Introduces Web Application Integrity, Consistency, and Transparency (WAICT), a W3C-backed effort to bring stronger security guarantees to the web. Details the problem of JavaScript cryptography distribution and proposes solutions involving Subresource Integrity (SRI) and an Integrity Manifest to define and enforce the integrity of entire web applications. Explores achieving transparency through opt-in, append-only logs using hash chains, with requirements for non-centralization, user privacy, and monitorability.

10/9/2025

Introduces Cloudforce One REACT, a new incident response service that integrates with Cloudflare's platform. REACT offers security advisory services (threat hunting, tabletop exercises, readiness assessments) and incident response for active crises (APT, ransomware, insider threats, BEC). Key differentiators include unmatched threat visibility due to Cloudflare's network presence, network-native mitigation capabilities (WAF rules, SWG policies) deployable at the edge, service delivery by seasoned experts, and vendor-agnostic scope. The post details prevalent threats observed by REACT, such as insider threats, ransomware, and application/supply chain breaches, and highlights the direct integration of REACT services into the Cloudflare dashboard for both proactive engagement and emergency response.

9/24/2025

The CSAM Scanning Tool has been simplified by removing the requirement for users to create and provide their own NCMEC credentials. This change, implemented in February, has led to a 1600% increase in monthly adoption. The tool now scans cached content for CSAM using fuzzy hashing and automatically blocks identified malicious URLs, notifying the site operator for further action.

9/24/2025

This post details the implementation and results of Automatic SSL/TLS, a system that automatically scans and upgrades origin server TLS configurations to the most secure mode supported. It explains the technical evolution of TLS, the challenges of securing the edge-to-origin connection, and the mechanics of how Automatic SSL/TLS works by crawling websites, comparing HTTP/HTTPS content, and checking TLS certificates. It highlights the improvement from the previous SSL/TLS Recommender, which had low adoption, to an automated system that has secured over 6 million domains.

9/24/2025

This post introduces the Content Signals Policy, a new addition to robots.txt that allows website operators to express preferences for how their content can be used after it has been accessed. It defines three content signals: 'search', 'ai-input', and 'ai-train', with machine-readable 'yes' or 'no' syntax. This policy aims to address the free-rider problem of data scraping and the "impossible choice" website operators face between open access and data misuse, particularly in the context of AI model training.

9/23/2025

Introduces a new platform for per-customer behavioral anomaly detection using machine learning models to identify unique bot behaviors. This platform establishes dynamic baselines of normal traffic for each customer, identifies deviations from these baselines, and generates actionable findings through new Bot Detection IDs for WAF rules. It also details improvements in globally scalable bot fingerprinting, including heuristics for HTTP/2 and Client Hello extensions, and enhanced detection for residential and commercial proxy networks by combining network data with client-side information from challenge solves.

9/23/2025

This post introduces the integration of Cloudflare's Bot Management and AI Crawl Control services into Project Galileo, specifically to protect journalists and news organizations from AI crawlers. It highlights the impact of AI on web traffic and revenue for news outlets, and details how these new services provide control over AI bot access to content, enabling monitoring, analysis, and negotiation with AI companies.

9/15/2025

This post details the integration of Cloudflare's SASE platform (specifically Zero Trust Access and Email Security) with CrowdStrike Falcon Fusion SOAR. It introduces two out-of-the-box integrations for automated response workflows, leveraging webhooks and API calls. Technical details include the specific API actions available for Email Security and Zero Trust Access within CrowdStrike, an example of an automated workflow (phishing detection -> block sender -> revoke sessions -> isolate endpoint), and the configuration of Logpush jobs from Cloudflare to CrowdStrike via HTTP destinations.

9/4/2025

This post details the unauthorized issuance of TLS certificates for Cloudflare's 1.1.1.1 DNS resolver by Fina CA. It explains the mechanics of TLS certificate validation for DNS resolvers, the role of Certificate Transparency (CT) in detecting such misissuances, and the investigation into potential malicious use. The post emphasizes the security implications of CA negligence and the importance of robust CA security practices.

8/28/2025

This post introduces 'signed agents,' a new classification within Cloudflare's bot management capabilities. It extends the existing verified bots program by leveraging Web Bot Auth and cryptographic signatures to identify and manage agents directed by end-users, distinct from bots operated by single companies. This provides customers with more granular control over automated traffic through security rules and enhances transparency via the Radar Bots Directory, which now includes both signed agents and verified bots.

8/26/2025

Introduces unsafe content moderation integrated into Cloudflare Firewall for AI, leveraging Llama Guard 3 for real-time detection and blocking of harmful prompts targeting LLM endpoints. This feature provides a model-agnostic, edge-native policy layer for AI security, enabling unified detection, analytics, and topic enforcement without application code modification. It utilizes a new asynchronous architecture with parallel, non-blocking requests to detection modules (PII, unsafe topics) deployed on Workers AI with GPUs, ensuring scalability and minimal latency. Rules can be enforced via custom rules in the WAF to log or block based on detected unsafe topics.

8/21/2025

This post details how Cloudflare's automated DDoS mitigation systems protected the volunteer-run fogos.pt website during two significant attacks, mitigating 33,000 requests per second and 1.7 Gbps of bandwidth without service disruption. It highlights the effectiveness of Cloudflare's systems for smaller, yet critical, public interest sites, and the role of Project Galileo in providing these protections.

8/15/2025

This post details the MadeYouReset (CVE-2025-8671) HTTP/2 vulnerability, which exploits server-sent stream resets. It explains how Cloudflare's existing mitigations for Rapid Reset and general HTTP/2 RFC 9113 compliance provide protection against this new vulnerability. It also notes that the Rust-language h2 library used by Cloudflare's Pingora framework was potentially susceptible in versions prior to 0.4.11, and advises users to update.

8/12/2025

Introduced 'Externa' and 'Interna' as new use-case bundles to simplify product packaging and pricing. Externa bundles WAF, DDoS, API security, networking, and application performance services for public-facing systems with a pricing model that excludes attack traffic. Interna addresses internal systems and hybrid work environments with a per-seat model that includes bandwidth and premium features like DEM and CASB. Both bundles offer tiered Essentials, Advantage, and Premier options.

8/5/2025

This post details the optimization of authentication latency for Cloudflare's privacy proxy product. It identifies and resolves a significant performance bottleneck related to TCP Nagle's algorithm and delayed ACKs, reducing double-spend check latency from approximately 40ms to under 1ms. This directly improves the performance and privacy of services like Apple's Private Relay and Microsoft's Edge Secure Network by ensuring faster token validation.

8/4/2025

This post details the observed stealth crawling behavior of Perplexity, an AI-powered answer engine, which attempts to evade website no-crawl directives by obscuring its identity. Cloudflare observed Perplexity modifying its user agent, changing its source ASNs, and ignoring robots.txt files. Cloudflare has de-listed Perplexity as a verified bot and added heuristics to its managed rules to block this stealth crawling. The post also contrasts this behavior with well-meaning bot operators like OpenAI, who adhere to transparency and respect website preferences. Cloudflare outlines how customers can protect themselves using bot management systems and managed rules.

8/1/2025

This post details a vulnerability found in the older SSL for SaaS v1 (Managed CNAME) product, which relied on IP-based routing and lacked domain ownership verification. It explains how this architecture could be exploited and highlights the mitigation strategy: the phased transition to the more secure Cloudflare for SaaS (v2), which enforces hostname verification. The post also outlines compensating controls for remaining v1 customers and emphasizes the ongoing commitment to security and transparency.

7/22/2025

This post details Cloudflare's immediate response to CVE-2025-53770, a critical SharePoint RCE vulnerability. Cloudflare's WAF Managed Rules were updated with emergency releases to mitigate the vulnerability. The post unpacks the 'ToolShell' exploit chain, explaining its three stages: authentication bypass (CVE-2025-53771), remote code execution via deserialization (CVE-2025-53770), and the long-game persistence by stealing cryptographic machine keys. It highlights the rapid development and deployment of WAF rules, tracking over 300,000 mitigation hits.

7/15/2025

This post details the significant increase in hyper-volumetric DDoS attacks in Q2 2025, with Cloudflare blocking over 6,500 such attacks, averaging 71 per day. It highlights the record-breaking scale of these attacks, reaching 7.3 Tbps and 4.8 billion packets per second. The report also notes a year-over-year increase in overall DDoS attacks and a rise in Ransom DDoS attacks, while detailing shifts in the top attacked locations, industries, and sources of these attacks, including specific Autonomous System Numbers (ASNs) involved in HTTP DDoS attacks.

7/7/2025

This post introduces egress policies by hostname, domain, content category, and application within Cloudflare's SASE platform. Previously, egress policies were limited to user groups and destination IP addresses, making it difficult to manage access to external services with dynamic IP addresses. The new feature leverages Cloudflare's DNS resolver and a 'synthetic IP' mechanism to associate DNS queries with network connections, enabling L4 egress policy evaluation based on L7 information like hostnames. This significantly simplifies policy management for organizations and enhances security by providing more granular control over outbound traffic.

7/1/2025

This post introduces 'pay per crawl,' a new service that allows content owners to monetize their content by charging AI crawlers for access. It leverages HTTP response code 402 and authenticated payment headers (HTTP Message Signatures) to enable programmatic payment for content. This extends Cloudflare's bot management and security capabilities by providing a mechanism for controlled and compensated AI data consumption.

7/1/2025

Introduced integration of HTTP Message Signatures into the Verified Bots Program, simplifying enrollment for bots that cryptographically sign requests. This allows for faster approval of bots and provides site owners with more accurate identification of trusted bot traffic. Cloudflare will automatically validate signatures on the edge, marking verified traffic for use in Bot Management and WAF rules. Open-source libraries in Rust and TypeScript are provided to facilitate Message Signature generation. The post also details the technical steps for bots to become verified using Message Signatures and how site owners can leverage the `cf.verified_bot_category` field for WAF and Rate Limiting rules. It also outlines the future direction of Web Bot Auth and its standardization.

6/19/2025

This post details the autonomous mitigation of a record-breaking 7.3 Tbps DDoS attack, highlighting the scale of the attack (37.4 terabytes in 45 seconds) and its multi-vector nature, primarily UDP floods with smaller percentages of QOTD, Echo, NTP, Mirai UDP, Portmap, and RIPv1 reflection/amplification attacks. It provides detailed breakdowns of each attack vector, including how they work, how to prevent becoming a reflection/amplification participant, and how to defend against them. The post also analyzes the attack origins, noting the significant contributions from Brazil and Vietnam, and the involvement of over 122,000 source IP addresses across 5,433 Autonomous Systems.

5/23/2025

This post announces Cloudflare's recognition in the Gartner Magic Quadrant for Security Service Edge (SSE) for the third consecutive year. It details the evolution of Cloudflare's SSE platform, highlighting its integration of Zero Trust access control, outbound filtering, secure SaaS usage, data protection, and employee experience monitoring. The post emphasizes the platform's foundation on Cloudflare's global network, its performance benefits from single-pass inspection, and its agility in adopting new security standards. It also outlines future planned capabilities for access control and filtering.

5/22/2025

This post details the discovery and mitigation of a critical HTTP/1.1 request smuggling vulnerability (CVE-2025-4366) within the Pingora OSS framework, specifically affecting its caching functionality. It highlights how inconsistencies in HTTP request parsing, particularly on cache hits, could be exploited to inject malicious headers or URLs into subsequent requests. The post emphasizes Cloudflare's swift response through its bug bounty program, disabling vulnerable components, and releasing a patch, underscoring the ongoing effort to secure the entire web stack, including foundational proxy components.

5/19/2025

This post introduces the ability for customers to dynamically reallocate parts of their Bring Your Own IP (BYOIP) prefixes across different Cloudflare services (CDN, Spectrum, Magic Transit) using Service Bindings. This is enabled by extending the Tubular eBPF-based IP and port binding service to support dynamic updates of IP sets and iptable rules across Cloudflare's global infrastructure without requiring service restarts. The integration with the NGINX ingress proxy was addressed by introducing a shared Unix domain socket. The goal is to reduce the transition time for IP address prefix migrations between services from hours to minutes.

5/16/2025

This post details Cloudflare's commitment to transparency in vulnerability reporting, aligning with CISA's "Secure by Design" pledge. It explains the process of issuing CVEs as a CVE Numbering Authority (CNA), including triage criteria and disclosure timelines. Notable CVEs related to Cloudflare products (quiche, WordPress plugin, WARP client) and external dependencies (BoringSSL impacting mTLS) are highlighted, demonstrating the practical application of these security practices.

5/15/2025

Introduces HTTP Message Signatures and request mTLS as new cryptographic mechanisms for verifying legitimate bot and AI agent traffic, moving beyond traditional user agent and IP address validation. Details the implementation of these standards, including the generation and validation of signatures, and provides code examples for developers.

4/28/2025

This post details the significant increase in DDoS attacks observed in Q1 2025, with a 358% YoY increase and 198% QoQ increase, totaling 20.5 million blocked attacks. It highlights the evolution of Cloudflare's autonomous defenses in handling hyper-volumetric attacks, including record-breaking campaigns of 4.8 Bpps and 6.5 Tbps. The post also analyzes emerging threat vectors like CLDAP and ESP reflection attacks, and discusses the anatomy of both network-layer and HTTP-layer DDoS attacks, including the prevalence of SYN floods, Mirai botnets, and botnet-impersonating attacks. It also touches on threat actor motivations and the short duration of most attacks, necessitating rapid, automated mitigation.

4/11/2025

This post introduces a next-generation Certificate Transparency (CT) log built on Cloudflare Workers, leveraging the new static CT API design. It details the history and importance of CT, the challenges in operating existing CT logs (integrity, availability, cost), and how the new design, implemented in Rust and deployable on Cloudflare's Developer Platform, addresses these issues by making CT logs more efficient, cacheable, and easier to operate. This represents an advancement in Cloudflare's contribution to internet security infrastructure.

3/24/2025

This post announces several security-related enhancements and features. It details advancements in post-quantum cryptography integration with Cloudflare Zero Trust, automated phishing abuse reporting using threat intelligence and Developer Platform products, and improved account security through social logins and email security for political campaigns. It also highlights enhanced botnet protection, flexible cipher suites, an upgraded URL Scanner, and insights into password reuse. New threat research capabilities include a threat events platform for real-time insights, a unified platform for security posture management, native monitoring with Log Explorer and custom dashboards, new Turnstile Analytics, and extended Cloudflare Radar insights for DDoS, leaked credentials, and bots. For AI security, it introduces Cloudflare for AI, AI models for detecting malicious JavaScript, cryptographic watermarks for AI-generated content, generative AI for deterring AI crawlers, Firewall for AI to protect LLM-powered applications, and improved bot management flexibility. Simplification efforts include Cloudy, an AI agent for configurations, a unified dashboard for application security, improved support for private applications and reusable access policies, and simplified allowlist management with Cloudflare Aegis. API security is enhanced with HTTPS-only for Cloudflare APIs. Data security advancements include detecting sensitive data and misconfigurations in AWS and GCP with Cloudflare One, browser-based RDP for secure third-party access, AI-powered context analysis for Data Loss Prevention accuracy, and DLP Assist for Microsoft Outlook. It also includes a beginner's guide to lattice cryptography for post-quantum preparation and IRAP assessment at the PROTECTED level for the Australian Public Sector.

3/20/2025

This post announces Cloudflare's recognition as a Leader in the 2025 Forrester Wave™ for Web Application Firewall Solutions. It highlights the evolution of Cloudflare's WAF from its introduction in 2013 to a comprehensive Application Security platform. Key advancements mentioned include the integration of WAF, bot mitigation, API security, client-side protection, and DDoS mitigation on a unified engine, leveraging AI/ML for threat detection. The post also emphasizes the platform's ease of use, Infrastructure as Code support, and an AI agent for rule creation and analytics. It details top-ranked criteria such as detection models, Layer 7 DDoS protection, rule creation, management UI, product security, IaC support, and innovation.

3/20/2025

This post details the technical implementation of closing HTTP ports (80 and others) for api.cloudflare.com to enforce HTTPS-only API traffic. It explains the security risks of cleartext HTTP requests, especially for API tokens, and the limitations of redirection and HSTS for API clients. The solution involves preemptively refusing connections at the transport layer by disabling HTTP ports, preventing handshake and data exchange before sensitive information is transmitted. It also touches on the challenges of global scale, the need to support legacy clients, and the use of Tubular with BSD Sockets API for managing IP addresses and ports.

3/20/2025

Introduced a unified Application Security experience by consolidating WAF, DDoS Mitigation, Bot Management, API Security, and Client Side Security into a single platform with a cohesive UI. This unification simplifies policy configuration, threat detection, and consistent protection across all application aspects by treating traffic as 'data', signals/detections as 'metadata', and security rules as a means to combine these to perform actions. The new dashboard features an overview page for security suggestions, simplified analytics for traffic investigation, a 'web assets' page for attack surface management, and a single Security Rules page for unified mitigation rule management.

3/20/2025

This post introduces Bring Your Own IPs (BYOIP) for Cloudflare Aegis, a customer-accessible Aegis API, and observability for Aegis IP utilization. It details how Aegis provides dedicated egress IP addresses to lock down origin access, contrasting it with traditional IP allowlisting and other origin protection methods like mTLS and Cloudflare Tunnels. The post explains the routing of requests with Aegis, including the use of soft-unicasting and Unimog for load balancing, and discusses capacity considerations for both IPv4 and IPv6, highlighting the benefits of IPv6 for scale and resiliency. The introduction of BYOIP for Aegis allows customers to onboard entire IPv4 /24 prefixes or IPv6 /64 prefixes for cost-effective configurations with higher capacity.

3/19/2025

Introduced a new AI model integrated into Page Shield that detects specific malicious JavaScript intents (Magecart, crypto mining, malware) by parsing JavaScript into syntax trees and feeding them into a Graph Neural Network. This model improves upon previous methods by providing clearer insights into a script's malicious objectives rather than just indirect indicators.

3/19/2025

This post details the migration of Cloudflare's Bot Management heuristics engine from a Lua-based openresty implementation to the Cloudflare Ruleset Engine. This migration enables more expressive and precise rule writing, improving bot detection accuracy and reducing false positives. It also provides Bot Management customers with enhanced visibility through Bot Detection IDs, allowing for granular control and analysis of bot traffic in analytics, logs, and firewall events. New detection IDs for account takeover prevention have also been introduced.

3/18/2025

Introduced the Cloudforce One threat events platform, a new capability that provides contextual data about observed and mitigated threats. This platform leverages Cloudflare's network traffic insights to offer a real-time view of threat activity. It is built using Cloudflare Workers and SQLite-backed Durable Objects for scalable storage and event management. The platform maps events to the MITRE ATT&CK framework and Cyber Kill Chain stages, and includes DoS attacks and advanced threat operations. It aims to empower security practitioners with actionable insights and is accessible via the Cloudflare Dashboard and a dedicated API.

3/18/2025

This post significantly enhances Cloudflare Radar's security insights by refactoring the 'Security & Attacks' page into dedicated 'Application Layer' and 'Network Layer' sections. It introduces new datasets for DDoS attacks, providing geographic and autonomous system (AS) level distribution insights. Additionally, it adds visibility into leaked credential trends, highlighting the prevalence of compromised credentials in authentication requests (both human and bot), and launches a new dedicated 'Bots' page to monitor non-human internet traffic, further strengthening the platform's threat intelligence capabilities.

3/18/2025

This post introduces new capabilities for predictive security posture management across SaaS and web applications. For SaaS, it details a new real-time data collection pipeline using Cloudflare Workers and R2 to overcome vendor rate limits, enabling faster discovery and inventory of assets and documents. For web applications, it introduces a new Security Overview page that aggregates and prioritizes security suggestions based on traffic profile and business needs, including attack detection, traffic disposition, active security modules, and rule suggestions. It also enhances Security Insights with role-based access control (RBAC).

3/18/2025

This post introduces a major upgrade to Turnstile Analytics, providing enhanced visibility into visitor traffic, challenge effectiveness, and potential security threats. New features include TopN statistics for granular traffic analysis (hostname, ASN, user agent, browser, source IP, country, OS), detailed challenge outcomes (Likely Human vs. Likely Bot), breakdown of solve rates (interactive, non-interactive, pre-clearance), and token validation metrics. The post also provides a real-world example of using Turnstile for login and signup pages, including code snippets for widget rendering and Siteverify API validation, and explains how to interpret the new analytics to identify and mitigate sophisticated bot attacks.

3/17/2025

This post details the automation of Cloudflare's Security Level feature, moving from manual threshold configuration to an always-protected state by integrating botnet data and other request rate signals. It also introduces granular cipher suite selection in the dashboard and enhancements to the URL scanner, including bulk scanning and similarity search.

3/17/2025

This post details an analysis of Cloudflare's observed traffic between September-November 2024, revealing that 41% of successful logins involve compromised passwords. It highlights that 95% of login attempts using leaked passwords are bot-driven, indicating widespread credential stuffing attacks. The analysis further breaks down these statistics for WordPress, showing 76% of leaked password login attempts are successful, with 48% being bot-driven. The post emphasizes the role of password reuse as a primary vulnerability and provides recommendations for users and website owners to enhance security.

3/17/2025

This post details the development and deployment of advanced automation tooling to combat phishing attacks. It describes the transition from manual review of abuse reports to an automated system that resolves 78% of phishing reports with a median time to take action of under an hour. The system leverages the Cloudflare Developer Platform, including Workers, URL Scanner, machine learning classifiers, threat feeds, KV, Durable Objects, Hyperdrive, Queues, Workers AI, and D1, to process and analyze URLs, identify phishing indicators, and recommend actions. It also highlights how this intelligence is used to enhance customer-facing products like Brand Protection.

3/3/2025

This post introduces two new capabilities for Cloudflare Waiting Room: the integration of an invisible Turnstile challenge to quantify bot traffic within the queue, and the Infinite Queue feature for Advanced Waiting Rooms, which redirects failing bot traffic to a custom page to waste their resources. It also details Session Revocation, allowing for dynamic session termination to open up spots and improve queue throughput. The post explains how Turnstile's challenge outcomes are categorized as 'Likely Bots', 'Bots', and 'Likely Humans', and how these metrics are available in Waiting Room Analytics.

2/10/2025

This post details the discovery and mitigation of a broadcast address amplification vulnerability in Cloudflare's QUIC implementation. It explains how sending a QUIC Initial packet to a broadcast IP address could trigger a server CPU and reflection amplification attack. The vulnerability was traced to the way Cloudflare servers bind anycast IP ranges to their loopback interfaces, creating local and broadcast routes that, when targeted by a QUIC Initial packet to a broadcast address, could lead to excessive response packets. The fix involved modifying the server's packet handling logic to prevent this amplification vector.

2/7/2025

This post details a vulnerability in Cloudflare's Mutual TLS (mTLS) implementation related to session resumption, tracked as CVE-2025-23419. A flaw in how BoringSSL handled session caches allowed a client with a valid mTLS certificate for one zone to resume a TLS session with another zone without re-authentication. Cloudflare mitigated this by disabling TLS session resumption for all customers with mTLS enabled and is exploring ways to reintroduce performance benefits. The post also provides guidance on further hardening mTLS configurations using Transform Rules, logging, and WAF custom rules, including passing client certificate metadata to origins.

2/5/2025

This post details Cloudflare's commitment to achieving FedRAMP High, IRAP, and ENS certifications for Cloudflare for Government. It highlights the integration of these compliance capabilities directly into the core platform, leveraging the global network for traffic processing, management, and metadata storage locality. The post also outlines the expansion of FedRAMP scope to include API Shield, R2, Cache Reserve, and CASB, with future plans for Hyperdrive and Cloudflare Images. It emphasizes the expansion of data centers to support international public sector customers and the ongoing commitment to post-quantum cryptography (PQC) as a baseline for internet security.

2/3/2025

This post introduces the integration of Content Credentials (based on the C2PA standard) into Cloudflare Images. This allows content creators to preserve the provenance of their images, including creation details and editing history, across the Cloudflare network. Cloudflare Images will now cryptographically sign these transformations, ensuring tamper-evidence and enabling end-users to verify the origin and modifications of images through open-source tools. This extends Cloudflare's security and content integrity offerings to the realm of digital media provenance.

1/21/2025

This post details the analysis of DDoS attack trends for Q4 2024 and the year as a whole, highlighting a record-breaking 5.6 Tbps attack. It provides technical insights into the volume and types of DDoS attacks mitigated, including Layer 3/4 and HTTP attacks. Specific contributions include the breakdown of HTTP attack vectors, analysis of commonly abused user agents (e.g., HITV_ST_PLATFORM, hackney), and examination of HTTP attributes like methods (HEAD, DELETE) and paths (/wp-admin/) that are disproportionately used in attacks. It also details the top Layer 3/4 attack vectors (SYN flood, DNS flood, UDP floods) and the emergence of vectors like Memcached DDoS attacks. The post emphasizes the role of Cloudflare's autonomous defense systems and its unique vantage point from its global network in detecting and mitigating these threats.

1/19/2025

This post details how Cloudflare's DNS resolver and network traffic analysis capabilities were used to observe the immediate impact of the US ban on TikTok. It quantifies the sharp decline in traffic to TikTok and its associated domains, as well as the concurrent surge in traffic to alternative platforms like RedNote (Xiaohongshu). The post also highlights the global reach of these traffic shifts and the subsequent partial restoration of TikTok services, underscoring Cloudflare's role in real-time internet traffic monitoring and analysis in response to significant geopolitical events.

1/14/2025

This post details Cloudflare's proactive efforts to reduce entire classes of vulnerabilities, specifically injection flaws and secrets in code, aligning with CISA's 'Secure by Design' pledge. It highlights the implementation of custom SAST rulesets, automated detection, and 'build break' enforcement within CI/CD pipelines to prevent these vulnerabilities from entering production. The post quantifies the impact with a 79% reduction in secrets and a 44% reduction in injection vulnerabilities in the latter half of 2024, showcasing a shift towards preventing vulnerabilities at their source rather than patching them.

12/30/2024

This post introduces h3i, a new open-source command-line tool and Rust library for low-level HTTP/3 testing and debugging. It details the motivation behind its development, its role in ensuring standards-compliant software and production systems, and provides guidance on its usage. The post also includes a recap of QUIC and HTTP/3, and background on Cloudflare's existing testing methodologies for these protocols, highlighting the need for more accessible and maintainable tools like h3i to test edge cases and protocol deviations.

12/27/2024

This post introduces the adoption of MASQUE, an HTTP/3-based protocol, to power Cloudflare's 1.1.1.1 and WARP applications, enhancing security and stability. It also announces the general availability of Digital Experience Monitoring (DEX) and introduces Remote Captures (PCAP and WARP Diag) for enhanced device visibility and troubleshooting within the Zero Trust offering.

12/23/2024

This post details the continued evolution of Cloudflare's bot management capabilities, specifically focusing on the rise of AI bots and their impact during peak shopping periods like Black Friday. It quantifies the increase in bot traffic, including AI bots and those originating from residential proxy networks. The post highlights new detection methods for AI bots and residential proxies, and provides actionable advice for customers on how to leverage Cloudflare's Bot Management and WAF features to protect against these threats, including blocking AI bots and monitoring for account takeover attempts.

12/23/2024

This post details the observed trends in cyberattacks and Internet traffic patterns during global elections in 2024. It highlights the increase in DDoS attacks targeting political campaigns and infrastructure across various countries (US, France, UK, Netherlands, Romania, South Africa, Portugal, Taiwan, Japan), providing specific metrics like peak requests per second and attack volumes. It also documents election-related Internet shutdowns in Comoros and Pakistan, and social media access suspensions in Mauritius. Furthermore, it analyzes Internet traffic patterns on election days in several countries, correlating them with polling hours, results broadcasts, and dominant device usage (mobile vs. desktop).

12/10/2024

This post introduces 'Robotcop,' an extension of AI Crawl Control, which allows customers to programmatically enforce their robots.txt policies against AI bots. It provides visibility into which AI services are honoring robots.txt and enables the automatic translation of these policies into WAF rules for network-level enforcement, moving from voluntary compliance to mandatory adherence.

12/3/2024

This post analyzes internet traffic and cyber threat trends during Cyber Week 2024, highlighting peak traffic days (Cyber Monday, Sunday, Black Friday), global and US-specific patterns, shifts in mobile vs. desktop usage, and the rise in DDoS attacks targeting e-commerce sites. It also details DNS traffic trends for e-commerce, low-cost, and second-hand shopping sites, providing valuable data on evolving online consumer behavior and associated security challenges.

11/20/2024

This post details the evolution of DDoS attack sizes over the last decade, highlighting an exponential growth trend in requests per second (rps), packets per second (pps), and bits per second (bps). It analyzes historical data from Google and Cloudflare, showing significant increases in attack volumes and a shift from IoT-based botnets to more powerful VM-based botnets. The post also discusses the challenges in defining individual attacks and how Cloudflare's Connectivity Cloud, with its automated detection and mitigation capabilities, adapts to these evolving threats.

11/6/2024

This post details Cloudflare's role in protecting US election infrastructure from cyberattacks during the 2024 election cycle. It highlights the mitigation of over 6 billion HTTP DDoS requests targeting election-related websites, with no significant disruptions observed. The post analyzes traffic shifts, DNS trends, and specific DDoS attack patterns against campaign and party websites, showcasing the scale and sophistication of these attacks. It also reiterates Cloudflare's commitment to election security through its Impact programs (Project Galileo, Athenian Project, Cloudflare for Campaigns) and collaborations with government agencies.

10/23/2024

This post details the significant increase in DDoS attacks observed in Q3 2024, with nearly 6 million attacks mitigated. It highlights the mitigation of over 200 hyper-volumetric attacks exceeding 1 Tbps, including a record-breaking 4.2 Tbps attack. The analysis covers attack types (network vs. application layer), duration, vectors (SYN flood, DNS flood, SSDP amplification), user agents used in HTTP attacks (Chrome, Go-http-client, fasthttp), and HTTP attack attributes (DELETE method, non-standard HTTP/1.2, HTTPS). It also identifies top attacked locations (China, UAE) and industries (Banking & Financial Services, IT & Services).

10/23/2024

This post introduces an advanced anomaly detection pipeline for identifying novel and subtle DDoS attacks. It details the limitations of naive volumetric models and time series forecasting, then presents a more robust approach using multiple traffic characteristics (beyond volume) analyzed through Principal Component Analysis (PCA) and Mahalanobis distance. This enables the training of millions of models daily to detect attacks that might otherwise go unnoticed, particularly for smaller customers.

10/15/2024

Introduces an integration with Okta to share Cloudflare's real-time user risk scores. This enables dynamic security posture management by allowing Okta to enforce policies (e.g., MFA, logout) based on risk levels (high, medium, low) derived from user activities like impossible travel or DLP detections. The integration utilizes the OpenID Shared Signals Framework Specification (SSF) and Security Event Tokens (SETs) for secure and standardized risk data exchange.

10/7/2024

Introduced a free, integrated security.txt generator into the Cloudflare dashboard. This feature dynamically constructs the security.txt file using data stored in PostgreSQL and synchronized globally via Quicksilver, ensuring real-time updates. It supports expiration timestamps, optional fields like PGP keys and signatures, and can be managed via API. The generator aims to simplify vulnerability disclosure for all Cloudflare users.

10/2/2024

This post details Cloudflare's autonomous mitigation of a world-record 3.8 Tbps DDoS attack. It explains the anatomy of L3/4 DDoS attacks, focusing on CPU cycle and network bandwidth exhaustion. It highlights how Cloudflare's global anycast network distributes attack traffic, and how real-time dynamic signatures are generated to match attack traffic. The post also describes the use of kernel features to drop packets at wire-speed for efficient mitigation.

9/27/2024

This post introduces three key advancements in Cloudflare's AI and bot management capabilities: 1. AI Assistant for WAF Rule Builder: A new feature that allows users to generate WAF custom and rate-limiting rules using natural language prompts. This assistant provides a foundation for rules that can be further refined. 2. AI Bot Traffic Insights on Cloudflare Radar: The Cloudflare Radar platform now includes a graph on its Traffic page displaying insights into AI bot and crawler traffic trends over selected time periods, based on the ai.robots.txt list. Time series and summary data are available via the Radar API. 3. Enhanced AI Bot Blocking Capabilities: The existing AI bot blocking feature has been updated to include 27 signatures of AI bots that do not respect robots.txt or crawl rates. This enhanced rule logic is now powered by Cloudflare managed rules, enabling real-time updates. The ML model for bot detection has been improved with additional heuristics, increasing detection rates and certainty. These updates have led to a significant reduction in AI bot traffic.

9/24/2024

This post introduces several new security features and makes existing ones more broadly available. Key contributions include: making Security Analytics and DNS Analytics available to all plans (including free), enhancing Account Takeover (ATO) detection with automatic detection and a combined leaked credentials database (HIBP + Cloudflare's), introducing API Schema Validation for all customers, and providing Page Shield script monitoring. For Cloudflare One users, Magic Network Monitoring, Data Loss Prevention, and Digital Experience Monitoring are now part of a free offering. The post also announces the launch of the Cloudforce One threat intelligence website.

9/24/2024

This post details Cloudflare's new role in verifying WhatsApp's Key Transparency audit proofs. It describes the architecture of the Auditor service built on Cloudflare Workers, utilizing Rust and Durable Objects for timestamping and R2 buckets with containers for tree validation. The contribution focuses on building and operating a system that audits the Auditable Key Directory (AKD) to ensure the global uniqueness and validity of epochs, thereby enhancing the security of end-to-end encrypted messages.

9/24/2024

This post announces Cloudflare's initiative to partner with ISPs and network equipment providers to offer its DNS resolvers (1.1.1.1, 1.1.1.2, 1.1.1.3) for free. This expands the reach of Cloudflare's privacy and security features beyond individual users to entire home networks, making it easier for consumers to adopt these protections through familiar service providers. It also highlights the evolution of 1.1.1.1 for Families and introduces the advanced Gateway product for more customizable filtering.

9/23/2024

Introduced Ephemeral IDs, a new feature that generates a unique short-lived ID for website visitors interacting with Turnstile. This ID is calculated based on aggregated client-side signals and does not rely on network-level information like IP addresses or cookies. Ephemeral IDs are designed to be short-lived and not 100% unique across different customers, making them effective for identifying patterns of fraud and abuse without compromising user privacy. They are available through the Turnstile siteverify response for enhanced fraud detection, particularly for use cases like preventing fraudulent account signups.

9/19/2024

This post details Cloudflare's integration of SSL.com as a new certificate authority (CA) for its Advanced Certificate Manager and SSL for SaaS products. This allows customers who previously relied on Entrust (which is being distrusted by Chrome and Mozilla) to transition to a trusted CA with automated issuance and renewal through Cloudflare's platform. It outlines the UI and API configurations for selecting SSL.com, the default 90-day validity period, and the option for custom validity periods for Enterprise customers. It also emphasizes the benefits of Cloudflare's managed certificate pipeline over manual management for Entrust customers.

9/12/2024

This post details the application of sequence learning, specifically using variable order Markov chains (VOMCs), to enhance API security by detecting and mitigating sequential abuse. It explains how API sessions are modeled, the limitations of standard Markov chains, and how VOMCs are used to identify important API request sequences by considering credible intervals and variable context lengths. This contributes to the Sequence Analytics product by providing a more robust method for identifying malicious API request patterns that are not detectable by volumetric methods alone.

9/11/2024

This post details the integration of Cloudflare Email Security and Zero Trust logs with CrowdStrike Falcon Next-Gen SIEM. It explains how IoC alerts from Cloudflare Email Security can notify analysts of suspicious activity, and how Zero Trust logs from Access and Gateway can be pushed to Falcon Next-Gen SIEM for visualization, analysis, and remediation. It also outlines the technical steps for setting up an HTTP logpush job from Cloudflare to Falcon Next-Gen SIEM, including API key generation and destination configuration.

9/5/2024

This post introduces a significant new dimension to website security by detailing Cloudflare's research into global connection tampering. It quantifies the prevalence of such tampering (20% of connections), identifies signature patterns indicative of third-party intervention (censorship, ISP blocking, enterprise security), and provides global insights into these practices through new dashboards and APIs on Cloudflare Radar. The post also explains the technical underpinnings of connection tampering, particularly related to the SNI field in TLS, and uses telephone call analogies to make the concept accessible.

8/23/2024

This post analyzes internet traffic and security trends during the 2024 U.S. Democratic National Convention. It details shifts in DNS traffic to Kamala Harris-related sites and fundraising domains, increased traffic to news organizations, and observed DDoS attacks targeting politically-related organizations. It also examines email trends, noting a surge in Trump-related emails and a drop in Biden-related emails. This contributes to the understanding of how major political events influence internet behavior and security threats, providing real-world data on the effectiveness of Cloudflare's threat management capabilities during high-profile events.

8/22/2024

Introduced wildcard support (case-insensitive 'wildcard' and case-sensitive 'strict wildcard' operators) to the Ruleset Engine, enabling flexible pattern matching for various string fields. Developed the `wildcard_replace()` function for Single Redirects to dynamically construct redirect URLs using captured wildcard segments. Introduced a simplified UI for Single Redirects to facilitate wildcard pattern configuration without complex functions. Built a custom Rust crate for wildcard matching, optimizing for performance and supporting byte-oriented matching and escape sequences, while limiting the number of asterisks to ensure predictable performance.

8/16/2024

This post details Cloudflare's advancements in combating multi-channel phishing, which extends beyond email to SMS, messaging apps, cloud collaboration tools, and social platforms. It highlights the integration of Email Security, Gateway, Browser Isolation, and DLP to detect and prevent phishing attempts that involve clicking links, downloading files, or Business Email Compromise (BEC). A real-world example demonstrates how these integrated solutions can block malicious actions across different vectors, even when attackers adapt their tactics. The post also emphasizes the ease of deployment and management of these security measures through the Cloudflare One suite.

8/12/2024

This post introduces JA4, a successor to JA3, for more robust TLS client fingerprinting. It details the JA4 fingerprint structure, its advantages over JA3 (resistance to extension randomization, inclusion of ALPN), and the development of a new Rust-based parser, `client-hello-parser`, to efficiently parse TLS ClientHello messages and generate JA4 hashes. The parser emphasizes optimized memory usage (amortized zero heap allocations), memory safety, ultra-low latency through SIMD and iterators, and a robust testing suite including fuzzing and compatibility checks with legacy C parsers and Wireshark plugins. This enables better integration of JA4 fingerprints across Cloudflare's firewall rules, Workers, and analytics systems.

8/8/2024

Introduces Automatic SSL/TLS setting for origin connectivity, leveraging the SSL/TLS Recommender to transparently and seamlessly maximize encryption modes between Cloudflare and origin servers without risking site downtime. This builds upon previous efforts in Universal SSL and the SSL/TLS Recommender to automate origin security configuration.

7/29/2024

This post details the obsolescence of certificate pinning due to the evolving PKI ecosystem, specifically shorter certificate lifetimes and more frequent intermediate CA rotations. It highlights the increase in customer outages caused by certificate pinning and advocates for modern alternatives like ACME protocol adoption and increased use of certificate transparency logs.

7/19/2024

This post contributes to the website security and threat management thread by detailing observed cyberattack trends and internet traffic shifts during major political events in the US, specifically the 2024 Republican National Convention and the attempted assassination of Donald Trump. It highlights the occurrence of DDoS attacks targeting political websites and campaigns, the impact of news events on traffic to media outlets, and the importance of automated, in-line detection and mitigation systems for short, high-volume attacks. It also provides specific data points on attack volumes and traffic increases, reinforcing the need for robust threat management capabilities.

7/11/2024

This post provides a 2024 update on Cloudflare's Application Security Report, detailing a substantial increase in malicious traffic activity across the Internet. It highlights key trends including: WAF and Bot mitigations accounting for over half of all mitigated traffic, the rapid exploitation of CVEs (as fast as 22 minutes after proof-of-concept), DDoS attacks remaining the most common attack vector, a significant portion of observed traffic being automated and potentially malicious bots, and API traffic accounting for 60% of all traffic with a concerning quarter of API endpoints unaccounted for. It also introduces a new section on client-side security and the proliferation of third-party integrations, noting an average of 47 third-party endpoints integrated on enterprise sites. The report also quantifies network growth, with HTTP requests per second increasing by 23.9% YoY and DNS queries per second by 40% YoY, and a substantial 86.6% YoY increase in blocked cyber threats.

7/9/2024

This post details Cloudflare's DDoS threat landscape analysis for Q2 2024, observing a 20% year-over-year increase in DDoS attacks and a significant rise in threat actor sophistication, necessitating a tenfold increase in automated mitigation fingerprints. It also highlights the rise in Ransom DDoS attacks and provides detailed statistics on attacked countries, industries, and attack sources, along with an analysis of network-layer and HTTP DDoS attack vectors.

7/9/2024

This post details a new 'Blast-RADIUS' attack that exploits MD5 collision vulnerabilities in RADIUS/UDP authentication modes (PAP, CHAP, MS-CHAP). The attack allows a Man-in-the-Middle to gain unauthorized administrative access to network devices by forging RADIUS responses. It highlights the protocol's reliance on outdated cryptography and proposes mitigations including using RADIUS over TLS/DTLS or disabling vulnerable authentication modes.

7/8/2024

This post details Cloudflare's role in defending French political parties against significant DDoS attacks during the 2024 legislative elections. It quantifies the intensity and volume of these attacks, highlighting their impact on protected entities and their potential as a distraction for other cyber threats. Additionally, the post analyzes internet traffic shifts during election periods, noting a distinct dip in traffic when initial results were announced, and observes an increase in mobile device usage on election days. It also tracks DNS trends for news outlets and social media, demonstrating how these platforms see increased activity during election reporting.

7/3/2024

This post details Cloudflare's role in blocking Distributed Denial of Service (DDoS) attacks against three French political parties during the early stages of the 2024 legislative elections. It quantifies the attack volumes (up to 118,000 requests per second) and provides insights into traffic patterns, including a modest dip in overall internet traffic during voting hours and a subsequent increase after polls closed. The post also references previous election-related cyberattack coverage and directs readers to Cloudflare Radar for ongoing election insights.

7/3/2024

Introduced a one-click feature to block all AI bots and scrapers, leveraging global machine learning models to identify and block AI traffic, even when user agents are spoofed. This feature automatically updates with new bot fingerprints and is available to all customers. The post also details analysis of AI bot activity on Cloudflare's network, including popular AI bots by request volume and share of websites accessed, and discusses how website operators currently block AI bots.

6/26/2024

Introduced an automatic JavaScript URL rewriting service that rewrites links to polyfill.io found in websites proxied by Cloudflare to a link to Cloudflare's mirror on cdnjs. This feature leverages ROFL (Response Overseer for FL) for performant HTML rewriting on the fly, ensuring safety and efficiency. The feature is enabled by default for free plan customers and is an optional, single-click activation for paid plan customers. The service parses script tag source attributes and rewrites them if they link to polyfill.io, provided no Content Security Policy (CSP) header is present.

6/24/2024

This post introduces a new feature that automatically checks Cloudflare user passwords against threat intelligence sources monitoring data breaches. If a leaked password is detected during login, the user is alerted and prompted to reset their password after a grace period of three login attempts. The post also details how credentials leak (hashing, salting, credential stuffing attacks) and how customers can protect themselves (unique passwords, password managers, two-factor authentication). It explains the technical implementation of the leaked password check using password hashes and fast lookups, and outlines future plans for increasing 2FA adoption and expanding SSO capabilities.

6/24/2024

Introduced Bot Management machine learning model v8, which specifically targets the detection of residential proxy abuse. This model analyzes over 46 million HTTP requests per second in real-time, leveraging features based on request fingerprints, behavioral signals, and global statistics. The training process involves fetching and preparing datasets from Clickhouse, using Catboost models, and rigorous validation including specializations for different traffic sources. The model's effectiveness is evaluated through reproducibility checks, feature distribution analysis, and deployment in shadow mode before full activation. The detection of residential proxies is achieved by comparing direct vs. proxied requests, analyzing network latency discrepancies, and identifying unique fingerprints from browsing agents to track bots regardless of IP source, while avoiding broad IP blocking.

6/6/2024

This post details Cloudflare's mitigation of significant DDoS attacks targeting Dutch political websites during the European Parliament election. It quantifies attack volumes (billions of HTTP requests, tens of thousands of requests per second) and provides specific peak times and durations for two distinct attacks. It also contextualizes these attacks within broader geopolitical events and links to relevant resources for DDoS defense and election insights.

5/30/2024

This post details Cloudforce One's proactive disruption of the FlyingYeti phishing campaign targeting Ukraine. It describes the campaign's background, including the use of debt-themed lures and the COOKBOX PowerShell malware, and the exploitation of the WinRAR vulnerability CVE-2023-38831. The post outlines the technical details of the attack infrastructure, including the use of Cloudflare Workers and GitHub, and the analysis of the malicious RAR file. It also details the countermeasures taken by Cloudforce One, such as remediating the actor-associated Worker and developing detections, which significantly prolonged the actor's operational timeline and prevented them from achieving their objectives.

5/15/2024

This post details the integration of Cloudflare Zaraz CMP with IAB TCF requirements and Google's Consent Mode v2 signals, enabling compliance with advertising regulations and respecting user consent. It also introduces improved Bot Management support within Cloudflare Zaraz to fine-tune which requests trigger Zaraz events, helping to control costs and prevent bots from triggering analytics and conversion pixels.

5/10/2024

Introduces Custom Indicator Feeds, allowing authorized partners like the US Department of the Treasury and PNNL to publish threat intelligence (IoCs like IP addresses, URLs, domain names) directly into Cloudflare's platform. This enables financial institutions using Cloudflare Gateway to create DNS filtering policies that leverage this government-provided threat data, automating the integration of Indicators of Compromise (IoCs) for enhanced security against sector-specific threats.

5/7/2024

Introduces Cloudflare for Unified Risk Posture, a new suite of capabilities that converges SASE and WAAP portfolios for automated and dynamic risk posture enforcement. This suite evaluates risk across people (UEBA) and applications (threat detection), exchanges risk indicators with partners (CrowdStrike, Okta), and enforces automated risk controls. Highlights integrations with CrowdStrike Falcon Next-Gen SIEM for log sharing and Okta for user risk score enforcement. Introduces new first-party UEBA models for user risk scores based on device posture checks.

4/18/2024

This post announces Cloudflare's recognition in the Gartner Magic Quadrant for Security Service Edge (SSE) and highlights the evolution of its SSE capabilities, particularly within the Cloudflare One platform. It details advancements in Data Loss Prevention (DLP), Digital Experience Monitoring (DEX), and Cloud Access Security Broker (CASB) tools, emphasizing their integration and enhancement for enterprise security. The post also explains the concept of SSE and how Cloudflare One addresses its core components: Zero Trust Access Control, Outbound Filtering, Secure SaaS Usage, Data Protection, and Employee Experience.

4/17/2024

This post details Cloudflare's strategy for detecting and mitigating QR phishing (quishing) attacks within its cloud email security solution. It explains the mechanics of quishing, why QR codes are favored by attackers (error correction, obfuscation difficulty for machines, use on personal devices), and Cloudflare's two-part protection strategy: 1) identification and scanning of QR codes using computer vision and heuristics, and 2) analysis of decoded QR codes through URL deconstruction, malicious content scanning, and ML-based link reputation. It also highlights real-world examples of quishing impersonating Microsoft Authenticator and DocuSign.

4/16/2024

This post details the Q1 2024 DDoS threat landscape, highlighting a 50% year-over-year increase in mitigated attacks to 4.5 million. It notes an 80% YoY surge in DNS-based DDoS attacks, which now constitute 54% of network-layer attacks. The report also discusses the emergence of HTTP/2 Continuation Flood as a new, potentially severe attack vector, detailing its technical mechanism and impact, while confirming Cloudflare's network is not affected. It also mentions the continued prevalence of Mirai-variant botnets and the growth of Jenkins Flood attacks.

4/14/2024

This post analyzes internet traffic patterns in Israel and the Palestinian territories during Iran's April 13, 2024, attack. It observed a surge in traffic in Israel as people sought news and a noticeable drop in traffic in the Palestinian territories. The post also notes the absence of a coordinated large cyberattack on Israeli domains protected by Cloudflare, while highlighting ongoing DDoS attacks targeting the Government Administration sector. This contributes to the understanding of how Cloudflare's threat management capabilities are applied during significant geopolitical events and the types of attacks it monitors.

4/12/2024

This post details Cloudflare's proactive approach to managing the upcoming Let's Encrypt certificate chain change. It explains how Cloudflare will migrate customer certificates to ensure compatibility with legacy devices that might not support the new chain, thereby preventing service disruptions. The post also highlights the robustness of Cloudflare's TLS certificate pipeline, emphasizing its ability to ensure certificate availability, handle CA outages, adopt best security practices like 90-day certificate lifetimes, and support modern cryptographic standards like ECDSA, all to maintain a secure and accessible internet for everyone.

4/4/2024

This post introduces a new Rate Limiting API that can be directly accessed from Cloudflare Workers at runtime. Previously, rate limiting was primarily configured via the dashboard or API. This new API allows for dynamic enforcement of rate limits, enabling more granular control based on application needs, customer tiers, and specific scenarios. It is backed by memcached for speed and is designed to be easily integrated into Workers. This significantly enhances the flexibility and power of Cloudflare's rate limiting capabilities, moving beyond static configurations to dynamic, code-driven enforcement.

3/14/2024

This post details Cloudflare's proactive management of a critical upcoming change in Let's Encrypt's certificate chain, which will impact legacy devices. Cloudflare is transitioning to Let's Encrypt's ISRG Root X1 chain and provides guidance for customers to mitigate potential client-side issues, including options for Enterprise customers to switch to Google Trust Services. The post also reflects on past advancements in TLS adoption and PKI agility, highlighting Cloudflare's commitment to supporting new security standards for a more secure internet.

3/8/2024

Introduced protocol detection to Cloudflare Gateway, allowing for filtering of network traffic based on protocol signatures (e.g., SSH, HTTP, MQTT) rather than solely relying on port numbers. This was implemented by adding a TCP socket pre-read hook to OXY, Cloudflare's Rust-based policy framework, to buffer initial data bytes for comparison against a protocol signature database. This enables more precise security policies and reduces the risk of over/under-filtering.

3/8/2024

This post introduces new features for the URL Scanner, including integration with the Security Center for enhanced cybersecurity workflows, an official API for custom scans with features like custom HTTP headers and multi-device screenshots, and enhanced search functionality. It details the technical architecture of the URL Scanner, highlighting the use of Cloudflare Workers, Durable Objects, R2, Queues, and the Browser Rendering API, and explains the scanning process involving queuing, browsing, post-processing, and storage.

3/7/2024

Introduced the Advanced DNS Protection system, a new defense mechanism against sophisticated DNS-based DDoS attacks. This system complements existing DDoS defenses by leveraging a stateful mitigation platform called `flowtrackd` and a distributed, gossip-based threat intelligence sharing mechanism. It aims to address attacks that are difficult to mitigate with traditional fingerprinting methods, particularly randomized and DNS laundering attacks. New DNS-centric data points have also been added to the Network Analytics dashboard and GraphQL API.

3/7/2024

Introduced Page Shield Cookie Monitor, a feature within Page Shield that automatically collects and displays all first-party cookies used by a website in a single dashboard. This eliminates the need for manual scanning bots and simplifies compliance by providing an exportable list of cookies, their attributes, and tracking of their first and last seen times and pages. It also includes an alert for newly detected cookies.

3/6/2024

This post details the integration of the MASQUE protocol into Cloudflare's Zero Trust WARP offering. MASQUE, built on HTTP/3 and QUIC, replaces WireGuard as the tunneling protocol. Key technical benefits include leveraging standard port 443 for improved connectivity across restrictive networks, offering FIPS-compliant cipher suites via TLS 1.3, and providing a more extensible protocol for future Zero Trust solutions. The implementation leverages Cloudflare's existing global network infrastructure for MASQUE, HTTP/3, and QUIC, ensuring proven reliability and scale.

3/5/2024

Introduced a new quick view within Security Center Insights for CISOs and security teams, providing a comprehensive overview of current Cloudflare product configurations and recommendations for enhancements. This includes highlighting underconfigured areas, unassigned resources, or unutilized features across security products like WAF, Access, Email Security, and Page Shield. Added the ability to export Security Insights using the public API, with dashboard export coming soon.

3/5/2024

Introduces the Deskope Program for migrating Netskope customers to Cloudflare One, mirroring the existing Descaler Program for Zscaler. Details the technical approach involving API calls for extracting, transforming, and loading Netskope configurations into Cloudflare One. Highlights the speed and simplicity advantages of Cloudflare Gateway over Netskope. Also announces the expansion of the Descaler Program to Authorized Service Delivery Partners, providing them with access to the Descaler toolkit and training.

3/5/2024

This post announces the General Availability (GA) of JWT validation in Cloudflare's API Gateway. It details the improvements made since the beta release, including support for Bearer token format, multiple JWKS configurations, validation of JWTs in cookies, and the ability to exclude managed endpoints. The post also explains the threat of broken authentication and authorization, provides a primer on JWT structure and its security benefits, and illustrates how JWT validation protects against missing/broken authentication and expired token reuse.

3/5/2024

Introduced Optical Character Recognition (OCR) to the Data Loss Prevention (DLP) engine, enabling the extraction and classification of sensitive information from images. Added predefined source code detections for common programming languages (C, C++, C#, Go, Haskell, Java, Javascript, Lua, Python, R, Rust, and Swift) to scan inline traffic and block HTTP requests containing source code, preventing data leaks and accidental exposure to external tools. These capabilities are available for both data at rest (via CASB) and data in transit (via Gateway).

3/4/2024

Introduces Firewall for AI, a new protection layer for Large Language Models (LLMs). This feature extends existing WAF capabilities like Rate Limiting and Sensitive Data Detection to address LLM-specific threats such as prompt injection, data exfiltration, and model denial of service. It analyzes user prompts to identify and block abuse attempts before they reach the LLM, and can be deployed in front of models hosted on Cloudflare Workers AI or other infrastructures.

3/4/2024

This post details Cloudflare's commitment to CISA's 'Secure by Design' principles, highlighting how memory-safe languages like Rust are used in critical components like the WAF and HTTP proxy (Pingora), and how Zero Trust principles are applied by default. It also emphasizes the free offering of Universal SSL, unmetered DDoS mitigation, MIGP for credential checking, WAF Managed Rulesets, and post-quantum cryptography, all of which contribute to a more secure internet by default.

3/4/2024

This post details how Cloudflare's email security models are being enhanced to defend against AI-generated phishing and Business Email Compromise (BEC) attacks. It explains how LLMs can be used by attackers to create more convincing emails, but also highlights the inherent limitations and trade-offs. Cloudflare's existing machine learning systems, trained on billions of messages, are already equipped to detect these AI-enhanced threats by analyzing multiple signals beyond just text, including sender reputation, domain authenticity, communication patterns, and metadata. The post provides examples of how these signals are used to identify malicious emails, such as domain mismatches and recently registered domains, and discusses the importance of opportunity and data availability as bottlenecks for AI-driven attacks. It also reiterates the effectiveness of Cloudflare's existing email security products in protecting customers.

3/4/2024

This post details the analysis of a Magecart-style attack script detected by Cloudflare Page Shield. It describes the infection mechanism, the obfuscated JavaScript code, the malicious domain's registration and hosting provider (1337team Limited), and the script's data encoding/decoding functions, targeted data fields, harvesting logic, stealthy data exfiltration via image elements, persistent monitoring, execution intervals, and local data storage. It also highlights the proactive detection capabilities of Page Shield's ML model and recommends WAF Managed Rule Product for enhanced security.

3/4/2024

Introduces user risk scoring within Cloudflare One, leveraging AI/ML to analyze real-time user activity telemetry and identify abnormal behaviors. This feature assigns Low, Medium, or High risk scores to users based on predefined and custom behavioral rules, such as 'impossible travel' and Data Loss Prevention (DLP) triggers. The system analyzes existing Zero Trust logs without collecting additional user data, enabling dynamic security posture adjustments.

3/3/2024

This post announces new products and features for Security Week 2024, focusing on three key CISO challenges: responding to AI risks and opportunities, maintaining visibility and control in evolving cloud environments, and consolidating technologies to manage security budgets. Specific technical contributions include tools to safeguard AI models and applications, AI-powered analytics features, and measures to prevent data leakage from AI. The post also highlights advancements in securing multi-cloud environments and cost-saving consolidation strategies.

2/29/2024

This post introduces an alternative, Cloudflare-hosted endpoint for polyfill.io on cdnjs. This directly addresses supply chain risks associated with third-party JavaScript libraries by offering a more secure and reliable hosting option. It also highlights Cloudflare's commitment to web security by providing this alternative and mentions the development of Page Shield for detecting and mitigating such attacks.

2/1/2024

This post details a security incident where a threat actor gained access to Cloudflare's internal Atlassian servers using unrotated credentials from a previous Okta compromise. The incident involved reconnaissance, access to Jira, Confluence, and Bitbucket, and attempts to gain further access. Cloudflare's response involved a 'Code Red' remediation effort, including rotating over 5,000 production credentials, physically segmenting systems, reimaging and rebooting global network machines, and replacing hardware in a new data center. The post emphasizes the effectiveness of Cloudflare's Zero Trust architecture in limiting lateral movement and protecting customer data, while also highlighting lessons learned regarding internal credential management and system hardening.

1/26/2024

Mitigated 35.7 million malicious HTTP requests targeting Jewish and Holocaust educational websites in 2023, a 2,190% increase from 2022. The share of mitigated requests for these websites grew from 0.3% in 2022 to 2.6% in 2023, an 872% year-over-year growth. This surge in cyber attacks against these specific websites coincides with a 27% increase in DDoS attacks against Israeli websites.

1/23/2024

This post details how Cloudflare's AI-powered WAF Attack Score proactively detected and blocked exploitation attempts for CVE-2023-46805 and CVE-2024-21887, zero-day vulnerabilities in Ivanti Connect Secure. It provides a technical analysis of the exploitation techniques, including directory traversal and command injection via crafted HTTP requests and JSON payloads. It also explains how the WAF Attack Score, particularly the 'WAF RCE Attack Score', identified these malicious requests before they were publicly disclosed, and highlights the rapid deployment of emergency managed rules to mitigate the threat.

1/9/2024

This post details the evolution of DDoS attack trends observed in Q4 2023 and throughout the year. It highlights a significant increase in network-layer DDoS attacks (117% YoY) and a decrease in HTTP DDoS attacks (20% YoY). It also details specific attack patterns related to geopolitical events (Israel-Hamas conflict, Taiwan tensions) and major conferences (COP 28). A key technical contribution discussed is the mitigation of hyper-volumetric DDoS attacks exploiting an HTTP/2 vulnerability, including the largest attack ever seen by Cloudflare (201 million rps). The post also quantifies the volume of mitigated HTTP and network-layer attacks, and analyzes attack targets by industry and region.

1/9/2024

This post introduces Cloudflare's 2024 API security and management report, detailing findings from real traffic data. It highlights the prevalence of 'Shadow APIs' (undiscovered APIs) and introduces Cloudflare's API Discovery tool, which uses machine learning to identify these hidden endpoints. It also discusses best practices for API rate limiting, recommending session-based limits over IP-based limits, and introduces Cloudflare's Advanced Rate Limiting and API Gateway for precise control. The post also emphasizes the importance of applying WAF protection to API traffic to mitigate web application attacks.

1/4/2024

This post details the upgrade of the Privacy Pass protocol to its latest IETF draft version. It introduces new open-source templates for Privacy Pass Origins, Issuers, and Attesters based on Cloudflare Workers, and releases updated browser extensions named 'Silk - Privacy Pass Client'. The post also discusses the deprecation of the Privacy Pass API for configuration and highlights the integration of Privacy Pass as a signal in Cloudflare's Web Application Firewall and Bot Management products, as well as Apple's Private Access Tokens system.

12/18/2023

This post details the integration of Cloudflare Turnstile with the Cloudflare Web Application Firewall (WAF). It introduces the concept of 'Pre-Clearance mode' for Turnstile, allowing it to issue a `cf_clearance` cookie for a domain. This enables the WAF to manage fetch requests that would otherwise fail due to expecting HTML responses instead of JSON/XML. The post provides a technical walkthrough of implementing this integration by overriding the `fetch` function to invoke Turnstile when a `cf-mitigated` header with a 'challenge' value is detected, and then replaying the request.

11/24/2023

This post analyzes internet traffic trends during Thanksgiving in the US, providing insights into user behavior and security-related traffic patterns. It details a 10% daily decrease in internet traffic, with specific hourly drops and variations across states. The post also highlights an increase in mobile traffic, a slowdown in food delivery and online grocery shopping DNS traffic, the lowest percentage of DDoS attacks targeting the US in November, a significant drop in email messages sent, and an increase in spam percentage. These observations contribute to understanding how major cultural events impact network traffic and security threats, informing future threat management and traffic optimization strategies.

11/20/2023

This post details the mitigation of 234,740,000 threats to U.S. election groups between Nov 2022 and Aug 2023, with HTTP Anomaly and SQL Injection being the top WAF attack vectors. It also highlights increased traffic to government election sites during election periods and the adoption of .gov domains. The post also details threat mitigation for political campaigns and organizations promoting voting rights, with a focus on WAF rule effectiveness and specific attack patterns.

11/15/2023

Introduced hostname and ASN lists as new types of Custom Lists for the WAF. These lists allow users to manage and reference collections of hostnames and Autonomous System Numbers (ASNs) within WAF rules, improving manageability, reducing rule complexity, and overcoming expression editor limitations. This expands upon the existing IP list functionality.

10/26/2023

Introduced HAR Sanitizer, an open-source tool built on Cloudflare Workers that sanitizes HTTP Archive (HAR) files by stripping session-related cookies and JWTs. This tool addresses the security risk of HAR files being used as an attack vector after the Okta breach. The sanitizer offers default stripping of sensitive information and a 'just enough' sanitization mode for specific use cases like Cloudflare Access JWTs, where the cryptographic signature is removed while retaining debugging information. Future enhancements include DLP scanning and automated sanitization in collaboration tools.

10/26/2023

This post details the evolution of Cloudflare's DDoS mitigation capabilities, specifically highlighting the unprecedented scale of HTTP/2 Rapid Reset attacks in Q3 2023. It quantifies the increase in HTTP DDoS traffic (65% QoQ) and L3/4 DDoS attacks (14% QoQ), detailing the largest attacks observed (201M rps for HTTP, 2.6 Tbps for L3/4). It also discusses the shift in targeted industries and the sources of these attacks, including the impact of VM-based botnets and the exploitation of HTTP/2. The post also references an engineering blog post for a deeper technical dive into the HTTP/2 Rapid Reset vulnerability and mitigation strategies.

10/23/2023

This post details Cloudflare's response to significant DDoS attacks targeting Israeli websites during the Israel-Hamas war, including mitigation of attacks peaking at 1M rps. It also highlights the discovery and analysis of malicious Android applications impersonating legitimate alert apps, which exfiltrated sensitive user data. The post provides statistics on targeted industries and attack volumes against both Israeli and Palestinian websites, underscoring the role of Cloudflare's security services in conflict zones.

10/20/2023

This post details Cloudflare's mitigation of a security incident originating from a compromise of Okta's systems. It highlights the effectiveness of Cloudflare's Zero Trust architecture, Gateway, and Data Loss Prevention in detecting and containing the threat actor's access before it could impact customer data or production systems. The post also provides recommendations for Okta and its customers regarding security best practices, particularly around multi-factor authentication and session management.

10/14/2023

This post details the discovery and analysis of a malicious Android application impersonating the legitimate RedAlert - Rocket Alerts application. It describes the attack vector (domain impersonation, modified open-source code), the malicious APK's capabilities (data exfiltration of SIM info, contacts, SMS, accounts, call logs, installed apps), its encryption methods (AES-CBC, RSA), anti-analysis techniques (anti-debugging, anti-emulation, anti-test), and provides indicators of compromise (IOCs) including the malicious APK download URL, C2 IP address, APK hash, and public key.

10/10/2023

This post details the HTTP/2 Rapid Reset attack (CVE-2023-44487), a novel DDoS vector that exploits the HTTP/2 protocol's RST stream mechanism to generate massive request volumes with minimal botnet resources. It explains the HTTP/1.1 and HTTP/2 protocols, the stream lifecycle, and how the RST_STREAM frame can be abused. Cloudflare's mitigation strategies, including automated DDoS system enhancements and coordinated disclosure with Google and AWS, are discussed. The post also provides technical details on the attack's mechanics and the protocol features exploited.

10/10/2023

This post details Cloudflare's response to a novel zero-day vulnerability in the HTTP/2 protocol, dubbed 'HTTP/2 Rapid Reset'. It describes how the vulnerability was exploited to generate hyper-volumetric DDoS attacks, including an attack exceeding 201 million requests per second. Cloudflare mitigated these attacks by developing purpose-built technology and collaborating with industry partners for responsible disclosure and patching. The post also provides recommendations for CSOs on how to protect their organizations.

10/5/2023

This post details Cloudflare's discovery and mitigation of the CVE-2023-4863 vulnerability in the libwebp library. It explains the technical details of the heap buffer overflow, its widespread impact beyond Google Chrome, and Cloudflare's swift action in patching its services and reporting to the RustSec advisory. The post highlights the interconnectedness of the internet ecosystem and the importance of responsible disclosure and timely updates.

10/4/2023

This post details the proactive application of new managed WAF rules to protect all Cloudflare customers against the zero-day vulnerability CVE-2023-22515 affecting Atlassian Confluence Server and Data Center products. It outlines the rule IDs and their default actions (Block) for new, legacy, and free managed rulesets, demonstrating Cloudflare's rapid response to emerging threats.

10/4/2023

This post announces a significant enhancement to Cloudflare Waiting Room, enabling it to protect multiple hostname and path combinations with a single waiting room configuration. This addresses a key customer need for broader site coverage and more flexible deployment, particularly for complex site structures like those using subdomains for different sections (e.g., checkout) or for multilingual sites. The update allows for a unified waiting room experience across these diverse configurations, simplifying management and improving end-user journeys during traffic surges. It also provides guidance and starter templates for implementing multi-language waiting rooms.

9/29/2023

Introduced Encrypted Client Hello (ECH) as a successor to ESNI, available on all Cloudflare plans. ECH encrypts the Server Name Indication (SNI) during the TLS handshake, preventing network intermediaries from determining which specific website a user is visiting. The implementation involves splitting the ClientHello message into an outer, non-sensitive part with a shared SNI (cloudflare-ech.com) and an inner, encrypted part with the actual server name, readable only by Cloudflare.

9/29/2023

This post details Cloudflare's research and implementation of machine learning models to achieve zero time to mitigate for Web Application Firewall (WAF) threats. It explains the process of creating a high-quality training set using existing signatures and real traffic, enhancing it with artificial data, and building a fast classifier. The goal is to detect novel web attack vectors before they are known to security researchers, moving beyond signature-based detection alone.

9/29/2023

This post announces the complete replacement of all CAPTCHAs issued by Cloudflare with Turnstile, a new CAPTCHA replacement. Turnstile is now generally available and free for unlimited use in its 'Managed' mode. It is designed to be easy on humans, hard on bots, and private, meeting WCAG 2.1 Level AA compliance and GDPR/CCPA requirements. The post details the technical approach of analyzing background data and browser characteristics during a lightweight test (e.g., proof-of-work) to identify bots, rather than relying on visual puzzles. It also highlights Turnstile's effectiveness in preventing automated account signups and its successful handling of high-traffic events like the Eurovision final vote. Lessons learned during the beta include the need for transparency in challenge failure reasons and the development of new methods to detect cached challenge pages and accommodate privacy-focused browser configurations.

9/29/2023

Introduced new Verified Bot categories (Search Engine Crawler, Aggregator, AI Crawler, Page Preview, Advertising, Academic Research, Accessibility, Feed Fetcher, Security, Webhooks) available in the Cloudflare Rules Engine and Workers. This allows for more granular control over bot traffic, enabling specific responses to different bot types, such as blocking AI crawlers while allowing search engine crawlers. Also detailed criteria for tagging respectful AI bots, expanding the Verified Bots policy.

9/28/2023

This post announces a partnership with Microsoft Edge to power its Secure Network VPN. It details how Cloudflare's Privacy Proxy Platform, utilizing HTTP CONNECT, 1.1.1.1 for DNS, and Privacy Pass for authentication, provides a private and secure VPN experience directly within the browser. It highlights the platform's ability to maintain geolocation parity and leverage Cloudflare's global network for low latency and performance benefits, extending the company's security offerings into browser-level privacy.

9/26/2023

This post details how Cloudflare can help users avoid AWS's new IPv4 charges by facilitating a transition to IPv6. It explains the technical steps involved in enabling IPv6 compatibility on Cloudflare and configuring AWS origins for IPv6. It also provides a credit incentive for Pro/Business subscribers who adopt this feature. The post also elaborates on the technical reasons behind IPv4 exhaustion and the advantages of IPv6.

9/20/2023

This post details the evolution of Cloudflare Waiting Room's core queuing mechanism. It explains how Waiting Room, built on Workers and Durable Objects, makes dynamic decisions on when to queue legitimate traffic spikes to protect customer sites. The post elaborates on the challenges of distributed state management and introduces the refined algorithm that uses traffic history and configured limits (total active users, new users per minute) to make low-latency queuing decisions at the worker level, while also discussing the trade-offs and potential side effects of this distributed approach.

9/19/2023

Introduced Rate Limit Analysis within Security Analytics to provide data-driven insights for setting rate limiting thresholds. This includes analyzing request rates based on IP, JA3 fingerprint, or a combination, over various time intervals. Also introduced a new 'throttle' behavior for rate limiting rules, which selectively drops requests to maintain a defined rate threshold, as an alternative to the 'fixed action' behavior.

9/15/2023

This post introduces significant enhancements to Cloudflare's Page Shield product, making Content Security Policies (CSPs) easier to manage. Key contributions include: full support for all major CSP directives (beyond the previously supported script-src), an improved suggestions engine that leverages observed network activity to auto-populate policy directives for script-src and connect-src, the ability to filter policy application by URI path, and the introduction of a feature to import existing CSP policies directly into the Page Shield interface. The post also details the `upgrade-insecure-requests` directive and discusses the ongoing roadmap for suggestions on other directives.

8/29/2023

This post details how Meter leverages the Cloudflare Tenant API and Cloudflare Gateway for DNS filtering. It highlights the implementation of parent-child policy configurations, allowing for granular control across different customer locations (offices, warehouses). Technical details include the use of Gateway locations defined as IPv4, IPv6, DoH, and DoT endpoints, customizable block pages, and the ability for customers to upload their own certificates for custom block pages.

8/21/2023

This post provides a quarterly update on application security trends observed on the Cloudflare network for Q2 2023. It details the volume of mitigated traffic, the breakdown between WAF and DDoS mitigation, and the increasing reliance on WAF custom rules. It highlights the common use of geolocation fields in WAF rules and the continued exploitation of older CVEs. Specific examples include CVE-2015-1635 for Microsoft IIS and WordPress wp-config.php access attempts.

8/16/2023

This post contributes to the 'Website Security & Threat Management' thread by providing a detailed analysis of phishing threats observed between May 2022 and May 2023. It outlines Cloudflare's email security data processing, the volume of blocked malicious messages, and key phishing trends identified, including deceptive links, identity deception, and brand impersonation. It also details the technical methods used for email threat categorization, such as structural analysis, sentiment analysis, and trust graphs, and provides specific examples of attack vectors, including a Microsoft credential harvesting attempt that utilized OCR and a multi-stage redirect chain.

8/9/2023

Introduced per-hostname TLS settings, allowing granular control over minimum TLS versions and cipher suites for individual hostnames within a domain. This supersedes zone-level settings and addresses the trade-off between adopting modern, secure protocols and maintaining compatibility with legacy clients and devices.

8/4/2023

This post analyzes the most exploited vulnerabilities of 2022 based on Cloudflare's WAF data, highlighting Log4J and Atlassian Confluence Code Injection as the most prevalent. It details the specific CVEs, their impact, and Cloudflare's rapid response with WAF managed rules, including emergency releases and the extension of these protections to free plans. The post also presents trends of exploit attempts over time for various vulnerabilities, demonstrating the ongoing relevance of these threats and the effectiveness of Cloudflare's security measures.

7/28/2023

Introduced a BGP origin hijack detection system integrated with Cloudflare Radar. The system uses a Rust-based custom IP prefix trie to process BGP update messages, detect origin changes, and identify potential hijack events. It leverages data from live BGP streams and historical archives (RouteViews, RIPE RIS) to provide public detection results and APIs for integration into user workflows.

7/18/2023

This post details Cloudflare's Q2 2023 DDoS threat landscape, highlighting the increase in sophisticated and randomized HTTP DDoS attacks, a surge in DNS-based attacks including DNS Laundering, and the impact of hacktivist groups. It describes the technical challenges in mitigating highly randomized HTTP attacks that mimic browser behavior and the analysis of DNS Laundering attacks that leverage recursive DNS resolvers. The post also details the detection and mitigation of large-scale DDoS attacks, including an ACK flood from a Mirai-variant botnet and attacks associated with the 'Darknet Parliament' hacktivist alliance, providing insights into attack vectors, target industries, and mitigation strategies.

7/14/2023

This post introduces 'Version Comparisons' for Zone Versioning, a new capability that allows Enterprise customers to perform side-by-side diffs of their zone configurations between different versions. This directly addresses the challenge of manually inspecting configuration changes, making it easier and safer to evaluate and deploy new versions of zone configurations by providing a diff-like experience within the Cloudflare dashboard.

7/13/2023

Introduces Exact Data Match (EDM) for Data Loss Prevention (DLP). EDM allows customers to securely provide lists of sensitive data (e.g., credit card numbers, names, addresses) which are then hashed before reaching Cloudflare. Cloudflare scans traffic or repositories for matches of these hashes, enabling targeted DLP detections and reducing false positives compared to generic pattern matching. The feature includes a mechanism for uploading DLP datasets and integrating them into DLP profiles for inline scanning with Gateway or data-at-rest scanning with CASB.

7/11/2023

This post introduces the capability for customers to bring their own Certificate Authority (CA) to use for mutual TLS (mTLS) client authentication within Cloudflare's API Shield solution. Previously, API Shield provided a self-signed CA for customers. This new feature allows customers to use their existing private CAs or CAs issued by approved third parties, enhancing security and control over their mTLS configurations. It involves uploading CAs to an account-level endpoint and associating them with mTLS-enabled hostnames via the API Shield hostname association API. The feature also includes a logging mechanism for firewall rules to test setup before enforcement.

6/23/2023

This post details the integration of Cloudflare Turnstile with the Eurovision voting API endpoints to validate online votes and prevent fraudulent requests from emulated browsers. It also highlights the use of Cloudflare CDN, DDoS protection, and WAF to mitigate attacks during the event.

6/22/2023

The Descaler Program has been enhanced with new features to accelerate the migration of Zscaler configurations to Cloudflare One. These enhancements include the ability to export configurations in a shareable Terraform file, enabling infrastructure-as-code management, and the addition of a summary output that details migratable objects. These improvements reduce migration time from days to hours and address customer feedback regarding workflow integration and visibility.

6/22/2023

This post details Cloudflare's approach to measuring and optimizing Zero Trust performance. It argues for end-to-end HTTP response time as the primary metric, contrasting it with proxy latency and decrypted latency SLAs. The post explains the importance of last-mile peering, cloud peering, and diverse network paths for achieving optimal Zero Trust performance. It also outlines the methodology for performing these measurements using client programs that connect to enterprise websites through Cloudflare's Zero Trust services.

6/22/2023

This post introduces MASQUE, a new protocol for Cloudflare WARP that extends HTTP/3 and QUIC to proxy IP and UDP traffic. It aims to improve internet browsing speed and stability, offering a standards-based alternative to WireGuard with better extensibility and resilience. The integration of MASQUE into WARP is a significant step towards enhancing the security and performance of Cloudflare's consumer and enterprise offerings, particularly within the Zero Trust suite.

6/21/2023

This post details performance testing methodology and results for Cloudflare's Zero Trust offerings (SWG, ZTNA, RBI) against competitors (Zscaler, Netskope, Palo Alto Networks). It explains the importance of performance in Zero Trust adoption, the testing setup involving VMs in 12 regions, and the metrics used (95th percentile HTTP response time). It highlights Cloudflare's speed advantage attributed to its global network, extensive peering, and local presence, providing specific performance comparisons and regional data.

6/12/2023

This post details the development of a custom GraphQL query parser for Cloudflare's API Gateway. The parser tokenizes GraphQL queries in a streaming fashion to achieve low latency (p95 < 50 microseconds) and minimal memory allocation, enabling the extraction of query size and depth attributes. These attributes are then exposed via Wirefilter fields (`cf.api_gateway.graphql.query_size`, `cf.api_gateway.graphql.query_depth`, `cf.api_gateway.graphql.parsed_successfully`) to allow customers to create security rules against malicious GraphQL queries, specifically addressing denial-of-service risks from deeply nested or overly broad queries.

6/7/2023

Introduced Waiting Room Analytics, providing detailed metrics and visualizations of waiting room traffic, including time in queue, time on origin, active users, and new users per minute. This enables users to understand the impact of Waiting Room settings on user experience and make informed configuration decisions.

5/3/2023

This post introduces performance benchmarks comparing Cloudflare Access against Zscaler and Netskope across 10 Latin American countries. It details the testing methodology, focusing on 95th percentile Time to First Byte and Response times from an end-user perspective. The data shows Cloudflare Access to be significantly faster, attributing this to its larger data center presence in LATAM and optimized network performance.

4/25/2023

This post details the discovery of CVE-2023-29552, a new DDoS reflection/amplification attack vector leveraging the SLP protocol. It explains the SLP protocol, its exposure on the internet, and its high amplification factor. Cloudflare customers are protected by its automated DDoS protection system. Network operators are advised to block UDP port 427 to prevent their networks from being exploited to launch attacks.

4/20/2023

This post details Cloudflare's adoption of 'Secure-by-Design' and 'Secure-by-Default' principles, aligning with CISA's recommendations. It highlights the rewrite of the WAF evaluation engine in Rust for memory safety and performance, and the automatic provisioning of SSL certificates as examples of these principles. The ML-computed WAF Attack Score is presented as a mechanism for protecting against zero-day attacks without manual configuration. Cloudflare Tunnel is also discussed as a secure-by-default solution for network connectivity.

4/11/2023

This post details the evolving landscape of DDoS attacks in Q1 2023, highlighting the rise of hyper-volumetric attacks powered by VPS-based botnets and the continued prevalence of Ransom DDoS attacks. It showcases Cloudflare's automated mitigation capabilities for large-scale attacks (e.g., 71M rps, 1.3 Tbps) and emphasizes proactive measures, including collaboration with cloud providers and the launch of a free Botnet Threat Feed. The report also provides key statistics on targeted countries and industries, and discusses the shift towards DNS-based attacks as a popular vector.

4/6/2023

This post introduces Zone Holds, a new enterprise feature that prevents accidental or malicious takeover of a domain's Cloudflare configuration. It allows account owners to prevent other Cloudflare accounts from adding the same zone, optionally extending this protection to subdomains and custom hostnames. This directly addresses the risk of multiple teams within an organization inadvertently disrupting existing security configurations, ensuring a more controlled and secure environment for managing web properties.

4/3/2023

This post details a vulnerability discovered in Cloudflare's mTLS implementation where revoked client certificates were not being blocked during TLS session resumption. The issue stemmed from the client certificate chain not being re-evaluated after a session was resumed, leading to a bypass of Firewall Rules. The immediate mitigation involved disabling session resumption for mTLS connections, followed by a permanent fix that ensures the client certificate serial number and issuer SKI are correctly accessed and checked for revocation status even during session resumption.

3/29/2023

This post details Cloudflare's observation and mitigation of DDoS attacks targeting Australian universities by Killnet and AnonymousSudan. It explains the nature of these hacktivist groups and their attack methodologies, highlighting the increasing scale and audacity of such attacks. The post also provides specific recommendations for Cloudflare customers to enhance their DDoS protection, including enabling managed rulesets, adaptive DDoS protection, firewall rules, rate-limiting, and bot fight mode, reinforcing the company's commitment to providing unmetered and unlimited DDoS protection.

3/23/2023

This post introduces DCV Delegation, a feature that allows customers managing their DNS externally to offload the Domain Control Validation (DCV) process for TLS certificates to Cloudflare. This enables automatic renewal of TLS certificates without manual intervention, addressing the increased management overhead caused by shorter certificate lifetimes and stricter validation requirements like DNS-based DCV for wildcard certificates. This enhances the overall security and reliability of certificate management for a broader customer base.

3/18/2023

Introduced Account Security Analytics and Account Security Events, providing centralized dashboards for monitoring security-related traffic and events across all customer domains. These features offer account-level visibility into mitigated and non-mitigated traffic, security rule matches, and traffic patterns, enabling faster threat detection, configuration tuning, and identification of false positives/negatives for customers managing numerous zones.

3/18/2023

Introduced multi-domain and wildcard support for Cloudflare Access application definitions, allowing a single Access application to protect multiple subdomains or a pattern of hostnames. This simplifies policy management for organizations with numerous subdomains or single-page applications with separate front-end and API hostnames, and ensures consistent JWT cookie issuance across protected hostnames.

3/17/2023

This post details the integration between Cloudflare Area 1 email security and KnowBe4's SecurityCoach product. It outlines the technical steps required to set up the integration, including creating service accounts and API keys in the Cloudflare Area 1 dashboard and configuring the integration within the KnowBe4 KMSAT console. The post also describes how the integration provides real-time coaching to users when malicious attachments, links, spoofed emails, or suspicious emails are detected by Area 1.

3/16/2023

Super Bot Fight Mode has been re-architected and integrated as a managed ruleset within the new WAF, allowing for configuration via Custom Rules. This enables a 'skip' action for Custom Rules, which can bypass Super Bot Fight Mode, providing more granular control. A specific configuration option has been added to securely allow WordPress loopback requests. Future plans include migrating the original Bot Fight Mode for Free plan customers.

3/15/2023

Introduces Cloudflare Fraud Detection, a new capability to detect and categorize online fraud. This includes specific detections for fake account creation (leveraging signup data and threat intelligence) and expediting (using encrypted tokens to enforce normal user flow and timing). The system utilizes machine learning models that execute in under 0.2 milliseconds and integrates with Firewall Rules for flexible deployment options.

3/15/2023

This post introduces the Radar URL Scanner, a new free tool that provides a comprehensive report on a given URL, encompassing security (phishing, SSL), cookies, network activity, technologies, DOM, and performance. It leverages Cloudflare's Workers Browser Rendering API and aims to enhance threat modeling and provide aggregate insights into internet trends, thereby extending Cloudflare's capabilities in website security and threat analysis.

3/15/2023

Introduced WAF Attack Score Lite and Security Analytics for Business plan customers. WAF Attack Score Lite uses machine learning to classify incoming HTTP requests into four types: Attacks, Likely Attacks, Likely Clean, and Clean, focusing on SQL Injection, Cross-Site Scripting, and Remote Code Execution attacks. Security Analytics provides a dashboard for investigating traffic and false negatives. The `cf.waf.score.class` field is exposed for use in WAF Custom Rules and Rate Limiting Rules.

3/15/2023

Introduced Cloudflare Sequence Analytics for APIs, a new feature within API Gateway that allows customers to view and protect important sequences of API requests. This feature enables the creation of positive security models for APIs by enforcing the precedence of endpoints within a sequence, thereby reducing abusive traffic. The post details the concept of API sequences, the challenges in detecting abuse through sequence analysis, and the three-pronged approach of Sequence Analytics, Abuse Detection, and Mitigation.

3/15/2023

This post details the application of machine learning, specifically transformer-based neural networks, to detect malicious domains. It covers the training of models using DNS resolver data and known DGA domains, achieving over 99% accuracy. It also describes the deployment of these models to process DNS query names from the 1.1.1.1 resolver for real-time detection of DGA domains. Additionally, it introduces a two-stage model for detecting DNS tunneling, distinguishing it from benign applications that use similar query patterns.

3/15/2023

This post details Cloudforce One's proactive monitoring and detection of phishing campaigns leveraging the Silicon Valley Bank (SVB) brand following its collapse. It describes a specific KYC phishing campaign using a DocuSign-themed template and a multi-stage redirect chain involving Sizmek, Google Firebase, and a WordPress site, ultimately leading to an attacker-controlled domain. The post provides indicators of compromise and recommendations for customers, including specific search terms for Cloudflare Email Security, DMARC policy enforcement, and the importance of WAF protection for public-facing applications.

3/14/2023

This post introduces the integration of Cloudflare One's Data Loss Prevention (DLP) capabilities with Microsoft Purview Information Protection sensitivity labels. This allows organizations to leverage their existing Microsoft data classification and protection tools to identify and control sensitive data movement across corporate traffic managed by Cloudflare One. The integration enables CASB to retrieve Microsoft labels, populate DLP profiles, and build firewall policies to enforce rules based on these labels, extending Microsoft's data protection beyond its native environment.

3/14/2023

This post introduces the 'Descaler Program,' a new initiative designed to facilitate the migration of Zscaler customers to Cloudflare One. It highlights Cloudflare One as a unified SASE platform that combines network connectivity and Zero Trust security. The program offers technical migration tools, architecture workshops, and business components like ROI calculations and contract escape hatches to derisk the transition. It emphasizes Cloudflare One's advantages over Zscaler in user experience, connectivity, and agility.

3/14/2023

This post provides updated insights and trends on mitigated traffic, bot and API traffic, and account takeover attacks, based on Cloudflare's network traffic data from March 2022 through February 2023. It details the definitions of mitigated traffic, bot traffic, and API traffic, and presents global traffic insights including the percentage of mitigated HTTP requests, the breakdown of mitigated traffic by product group (DDoS, WAF, IP reputation, Access Rules), and the most frequent layer 7 attack vectors mitigated by the WAF. It also includes insights into bot traffic, highlighting the confidence in bot classification and the distribution of bot scores.

3/13/2023

Introduced new Brand and Phishing Protection tools within the Cloudflare Security Center. These tools leverage DNS query monitoring from 1.1.1.1 to detect newly observed domains and use fuzzy matching against user-defined patterns to identify and alert on potentially confusable domains used in phishing attacks. The feature includes real-time alerting and historical search capabilities for domains observed in the last 30 days. The post also details observations of the top 50 most impersonated brands in phishing attacks.

3/13/2023

Introduced Cloudflare Aegis, a feature providing dedicated egress IP addresses for customers. This allows organizations to lock down their services at an IP level, enhancing Zero Trust migration by enabling IP-based access control lists (ACLs) for origins, complementing existing mTLS and Access solutions. Aegis aims to simplify the transition for large organizations with many applications by reducing the complexity of IP allowlisting.

3/13/2023

Introduced Page Shield policies, a new feature for Cloudflare's client-side security solution. These policies leverage Content Security Policies (CSPs) to implement a positive security model, allowing administrators to define approved lists of external JavaScript libraries and connection endpoints. The feature aims to reduce the attack surface by preventing the execution of unvetted scripts and limiting data exfiltration. It includes a suggestions feature to simplify CSP management and supports both 'report only' and 'enforce' modes.

3/13/2023

Introduced general availability of mTLS support for Cloudflare Workers, enabling Workers to authenticate to services secured by mTLS. This involves uploading client certificates and private keys via `wrangler mtls-certificate upload`, configuring `mtls_certificates` bindings in `wrangler.toml`, and using the `environment.<BINDING>.fetch()` method in Worker code to present the client certificate during the TLS handshake.

2/13/2023

This post details Cloudflare's mitigation of a record-breaking 71 million requests per second (rps) HTTP/2-based DDoS attack. It highlights the scale of the attack, its origin from over 30,000 IP addresses, and the types of targeted websites. The post also announces a free Botnet threat feed for service providers and provides recommendations for customers to optimize their DDoS protection, including enabling managed rulesets, adaptive DDoS protection, firewall and rate limiting rules, securing origin servers, leveraging managed IP lists and bot scores, enabling caching, and utilizing DDoS alerting.

2/7/2023

This post details an incident where a Cloudflare engineer erroneously applied a bandwidth throttle to a customer's website traffic due to a misinterpretation of a network congestion alert. The incident highlights a lack of established process for throttling customers and a need for clearer communication and approval workflows for actions that impact customer domains. The post outlines immediate steps to establish multi-level approval for such actions and improve tooling, as well as a commitment to revising terms of service for better clarity.

2/2/2023

This post details the discovery and remediation of a vulnerability where specific DNS records using IPv4-mapped IPv6 addresses could bypass network policies and connect to loopback or internal IP addresses. The vulnerability arose from two bugs: one in the internal DNS system's serialization of IPv4-mapped IPv6 addresses, and another in the internal HTTP proxy's validation logic which incorrectly compared addresses against the wrong deny list based on the IP family of the DNS API response. A hotpatch was deployed to block exploitation by preventing the creation of such DNS records, followed by a permanent fix in the proxy service to correctly validate IP addresses against the appropriate deny list.

2/2/2023

This post details Cloudflare's response to a surge in targeted DDoS attacks against healthcare organizations, attributed to the pro-Russian hacktivist group Killnet. It highlights the automatic detection and mitigation of HTTP DDoS attacks by Cloudflare systems, the variability in attack methods suggesting multiple threat actors or a sophisticated coordinated attack, and provides specific mitigation recommendations for healthcare customers. These recommendations include optimizing DDoS Managed Rules, enabling Adaptive DDoS Protection for Enterprise customers, deploying firewall and rate-limiting rules, securing origin exposure, leveraging Managed IP Lists, enabling caching, and enabling DDoS alerting.

1/25/2023

This post details a critical incident on January 24, 2023, caused by a bug in the release of a new 'Last seen at' field for service tokens. The bug inadvertently overwrote the 'client_secret' metadata for service tokens, rendering them invalid and causing outages for several Cloudflare services, including Workers, Zero Trust, Cache Purge, Cache Reserve, Images, and R2. The post explains the technical details of the bug, the incident timeline, the fix implemented (manual restoration and database backup), and the root cause analysis, highlighting the importance of robust metadata handling and transactional integrity in authentication systems.

1/19/2023

Introduces Waiting Room Bypass Rules, allowing customers to define specific traffic conditions (IP address, URI path, query string, country) that should bypass the Waiting Room queue. This feature is built on the Cloudflare Ruleset Engine, providing a unified and flexible way to manage traffic exclusion for Waiting Room.

1/13/2023

This post significantly extends the Website Security & Threat Management feature thread by detailing how Cloudflare's WAF and security controls are now being applied to private networks. It introduces the ability to enforce WAF policies on internal traffic, secure private APIs, and leverage Cloudflare One's dataplane for in-path security for private applications. It also touches upon extending load balancing and performance optimization to private networks.

1/12/2023

This post announces the release of two new SaaS integrations for Cloudflare CASB: Salesforce and Box. These integrations allow security administrators to scan these platforms for security risks, including insecure settings, inappropriate file sharing, and default permissions. The post highlights the types of sensitive data stored in Salesforce and Box and the potential security threats they pose. It also mentions Cloudflare's existing CASB integrations and encourages users to request new integrations.

1/12/2023

Introduced Zone Versioning for enterprise customers, enabling versioning of zone configurations and deployment to distinct environments (Development, Staging, Production) using the Ruleset Engine. This allows for safe testing, staged rollouts, and rapid rollbacks of configuration changes, addressing customer pain points around testing and reverting impactful changes.

1/11/2023

Introduces Email Link Isolation, a new feature within Cloudflare Area 1 that rewrites potentially malicious email links and uses Cloudflare Browser Isolation as a fallback for suspicious links. This feature aims to provide an additional layer of defense against phishing attacks without impacting user productivity or adding administrative burden.

1/11/2023

This post details the upcoming integration of Cloudflare CASB and DLP, allowing for the scanning of sensitive data within files stored in SaaS applications. This extends DLP capabilities beyond data-in-transit to data-at-rest within supported SaaS platforms, enabling granular risk assessment and remediation for data exposures.

1/10/2023

Introduced custom DLP profiles, enabling users to define their own detection patterns using regular expressions within Cloudflare Gateway. This extends DLP capabilities beyond predefined identifiers to detect unique sensitive data like intellectual property and trade secrets. The implementation leverages the Rust regex crate for pattern matching and integrates with HTTP policies for enforcement. The post also outlines the roadmap for future DLP enhancements, including data at rest scanning, minimum match counts, and OCR.

1/10/2023

This post details how Cloudflare's security offerings, particularly through Cloudflare One, now provide comprehensive protection for all traffic flows, regardless of traditional network definitions like north/south and east/west. It highlights the evolution from perimeter security to a cloud-first SASE model, emphasizing Zero Trust Network Access and Secure Web Gateway for internal traffic, and application security and network services for external traffic, effectively unifying security controls across the entire network.

1/10/2023

This post details Cloudflare's DDoS threat landscape observations for Q4 2022, including an increase in HTTP DDoS attack traffic YoY, surges in volumetric attacks, and a steady increase in Ransom DDoS attacks. It also introduces updated methodologies for calculating attack traffic percentages, providing more granular insights into targeted industries and countries. The post highlights specific attack trends and provides data on the most targeted sectors and regions globally.

1/9/2023

This post details performance comparisons between Cloudflare's Zero Trust products (Gateway, Access, Browser Isolation) and Zscaler's equivalents (ZIA, ZPA, Cloud Browser Isolation). It quantifies the performance differences using metrics like 95th percentile Time to First Byte and Response Time, and delves into the reasons for Cloudflare's superior performance, focusing on network architecture, peering, and significantly lower proxy latency compared to Zscaler.

1/4/2023

Introduced WAF Content Scanning, a new feature integrated with the Web Application Firewall (WAF) that scans file uploads for malware. The engine detects 'content objects' using heuristics, avoiding scanning of common text types (HTML, JSON, XML). It supports multipart/form-data, multipart/mixed, and base64-encoded JSON payloads, parsing and scanning individual components. Scans run inline with HTTP traffic, locally on each server, with a current limit of 1MB per file. The feature exposes scan results as WAF fields (e.g., `cf.waf.content_scan.has_malicious_obj`) enabling custom rules for blocking, logging, or enforcing content types. It also facilitates discovery of upload endpoints through Security Analytics.

12/16/2022

This post details the unintended consequences of IP address blocking as a method for content moderation, highlighting its technical limitations, opacity to users, and legal/human rights concerns. It explains how shared IP addresses lead to collateral damage, affecting thousands of legitimate websites. The post contrasts IP blocking with more precise methods like DNS manipulation or source-level content removal, and discusses the legal obligations for necessity and proportionality in blocking orders. It advocates for blocking to be a last resort and emphasizes the need for transparency regarding blocked content and the reasons behind it.

12/14/2022

Introduced a new ruleset engine for Bot Fight Mode, built on the same engine as the new WAF, Transform Rules, and Cache Rules. This provides more flexibility for writing complex rules to catch elusive bots without impacting legitimate traffic. The data from these new detections are used to train the Machine Learning engine. The post also notes a significant reduction in the time bots spend on challenge pages (166% reduction) and a six-fold increase in CPU intensive challenges issued daily.

12/12/2022

This post announces the extension of Cloudflare's Zero Trust products to all domains under Project Galileo, aiming to democratize access to enterprise-level cybersecurity for underfunded organizations. It highlights how Project Galileo participants are using Zero Trust tools to secure their operations, with specific examples from the CyberPeace Institute, Information Technology Disaster Resource Center, Meedan, and the Organization of American States.

12/12/2022

This post details Cloudflare's response to cyberattacks on Ukrainian infrastructure during the conflict. It highlights the increase in DDoS and application layer firewall mitigated attacks on Ukrainian websites, and Cloudflare's provision of free services and support to Ukrainian government and infrastructure providers, as well as non-profits through Project Galileo. It also discusses the physical security of infrastructure in the region, the use of Keyless SSL, and the increased demand for zero trust solutions. The post also touches on internet disruptions and routing manipulation as tools in armed conflict, including tracking internet outages and rerouting of traffic through Russia.

12/9/2022

Introduced "Security Analytics" which provides a security lens across all HTTP traffic, not just mitigated requests. This new feature enables a "detect then mitigate" approach by analyzing attack analysis, bot analysis, and other security signals. It offers a new page layout with top statistics, time series charts for spotting anomalies (distinguishing between mitigated and unmitigated requests), analysis signals (bot score, WAF Attack Score, content scanning), sampled logs for detailed verification, and handy insights for quick exploration. This feature is being rolled out to Enterprise customers with Application Security Core or Advanced Bundles.

12/9/2022

Introduced a WAF attack scoring system using machine learning to classify requests by their probability of being malicious. This system complements existing signature-based rules by detecting evasion, bypass, and new attack techniques before they are publicly known. The model is trained on millions of true positive samples and is optimized for SQL Injection, XSS, and RCE attacks. Also launched new Security Analytics to visualize attack score distributions and facilitate the creation of WAF Custom Rules.

11/16/2022

Introduces the upcoming capability for Cloudflare Workers to use mutual TLS (mTLS) for outbound requests. This allows Workers to present client certificates, enabling server-side authentication and identification of the originating Worker. This addresses limitations of existing methods like Authenticated Origin Pull and token authentication by providing per-Worker granularity, secure HTTP communication, and client identity exposure.

11/11/2022

This post provides a detailed analysis of WAF-mitigated attack traffic targeting election-related websites during the 2022 US midterm elections. It breaks down attack types (SQLi, HTTP Anomaly, Software Specific, File Inclusion, XSS, Directory Traversal, Command Injection) and their prevalence for both the Athenian Project and Cloudflare for Campaigns. It also analyzes the geographical origin of attacks, noting that over 95% of attacks targeting Athenian Project participants originated from the US, while 55% of attacks targeting Cloudflare for Campaigns participants originated from the US, with other countries like Germany, Canada, and the UK also contributing.

11/2/2022

This post details how Cloudflare's adoption of BoringSSL, rather than OpenSSL, renders it unaffected by critical OpenSSL vulnerabilities CVE-2022-3602 and CVE-2022-3786. It explains the nature of these vulnerabilities, their potential impact on clients and servers, and provides guidance on patching vulnerable OpenSSL instances. The key takeaway is Cloudflare's proactive security stance through its choice of cryptographic library.

10/27/2022

Introduced Privacy Gateway, a privacy-preserving proxy built on Internet standards (Oblivious HTTP - OHTTP) and hybrid public-key cryptography. Privacy Gateway encrypts HTTP requests and responses between a client and an application server, ensuring that neither Cloudflare nor the application server has the full picture of the communication, thereby enhancing end-user privacy. It enables use cases like private telemetry collection, secure healthcare reporting, and privacy-preserving DNS resolution. The post details the architecture (Client, Privacy Gateway, Application Server), data flow, and the concepts of request privacy and client privacy, along with server integration requirements.

10/27/2022

This post introduces Oblivious HTTP (OHTTP) and its implementation as Privacy Gateway, a new privacy-enhancing protocol. It details how OHTTP decouples sender identity from request content through an encrypted relay mechanism, enhancing user privacy for applications. The post also describes the formal, computer-aided security analysis conducted to prove the privacy properties of OHTTP, using tools like Tamarin for modeling and verification.

10/21/2022

Introduced Page Shield's Connection Monitor, which leverages Content Security Policies (CSPs) to detect malicious outbound connections made by third-party JavaScript code. This feature complements Script Monitor by analyzing where data is sent, enhancing detection of data exfiltration and Magecart-style attacks. It stores connection information, including domain and threat intelligence lookups, while prioritizing privacy by default by only storing scheme and host.

10/18/2022

This post contributes to the understanding of website security and threat management by detailing observed internet disruptions in Q3 2022, specifically focusing on government-directed shutdowns in Iraq, Cuba, Afghanistan, Sierra Leone, Somaliland, India, and Iran. It highlights how these disruptions, often aimed at controlling communication during protests or exams, impact internet availability and underscore the importance of robust security and resilience measures.

10/12/2022

This post details the trends and insights from Cloudflare's Q3 2022 DDoS Threat Report. It highlights the increasing frequency and scale of multi-terabit DDoS attacks, including a 2.5 Tbps attack targeting a Minecraft server. The report breaks down trends in both application-layer (HTTP) and network-layer (L3/4) DDoS attacks, noting increases in attack volume, duration, and specific botnet activity (e.g., Mirai). It also provides industry and country-specific attack data, as well as insights into ransom DDoS attacks and the sources of attack traffic.

10/6/2022

Introduced Total TLS, a one-click feature that automatically issues individual TLS certificates for every subdomain of a customer's domain when Cloudflare is the authoritative DNS provider. This simplifies TLS management by eliminating the need for customers to manually specify hostnames for certificates, especially for those with thousands of subdomains. The feature leverages the existing Advanced Certificate Manager and provides warnings for proxied DNS records without TLS coverage.

10/3/2022

This post details the technical challenges and solutions for automatically upgrading origin SSL/TLS configurations to the highest available security level. It explains the evolution of origin security options (Off, Flexible, Full, Full (strict), Strict), the methodology used by the SSL/TLS Recommender tool (crawling, content similarity, certificate validation), and the shift from per-zone to per-origin SSL/TLS settings to maximize security posture for complex setups.

9/30/2022

This post details the integration of Cloudflare CASB findings with Cloudflare Gateway to automatically create HTTP policies. It provides three examples: blocking uploads to personal Google Drive, restricting upload/download activity for repeat oversharers, and preventing file uploads to unapproved Shadow IT applications. This enables fine-grained policy generation to prevent specific inappropriate behavior based on CASB-identified security issues.

9/29/2022

This post details the integration of hardware security keys (YubiKeys) with Cloudflare Zero Trust to provide phish-proof authentication. It explains the limitations of traditional MFA and how hardware keys, using the WebAuthn standard, offer superior security. The post also highlights Cloudflare's ability to enforce the use of hardware keys through the Authentication Method Reference (AMR) standard within its Zero Trust platform, and announces an exclusive offer for Cloudflare customers to purchase YubiKeys at a discounted price.

9/29/2022

Introduced unmetered Rate Limiting for Free, Pro, and Business customers, removing usage-based charges. Launched an updated Rate Limiting engine based on the ruleset engine, offering advanced rule-building capabilities previously available in Advanced Rate Limiting. This includes the ability to combine multiple request parameters (path, host, URI, query, method, user agent, source IP), separate counting and mitigation expressions, and expanded counting dimensions (IP with NAT awareness, Query, Host, Headers, Cookie, ASN, Country, Path, JA3, JSON field).

9/29/2022

Introduces Email Link Isolation, a new feature that rewrites suspicious links in emails to route users through an interstitial page and then to a remote isolated browser. This leverages Cloudflare's DNS resolver, classifiers from Cloudflare Gateway, and Cloudflare Browser Isolation to protect users from malicious payloads and zero-day exploits. The system continuously reevaluates domain reputations.

9/29/2022

This post details Cloudflare's internal migration from VPN-based authentication with TOTP to a Zero Trust architecture enforced by Cloudflare Access and FIDO2/WebAuthn security keys. It describes the selective enforcement strategy using OAuth2 AMR values and Terraform, the eventual full enforcement of FIDO2, and the extension of this security model to SSH connections via Cloudflare Tunnel and cloudflared.

9/28/2022

Introduced Turnstile, a new product offering a privacy-preserving, user-friendly alternative to CAPTCHA. Turnstile utilizes a rotating suite of non-intrusive browser challenges and machine learning models to validate users, minimizing data collection and integrating with Apple's Private Access Tokens. The product is available as a standalone service, allowing integration via a simple API without requiring traffic to pass through Cloudflare's global network. It offers implicit and explicit rendering options, custom 'Actions' for distinguishing use cases, and provides analytics on widget deployment and user behavior.

9/28/2022

Introduces a free Botnet Threat Feed for service providers, providing them with threat intelligence on their own IP addresses observed participating in HTTP DDoS attacks from the Cloudflare network. This enables service providers to identify and crack down on abusers, take down botnet nodes, and reduce abuse-driven costs.

9/27/2022

This post details Cloudflare's recognition as a Leader in the Forrester Wave™: Web Application Firewalls report. It highlights the WAF's strengths in strategy, innovation, management UI, rule creation, and incident investigation, specifically mentioning the rapid response to the Log4Shell vulnerability by deploying managed rules within 17 hours to protect customers. The post also emphasizes the WAF's role in protecting web applications from attacks and its integration with other security services.

9/27/2022

This post introduces Configuration Rules as a successor to Page Rules, significantly enhancing granular control over Cloudflare features. It expands the ability to apply settings based on a wider array of HTTP request attributes (beyond just URLs, including cookies and country of origin), enabling advanced use cases like A/B testing of features and more precise security policy application. This represents a substantial evolution in fine-grained traffic management and feature customization within the website security and threat management domain.

9/27/2022

Introduced Origin Rules, a new product that allows for overriding the host header, Server Name Indication (SNI), destination port, and DNS resolution of matching HTTP requests. This feature builds upon the existing ruleset engine and provides a no-code solution for complex origin routing scenarios, replacing the need for custom Workers or reverse proxies for tasks like SaaS platform integration and A/B testing cloud providers.

9/26/2022

Introduces a new platform for securing Internet of Things (IoT) devices. This platform will offer device management, cellular connectivity provisioning, and security policies to inspect and control traffic from IoT devices. It leverages Zero Trust principles, allowing granular control over device communication endpoints and uses SIM cards as a root-of-trust. Compute and storage for IoT devices can be offloaded to Cloudflare Workers, Analytics Engine, D1, and Pub/Sub, keeping processing close to the device.

9/22/2022

This post introduces Cloudflare Zaraz, a new product that enhances website security and user privacy by addressing the risks associated with third-party scripts. It introduces 'Managed Components' as a secure alternative to traditional third-party scripts, allowing for granular control over permissions and data exposure. Additionally, it announces upcoming Data Loss Prevention (DLP) features for Zaraz, which will enable reporting, masking, and removal of PII from data shared with third-party tools, further strengthening the privacy posture of websites.

9/22/2022

This post announces the General Availability (GA) of API Endpoint Management and Metrics within Cloudflare's API Shield. It introduces the ability for customers to save, update, and monitor the performance of their API endpoints, providing key metrics like latency, error rate, and response size. It also details enhancements to API Discovery to accept cookies and the addition of schema validation for request bodies. This significantly expands the capabilities of API Shield beyond just security to include comprehensive management and performance monitoring of APIs.

9/22/2022

This post details how Cloudflare's network monitoring capabilities, a facet of its broader threat management and visibility, were utilized to track and report on government-imposed internet disruptions in Iran. It specifically highlights the impact of these disruptions on internet traffic and DNS resolution, including the blocking of social media platforms and DNS-over-HTTPS/TLS, showcasing Cloudflare's role in observing and documenting censorship events.

9/20/2022

This post introduces the integration of Cloudflare Browser Isolation with Magic WAN. It details how customers with networks protected by Magic WAN can now enable Browser Isolation through HTTP policies. The technical steps involve connecting on-premise networks to Cloudflare via IPsec or GRE tunnels, creating an isolation policy in the Zero Trust dashboard, and enabling non-identity on-ramp support. This allows for the transparent interception and remote execution of traffic matching isolation criteria, providing enhanced security against browser-borne threats without endpoint software.

9/20/2022

This post announces the General Availability of Cloudflare's Data Loss Prevention (DLP) product. It details how DLP works by inspecting HTTP traffic for sensitive data using regex matches and algorithmic validation (e.g., Luhn's algorithm for credit card numbers). It explains how to configure DLP profiles and apply them to Gateway HTTP policies to block or allow traffic based on detected sensitive data, such as PII, intellectual property, or financial information. The post also highlights DLP's integration with other Cloudflare Zero Trust services for comprehensive data protection.

9/19/2022

Introduces Cloudforce One, a new subscription service providing access to Cloudflare's threat operations and research team. This includes threat data (IP, ASN, domain intelligence, threat actor cards, IoCs), security tools (Threat Investigation Portal for IPs, ASNs, URLs, domains; Brand Protection for keyword/asset monitoring; Sinkholes for malware containment), and the ability to make Requests for Information (RFIs) to the team for technical analysis. The service aims to empower security teams with actionable intelligence and tools for threat hunting and remediation.

9/19/2022

Introduced Advanced DDoS Alerts, offering customizable notifications for HTTP and L3/4 DDoS attacks. Users can now define specific Internet properties (zones, hostnames, IP prefixes), minimum attack thresholds (RPS, PPS, Mbps), and protocols to monitor, addressing noise from standard alerts and allowing for more targeted verification of mitigation effectiveness.

9/19/2022

Introduced Adaptive DDoS Protection, a new traffic profiling system that learns unique traffic patterns by analyzing maximal traffic rates over the past seven days using various dimensions (source country, user agent, IP protocol, destination ports). It uses the 95th percentile to discard outliers and integrates with ML-generated Bot Scores to distinguish legitimate traffic spikes from automated attacks. This system is available for Enterprise customers on specific plans and complements existing DDoS defenses.

9/19/2022

Introduced Account WAF, a feature allowing Enterprise customers to manage a single WAF configuration (including Managed, Firewall, and Rate Limiting rules) across multiple domains. This simplifies deployment by enabling rulesets to be applied based on filters defined using Wirefilter syntax, rather than configuring each domain individually. Custom Rulesets are introduced for user-defined rules, and Rate Limiting rulesets are also supported. The feature is exclusive to Enterprise plans on the Advanced plan or higher.

9/14/2022

This post introduces Pingora, a new in-house HTTP proxy built with Rust, designed to replace NGINX and handle Cloudflare's massive scale of over a trillion requests per day. It addresses architectural limitations of NGINX, such as its worker process model and per-worker connection pools, which previously hindered performance and connection reuse. Pingora's multithreading and work-stealing approach, combined with a custom HTTP library and an event-based programmable interface, significantly improves performance (reducing TTFB and handshake time) and enables faster development of new features, including HTTP/2 upstream support and gRPC, which directly benefit Cloudflare's security and performance products.

9/6/2022

This post announces Cloudflare's recognition as a Leader in Gartner's Magic Quadrant for Web Application and API Protection (WAAP). It details the components of Cloudflare's WAAP portfolio: DDoS protection, Web Application Firewall (WAF), Bot Management, API Gateway (with schema protection and abuse detection), and Page Shield. It also highlights the Security Center as a unified interface for these tools and mentions continuous innovation with specific product releases like API Shield Schema Protection, API Abuse Detection, a new WAF, customizable DDoS Managed Rules, and the Security Center.

9/5/2022

This post details the application of machine learning to Cloudflare's WAF, focusing on overcoming data challenges. It introduces data augmentation and generation techniques to improve model accuracy and reduce false positives. Specific methods discussed include generating heterogeneous negative samples, creating pseudo-random noise samples with increasing complexity, and mutating benign content. The post explains how these techniques help the ML model learn structural, semantic, and statistical properties of content, making it less sensitive to individual malicious tokens and more robust against obfuscation.

8/30/2022

Introduced a static threshold alongside the existing z-score methodology for Security Event Alerts. This dual-pronged approach aims to reduce false positives by ensuring alerts are triggered only when a spike in security events is both statistically anomalous (z-score > 3.5) and exceeds a minimum raw event count (initially set at 200). This addresses the issue of z-scores becoming infinite for domains with low or zero baseline security events, and also prevents alerts on statistically significant but low-volume spikes.

8/9/2022

This post details a sophisticated phishing attack targeting Cloudflare employees, including the mechanics of the attack (SMS phishing, fake Okta login page, real-time TOTP relay) and Cloudflare's response. It highlights the effectiveness of FIDO2 security keys in preventing compromise despite credential leakage, and the use of Cloudflare Gateway to block malicious domains. The post also outlines steps taken to identify and take down attacker infrastructure, update detections, and audit logs. Lessons learned include enhancing access controls for newly registered domains, implementing browser isolation for suspicious sites, and leveraging Area 1's phish-identification technology.

7/18/2022

This post details a debugging journey and fix for a crash in flowtrackd, a DoS defense mechanism, that occurred when using AF_XDP with network namespaces. It highlights an issue where AF_XDP was not network namespace aware, leading to crashes when interface index numbers were the same across different namespaces. The post also touches upon the performance improvements gained by using AF_XDP shared UMEM for a single flowtrackd instance to handle multiple customer accounts, and the network setup involving veth pairs and network namespaces for packet forwarding.

7/14/2022

This post details the analysis and mitigation of the 'Mantis' botnet, responsible for the largest HTTPS DDoS attacks observed. It highlights Mantis's evolution from the Meris botnet, its use of hijacked VMs and powerful servers, and its ability to launch 26 million requests per second attacks with an average of 5,200 HTTPS RPS per bot. The post also provides insights into the industries and geographic locations targeted by Mantis and reiterates Cloudflare's automated DDoS protection and WAF/CDN capabilities for mitigation.

7/12/2022

This post introduces Waiting Room Event Scheduling, a significant enhancement to the existing Waiting Room feature. It allows enterprise customers to proactively schedule changes to their waiting room's settings and custom queueing pages for online events. New queuing methods, Reject and Passthrough, are introduced for more granular traffic control. The post also details the concept of pre-queuing to manage traffic before an event starts and provides a walkthrough of the event creation workflow, emphasizing ease of use and customization.

7/11/2022

Introduces Location-Aware DDoS Protection, a new feature that leverages traffic origin (client country and region) and machine learning models to identify and mitigate DDoS attacks. It allows Enterprise customers subscribed to Advanced DDoS to customize sensitivity levels and enable the feature as an HTTP DDoS Managed rule, setting actions to Managed Challenge or Block.

7/7/2022

Introduced four new managed IP lists (VPNs, Botnets, Command and Control Servers, Malware, Anonymizers) for the Web Application Firewall (WAF). These lists are dynamically updated based on Cloudflare's threat intelligence feeds, combining open-source data and network behavior analysis. The post also details how these lists can be integrated into custom firewall rules and Advanced Rate Limiting, and how IP category information is now exposed directly in the Cloudflare dashboard for enhanced incident investigation.

7/6/2022

This post details DDoS attack trends observed in Q2 2022, including the largest attacks seen, ongoing attacks against Ukraine and Russia, and the emergence of Ransom DDoS attacks. It provides insights into application-layer and network-layer DDoS attack volumes, targeted industries (Aviation & Aerospace, BFSI, Gaming/Gambling, Telecommunications, IT), and geographical distribution of attacks (US, Cyprus, Hong Kong, China, Singapore, Germany). It also discusses the methodology for measuring DDoS activity and the role of automated mitigation systems and customer surveys.

7/5/2022

Introduced script status categorization (active, infrequent, inactive, cdn-cgi) to filter and prioritize scripts. Enhanced alert metadata for security analysts by integrating Cloudflare Radar insights, breaking down ML classifier scores (obfuscation, data exfiltration), displaying threat feed categorization, and including script change history. Added WHOIS information and SSL certificate transparency data to alerts for further validation. Improved dashboard linking to specific script details pages. Future work includes developing new detection mechanisms for data endpoints, CSP policy generation, and blocking scripts from accessing sensitive user hardware.

6/30/2022

Introduced Managed Transforms, a new feature within Transform Rules that offers one-click HTTP header modifications for common use cases. This simplifies adding bot management information (bot score, JA3 hash) and security headers (HSTS, CSP, Permission-Policy) to HTTP requests and responses, reducing manual configuration and improving security posture.

6/29/2022

This post analyzes traffic data to identify trends in Internet Explorer 11 usage decline, the prevalence of bot traffic masquerading as older browser versions (specifically IE 11, 7, 6, and 9), and the effectiveness of Cloudflare's WAF in mitigating this automated traffic. It provides insights into bot detection accuracy and the challenges of distinguishing human from automated traffic, particularly in regions like Brazil.

6/29/2022

This post introduces the use of eBPF (extended Berkeley Packet Filters) as a Linux Security Module (LSM) to implement granular security policies directly within the Linux kernel. Specifically, it demonstrates how LSM BPF can be used to prevent privilege escalation by blocking unprivileged users from creating new user namespaces via the `unshare` syscall, a vulnerability that has been difficult to address in the mainline kernel. This represents an advancement in Cloudflare's ability to dynamically enforce security policies and patch vulnerabilities without requiring kernel modifications or custom kernel modules, thereby enhancing its threat management capabilities.

6/24/2022

This post announces the upcoming support for HTTP/3 inspection within Cloudflare Gateway. It details the technical challenges of inspecting HTTP/3 traffic due to its reliance on QUIC over UDP, contrasting it with legacy TCP-based protocols. The post outlines how Cloudflare Gateway will enable full visibility and security policy application (AV-scanning, DLP, filtering) to HTTP/3 traffic by proxying UDP traffic and enabling TLS decryption.

6/22/2022

This post introduces support for Private Access Tokens within Cloudflare Access. This allows security teams to verify the health and integrity of a user's device, specifically Apple devices in this initial rollout, without requiring any software installation on the client. It leverages the Privacy Pass Protocol and involves an Origin (Cloudflare), Client (user's device), Attester (Apple), and Issuer (Cloudflare) to issue anonymous, unforgeable tokens that attest to device health attributes like OS version and jailbreak status.

6/21/2022

This post announces the private beta of Cloudflare's Intrusion Detection System (IDS) capabilities, delivered as-a-service. It addresses traditional IDS pain points like hardware constraints, capacity planning, performance trade-offs, and alert fatigue by leveraging Cloudflare's global Anycast network and software-defined approach. The IDS monitors all network traffic (any IP port or protocol) for known threat signatures and incorporates threat intelligence from Cloudflare's network and open-source feeds like Suricata.

6/20/2022

Introduces the integration of Cloudflare Area 1 email security with Cloudflare One platform, enabling Remote Browser Isolation (RBI) for email links. This feature rewrites suspicious URLs to a custom prefix, and upon click, redirects users to a remote browser instance on the Cloudflare Global Network. This isolates potentially malicious content, preventing device infection and credential compromise. The implementation leverages Network Vector Rendering (NVR) technology for efficient and secure draw command transmission. The post details how this addresses deferred phishing attacks by isolating suspicious links at the time of click, offering various mitigation options like splash warning pages, read-only mode, and restricted file operations.

6/20/2022

This post introduces the capability for customers to integrate third-party threat intelligence feeds into Cloudflare One products. Customers can upload API keys for partners like Mandiant, Recorded Future, and VirusTotal to use their threat data (IP addresses, FQDNs) within Cloudflare's rule builder for Gateway, Magic Firewall, WAF, and API Gateway. Additionally, VirusTotal data enriches Security Center search results for IPs, domains, and URLs.

6/20/2022

Introduced Data Loss Prevention (DLP) as a native feature within the Cloudflare One platform. This involves the creation of DLP Profiles for defining sensitive data (keywords, regexes) and Gateway HTTP policies to scan and control the transmission of this data. This enhances Zero Trust by adding a layer of protection based on the content of the data itself, complementing existing identity, device posture, content category, and application configuration checks.

6/20/2022

This post details the integration of Area 1's threat indicator data into Cloudflare's Zero Trust products, specifically enhancing phishing detection. It describes how Area 1's data pipeline, focused on identifying new and active phishing threats, supplements the existing Phishing category in Gateway. The post outlines the combined approach of Cloudflare and Area 1 in identifying phishing threats through web crawling, threat modeling, machine learning, and analysis of mail exchange server data. It emphasizes the benefit of this combined dataset for proactive threat filtering and improving phishing detection across various entry points.

6/14/2022

This post details the automatic detection and mitigation of a 26 million requests per second HTTPS DDoS attack, the largest on record. It analyzes the attack's origin from a botnet of hijacked virtual machines and powerful servers, contrasting its efficiency with larger, less powerful botnets. The post also discusses the increased computational cost of HTTPS DDoS attacks and provides statistics on the attack's origin countries and networks. It highlights the importance of automated, always-on DDoS protection services.

6/14/2022

This post details how countries like Syria, Sudan, and Algeria are implementing internet shutdowns or targeted website blocking during exam periods to prevent cheating. It showcases Cloudflare Radar data illustrating these disruptions and analyzes the asymmetric nature of Syria's shutdowns. The post also highlights Algeria's shift from full shutdowns to content blocking, using Network Error Logging (NEL) data to demonstrate the impact. This contributes to the understanding of how network-level controls, even if state-sponsored and for non-malicious reasons, can impact internet availability and require monitoring.

6/8/2022

Introduced Private Access Tokens (PATs) as a new method for validating human users without CAPTCHAs. PATs leverage an open standard (extension of Privacy Pass protocol) and involve collaboration between device vendors (Attesters) and token issuers (like Cloudflare) to generate anonymous, unforgeable tokens. This significantly improves privacy by validating device authenticity without collecting or storing sensitive user data, and enhances the user experience by removing CAPTCHAs, especially on mobile and API contexts.

6/8/2022

This post provides a detailed analysis of cyberattack trends against organizations protected under Project Galileo, with a specific focus on attacks targeting Ukraine. It quantifies the increase in DDoS and WAF-mitigated traffic, categorizes attack methods by region and organization type, and highlights the prevalence of SQL injection and HTTP anomalies. It also details the application growth for Project Galileo during the conflict and the types of organizations that saw increased traffic.

6/5/2022

This post details Cloudflare's rapid response to the Confluence zero-day vulnerability (CVE-2022-26134). It covers the immediate engagement of WAF teams to deploy mitigation rules, the analysis of exploit attempts observed in the wild (including early detection prior to the official advisory), and the refinement of WAF rules to improve accuracy and reduce false positives. The post also outlines Cloudflare's internal security measures, including the use of Cloudflare Access to protect internal Confluence instances, and provides guidance for on-premise Confluence users on patching, enabling Cloudflare Access, and checking logs for indicators of compromise.

6/3/2022

This post details the emergency response to CVE-2022-26134, a critical RCE vulnerability in Atlassian Confluence. Cloudflare engineers analyzed the vulnerability, prepared a WAF mitigation rule, and deployed it within hours of Atlassian's advisory. The rule (IDs 100531 and 408cff2b) was deployed at 23:38 UTC on June 2, 2022, with a default BLOCK action, protecting all WAF customers, including free tier users, running self-hosted Confluence. Additionally, Cloudflare Access provided protection by verifying authenticated users before requests reached the Confluence server.

5/12/2022

Introduced HTTP Applications and Routing Rules, a new system for managing L7 Cloudflare configuration. HTTP Applications allow grouping configuration settings (Page Rules, Firewall Rules, cache settings) into versions, independent of hostnames. Routing Rules, powered by the Ruleset Engine, map hostnames to specific HTTP Application versions. This enables staging of configuration changes by directing traffic to specific IPs for testing before full production rollout, and provides a mechanism for quick rollbacks.

5/6/2022

This post details six security vulnerabilities discovered in Cloudflare Pages' CI/CD build pipeline and publishing process by security researchers. It describes command injection flaws in `CLONE_REPO` and `PUBLISH_ASSETS`, API key disclosure due to incorrect file permissions, bash path injection, an Azure pipelines escape via the docker socket, and a Kubernetes API access issue due to a missing iptables rule. The post outlines the remediation steps taken, including input validation fixes, secret rotation, permission adjustments, architectural changes (adopting gVisor, migrating to Kubernetes), and customer notifications. It highlights the importance of the bug bounty program in identifying and fixing these issues.

4/27/2022

This post details the technical specifics of a 15.3 million rps HTTPS DDoS attack mitigation. It describes the attack's origin from data centers and a botnet of ~6,000 bots across 112 countries, with traffic originating from specific ASNs like Hetzner and OVH. It explains Cloudflare's autonomous DDoS protection system, including asynchronous traffic sampling, out-of-path analysis, data streaming algorithms for request analysis, conditional fingerprint matching, real-time signature creation with dynamic masking, and the compilation of mitigation rules when activation thresholds are met. It also references a deep-dive technical blog post on autonomous edge DDoS protection.

4/13/2022

This post announces a partnership with Kentik to integrate their network observability with Cloudflare's Magic Transit for on-demand DDoS protection. It details three procurement modes for Magic Transit: Always On, On Demand, and On Demand + Flow-based Monitoring. The integration leverages Kentik's flow-based monitoring to trigger Magic Transit's DDoS mitigation when attacks are detected, simplifying procurement and provisioning for customers.

4/12/2022

This post provides a detailed analysis of DDoS attack trends observed in Q1 2022, highlighting a massive spike in application-layer DDoS attacks and a decrease in network-layer attacks. It introduces new data points on volumetric attacks, zero-day reflection attacks, and geographical attack patterns in Russia and Ukraine. The post also details trends in ransom DDoS attacks and shifts in the primary sources and targets of application-layer attacks, particularly noting the US's emergence as a leading source. This contributes to the ongoing narrative of Cloudflare's threat intelligence and mitigation capabilities by providing specific, time-bound data on the evolving DDoS landscape.

4/1/2022

Introduced the 'Managed Challenge' platform as a replacement for traditional CAPTCHAs. This platform uses a series of non-interactive JavaScript challenges, machine learning models, and other signals to assess visitor behavior. It defers visual puzzles to a later stage, only serving them when signals are weak. The platform has reduced CAPTCHA usage by 91% and aims to reduce it to less than 1% by year-end, significantly improving user experience by reducing challenge time from 32 seconds to 1 second.

3/31/2022

This post details the deployment of new managed WAF rules to mitigate the Spring4Shell vulnerabilities (CVE-2022-22947, CVE-2022-22950, CVE-2022-22963, CVE-2022-22965). It specifies the WAF rule IDs and legacy IDs for rules targeting CVE-2022-22947 ('Spring - CVE:CVE-2022-22947'), CVE-2022-22950 and CVE-2022-22963 ('PHP - Code Injection' and 'Plone - Dangerous File Extension'), and CVE-2022-22963 and CVE-2022-22965 ('Spring - Code Injection'). It also mentions the use of OWASP Core Ruleset for protection.

3/31/2022

This post details Cloudflare's work in making SaltStack, an internal infrastructure management tool, quantum-secure. It chronicles the discovery and patching of several security vulnerabilities (CVE-2022-22934, CVE-2022-22935, CVE-2022-22936) in SaltStack's custom cryptographic protocol. Furthermore, it proposes and demonstrates the feasibility of migrating SaltStack's communication to a mutually authenticated TLS (mTLS) based transport as a path towards post-quantum security and improved overall security posture.

3/31/2022

This post details Area 1 Security's findings on the most impersonated brands in phishing campaigns for 2021, with the World Health Organization (WHO) being the top offender. It highlights common phishing tactics such as display name spoofing, domain impersonation, and the use of compromised legitimate hosts. The post also discusses the limitations of traditional email authentication methods (SPF, DKIM, DMARC) against sophisticated brand phishing and emphasizes the effectiveness of advanced detection techniques like web crawling and pattern analytics for identifying and mitigating these threats.

3/29/2022

This post details the optimization of Magic Firewall's IP lists by migrating from nftables sets to eBPF maps (BPF_MAP_TYPE_LPM_TRIE). This change significantly reduced memory consumption by allowing IP lists to be shared across network namespaces instead of being duplicated. The post also describes the necessary patch to the nftables project to enable direct integration of eBPF programs, allowing for atomic rule replacements and enhanced packet inspection capabilities.

3/29/2022

This post details how Cloudflare's Zero Trust and Remote Browser Isolation (RBI) services provide proactive protection against zero-day browser vulnerabilities, specifically referencing CVE-2022-1096. It explains the layered defense strategy: traffic steering via a roaming client, inspection and filtering by a secure web gateway, and execution of website code in a remote browser. It highlights RBI's ability to isolate endpoints, destroy and reconstruct browsers, encrypt egress traffic, and log egress traffic for incident response. The post contrasts the manual patching of local browsers with the automatic patching of remote browsers on Cloudflare's network.

3/26/2022

This post contributes to website security by analyzing a large dataset of phishing emails (56 million) to identify the most impersonated brands. It highlights trends in phishing attacks, such as the increased use of cloud services and cryptocurrency-related lures, and discusses the limitations of existing email authentication protocols in combating brand phishing.

3/22/2022

This post details Cloudflare's internal Security Incident Response Team (SIRT) process in response to a compromise of Okta, their identity provider. It outlines the timeline of investigation, actions taken (suspending accounts, forcing password resets), and the technical details of how Cloudflare uses Okta integrated with Cloudflare Access, including the use of hardware tokens and independent log storage for enhanced security. It also provides recommendations for Okta customers.

3/21/2022

This post provides a data-driven overview of application security trends observed on the Cloudflare network between December 2021 and March 2022. It quantifies the volume of mitigated traffic (8% of total HTTP requests), breaking down mitigation sources by feature (Layer 7 DDoS, Custom WAF Rules, Rate Limiting, IP Threat Reputation, Managed WAF Rules). It details the most common attack vectors blocked by Managed WAF Rules, with HTTP anomalies being the most prevalent. The post also analyzes the fields used in custom WAF rules, highlighting the continued prevalence of IP addresses and standard HTTP request fields, while noting the shift towards Zero Trust approaches.

3/18/2022

This post details the technical implementation of enforcing FIDO2 security keys as the only second factor for accessing internal and external applications protected by Cloudflare Access. It includes a Terraform code example demonstrating how to configure Cloudflare Access policies to require the 'swk' authentication method, which corresponds to logins using a security key. The post also presents a graph showing the reduction in soft token usage after this enforcement.

3/18/2022

Introduces SSH command logging as a new capability within Cloudflare Zero Trust, extending the Secure Web Gateway to inspect and log SSH traffic at the network layer. This feature provides full replay of commands run during SSH sessions, including across jump-hosts, without requiring software installation on individual machines. Logs are encrypted with customer-provided public keys, and an opt-in FIPS 140-2 mode is available. User authentication is handled via Cloudflare Short-Lived Certificates.

3/17/2022

This post details the evolution of Cloudflare's machine learning models for bot detection, with a specific focus on improving performance for mobile application traffic. It outlines the process of data gathering, feature selection, model building (using Catboost), offline and online monitoring, and deployment strategies. The key contribution is the identification and incorporation of new datasets representing legitimate mobile app traffic, which were previously under-represented, leading to significant reductions in false positive rates for mobile applications.

3/17/2022

This post announces the general availability of Clientless Web Isolation, a new on-ramp for Browser Isolation. It integrates Zero Trust Network Access (ZTNA) with remote browsing, allowing users to securely access any website, internal app, or SaaS application from any device without installing software or configuring certificates. It simplifies connections via a hyperlink, enables deep linking into isolated browsing for suspicious content, integrates with third-party secure web gateways, and provides secure access on BYOD devices, offering an alternative to VDI for browser-based applications.

3/17/2022

This post introduces on-demand packet captures from Cloudflare's global network, a new capability for customers using Magic Transit and Magic WAN. This feature provides granular visibility into network traffic by allowing users to request and analyze packet capture files. It addresses the challenge of fragmented visibility in modern networks by centralizing packet capture capabilities at the edge. The post details the technical implementation using nftables and tcpdump, and highlights its utility for both network troubleshooting and security analysis, directly contributing to the ability to identify and mitigate threats.

3/17/2022

This post announces a partnership with Aruba to integrate Cloudflare One's security services (Secure Web Gateway, Magic Firewall) with Aruba's EdgeConnect SD-WAN solution. This integration allows organizations to leverage their existing SD-WAN infrastructure to route corporate traffic through Cloudflare's global network for enhanced security and control, without requiring a rip-and-replace approach. It extends Cloudflare's security perimeter to the branch office and enables granular policy management for both internet-bound and inter-branch traffic.

3/17/2022

This post details the integration of Cloudflare's Zero Trust services (Access and Gateway) with CrowdStrike's Falcon Zero Trust Assessment (ZTA). It explains how customers can use CrowdStrike's real-time device posture assessments to build conditional access policies, requiring a minimum ZTA score or version before granting access. The technical implementation involves adding CrowdStrike as a device posture provider in the Cloudflare Zero Trust dashboard, requiring API credentials, and then creating device posture checks and incorporating them into Access and Gateway policies. Future work will involve correlating Cloudflare logs with Falcon telemetry.

3/16/2022

This post introduces the Cloudflare API Gateway, a new major capability that extends Cloudflare's security and management offerings to API-driven applications. It details features such as API Discovery to identify shadow APIs, Schema Validation to enforce API structure, Abuse Detection for rate limiting and scraping prevention, mTLS for device authentication, and enhanced Authentication (API keys, JWT, OAuth 2.0) and Routing capabilities leveraging Cloudflare Workers and Transform Rules. This significantly expands the scope of website security and threat management to include the critical area of API security.

3/16/2022

This post details how Envoy Media Group uses Cloudflare's Bot Management product, specifically the bot score generated by machine learning, to filter automated traffic. Envoy ingests the bot score as a custom header into their Revstr rules engine to dynamically adjust user experiences (e.g., longer forms for suspicious traffic). They also feed the bot score into their data warehouse for media buyers to analyze traffic sources and into their ML models to predict conversion rates and lifetime value, leading to a 15% increase in precision for their conversion rate prediction model.

3/16/2022

Introduced 'Friendly Bots', a new feature that allows customers to auto-validate non-malicious bots using IP lists, rDNS, and machine learning. This feature aims to reduce false positives in bot management, improve crawlability, and provide more granular control over bot traffic through custom policies. It also introduces downstream benefits like easier verification of emerging bots, instant feedback on validation data, and the ability for users to register bots they don't directly own.

3/16/2022

Introduced Advanced Rate Limiting, a new capability integrated with the WAF and Firewall Rules. This feature allows for defining rate limiting rules based on a wide range of HTTP request characteristics (URI, method, headers, cookies, body fields, bot score, JA3 fingerprint) and counting requests based on various dimensions (IP, country, header, cookie, ASN, query parameter value, bot fingerprint). It also enables separating the mitigation expression from the counting expression, allowing for more flexible blocking actions. The post details use cases for protecting web traffic and APIs, including counting based on session ID, request body content, and future support for complexity-based rate limiting.

3/15/2022

Introduced a free Cloudflare WAF Managed Ruleset available to all Cloudflare plans, including free zones. This ruleset is automatically deployed on new zones and provides protection against high-profile vulnerabilities such as Log4J and Shellshock. The WAF is built on a new Edge Rules Engine to ensure performance. Customers can configure or disable rules via the dashboard or API. Updates to the ruleset will be published on the change log.

3/15/2022

This post details how Cloudflare Zaraz integrates with Content Security Policy (CSP) by dynamically adding a nonce to the script-src policy when auto-injection is enabled. It explains the technical challenges of CSP, such as handling multiple CSP headers and the interaction between 'unsafe-inline' and nonces, and outlines the logic implemented to ensure Zaraz scripts are not blocked while maintaining CSP's security guarantees. It also notes current limitations regarding tools using _eval()_ and the non-modification of CSP-Report-Only headers.

3/15/2022

This post introduces 'WAF for SaaS', a significant extension of Cloudflare's WAF capabilities specifically tailored for Software-as-a-Service (SaaS) providers. It allows SaaS providers to create and deploy distinct sets of WAF rules for their individual customers, enabling segmented security based on varying requirements. The post also announces a free tier for Cloudflare for SaaS, offering 100 custom hostnames for free, and a substantial price reduction for custom hostnames, making advanced security more accessible to startups and growing SaaS businesses. It details how custom metadata can be associated with hostnames to dynamically trigger different security products like WAF, Firewall Rules, and Rate Limiting.

3/15/2022

Introduced a machine learning-based detection system to complement existing WAF managed rulesets. This system scores every request for the likelihood of SQLi or XSS attacks, providing a new WAF analytics experience. The model is trained on good/bad traffic classified by managed rules and augmented data, improving detection rates and identifying bypasses proactively. Mitigation is performed via custom WAF rules using the ML-generated scores. The system exposes scores for SQLi and XSS, with plans to extend to all managed rule attack vectors.

3/15/2022

This post details the redesign and consolidation of Cloudflare's WAF features into a unified 'Security' tab within the dashboard. It explains how user research informed the decision to group Firewall rules, Managed rules, and Rate limiting rules under a single WAF umbrella. The post outlines the new navigation structure, the types of rules available (Firewall rules, Rate limiting rules, Managed rules, and Tools), and the design principles behind the new user interface, emphasizing clarity and ease of use. It also announces upcoming enhancements like advanced rate limiting and free managed rulesets.

3/14/2022

Introduced the Investigate portal within the Cloudflare Security Center, allowing customers to query threat intelligence data (IPs, hostnames, AS details). This intelligence is also being annotated directly in analytics and logs. Leverages Cloudflare's network vantage point (DNS, CT logs, Area 1 email security) to enhance threat detection and classification. Outlines future plans for file scanning, CVE search, and threat actor linking.

3/14/2022

This post introduces the concept and implementation of 'Backup Certificates' as a critical enhancement to Cloudflare's website security and TLS certificate management. It addresses the need for resilience against unforeseen events like key compromises and mass revocations by Certificate Authorities. The post details the challenges of scale and manual intervention in certificate re-issuance and outlines Cloudflare's deployment plan for backup certificates, starting with Universal Certificates for free customers and expanding to Enterprise and other certificate types. This significantly strengthens the robustness of Cloudflare's security offerings by ensuring immediate availability of secure connections even during large-scale certificate emergencies.

3/13/2022

This post announces Security Week 2022 and outlines the planned topics and announcements. It provides a historical context for Cloudflare's security offerings, starting with website security (DNS, DDoS, WAF, SSL/TLS) and evolving to address application security (bots, APIs), protocol coverage (TCP/UDP, Spectrum, Magic Transit), email security (intent to acquire Area 1), and user protection (Zero Trust, forward proxy). Specific announcements are foreshadowed for different days of the week, including enhancements to TLS, WAF, Custom Rules, Bot Management, API security, Spectrum, Magic Transit, and Zero Trust. The post also mentions the strategic importance of network expansion and the 'network is the computer' paradigm.

3/10/2022

Introduced a system in partnership with WhatsApp to verify the integrity of code served to users in their browsers. This involves Cloudflare hosting a hash of the intended code, and a browser extension (WhatsApp Code Verify) comparing this hash with a locally computed hash of the executing code. This provides assurance against code tampering for web applications.

3/8/2022

This post details the discovery and mitigation of CVE-2022-26143, a zero-day vulnerability in the Mitel MiCollab platform that enables UDP amplification DDoS attacks. It explains the exploit mechanism, Cloudflare's autonomous detection and mitigation systems, and provides specific instructions for Magic Transit customers to block the vulnerability using Magic Firewall rules. The post also highlights Cloudflare's commitment to providing unmetered and unlimited DDoS protection.

3/8/2022

This post details the analysis and mitigation of a novel DDoS attack vector leveraging Mitel's TP-240 VoIP processing interface cards. It explains how misconfigured devices expose a system test facility on UDP port 10074, allowing attackers to use them as DDoS reflectors/amplifiers. The post details the attack mechanism, including a single-packet initiation capability leading to extremely high amplification ratios (up to 4,294,967,296:1), the potential for sustained attacks of up to 14 hours, and the collateral impact on voice communications. Recommended actions include network reconnaissance for remediation, vendor coordination, implementing ingress/egress source address validation, and robust DDoS defense strategies.

3/7/2022

This post details Cloudflare's response to cyberattacks in Ukraine, including extending services to Ukrainian government and telecom organizations at no cost, expediting onboarding under Project Galileo for Ukrainian entities, and implementing security measures for customer data by moving encryption key material out of affected regions and configuring facilities to brick themselves. It also highlights the adaptation of Zero Trust products to protect against threats like wiper malware observed in Ukraine, emphasizing the learning and improvement of global customer protection based on these events.

3/4/2022

This post significantly contributes to the understanding of Cloudflare's threat management by providing real-time data on internet traffic patterns and cyberattacks within Ukraine during a period of intense conflict. It details the impact of physical events on internet usage across different cities, highlights the surge in DDoS and layer 7 attacks against Ukrainian domains, and showcases Cloudflare's mitigation efforts. This data provides crucial context for the effectiveness and application of Cloudflare's security features in a high-stakes, real-world scenario.

3/2/2022

This post details Cloudflare's role as a 'second relay' in Apple's iCloud Private Relay service, explaining how Cloudflare's network, QUIC/MASQUE support, and quiche library are utilized. It provides guidance for website operators on ensuring geolocation accuracy, delivering high-performance user experiences, and managing fraud/bot detection systems that rely on IP addresses, by accommodating shared IP addresses and keeping geolocation databases updated. For Cloudflare customers, it highlights that existing rate limiting and bot management capabilities are already equipped to handle this traffic.

2/25/2022

This post introduces the challenge of post-quantum cryptography and its implications for website security and threat management. It highlights the need to protect confidentiality and authentication against quantum adversaries, discusses the complexities of migrating TLS and other foundational internet protocols to quantum-resistant algorithms, and emphasizes the opportunity to rethink and improve the Public Key Infrastructure (PKI) to better handle these future threats.

2/25/2022

This post details Cloudflare's ambitious initiative to 'post-quantum-ify' its internal connections, starting with TLS. It outlines the challenges of migrating dozens of services across various programming languages to use post-quantum cryptography, focusing on the confidentiality aspect of TLS. The post explains the adoption of a 'hybrid' mechanism combining classical and post-quantum algorithms (Kyber-512 with P-256) for TLS 1.3 key exchange, ensuring security and compliance. It also touches upon the reasons for not immediately migrating the authentication phase of TLS and the services targeted for this initial migration.

2/23/2022

This post announces the acquisition of Area 1 Security, marking a significant expansion of Cloudflare's threat management capabilities into email security. It highlights the historical importance of email as a threat vector, the limitations of existing email security solutions, and Cloudflare's own experience using Area 1's technology. The acquisition is positioned as a key step towards a comprehensive Zero Trust security platform, integrating email threat data with Cloudflare's global network intelligence to proactively combat phishing and other email-borne attacks.

2/23/2022

This post introduces the challenge of making cryptographic protocols, specifically TLS, post-quantum resistant. It details the need to replace current public-key cryptography algorithms (like ECDH and digital signatures) with quantum-resistant alternatives due to the threat posed by quantum computers. The post analyzes various post-quantum KEM and signature schemes, discussing trade-offs between speed, key size, and signature size, and explores potential protocol redesigns, such as using KEMs for authentication, to adapt to these new cryptographic realities.

2/21/2022

This post introduces the concept of post-quantum cryptography as a future threat to current cryptographic protocols used in website security and threat management. It proposes a taxonomy of challenges (Protocolla, Implementa, Regulae, Communitates, Investigationes) and discusses the implications for protocols like TLS, IPsec, and DNSSEC. It highlights past experiments with post-quantum TLS key exchange and ongoing research into post-quantum signature algorithms for authentication, indicating a proactive approach to securing future internet infrastructure.

2/18/2022

This post details the technical implementation of Page Shield for detecting Magecart-style attacks. It explains how the system uses Content Security Policies (CSP) reports, threat intelligence feeds, and ML-based static analysis. Specifically, it describes the use of Abstract Syntax Trees (ASTs) and data flow graphs to identify malicious scripts by analyzing data flow properties, detecting connections between PII reads and data exfiltration calls. It also covers the detection of obfuscated malicious scripts by normalizing content and analyzing 'revealed-risk', and handling scripts with arbitrary string transformations.

2/17/2022

This post introduces 'tubular', an open-sourced eBPF-based tooling for managing network traffic at the kernel level. It addresses limitations of the traditional BSD socket API by enabling advanced features like handling millions of IPs, coexisting multiple services on the same IP addresses, and managing dynamic service addresses. This significantly enhances Cloudflare's ability to manage and secure its network infrastructure, particularly for products like Spectrum, by providing more granular control and robustness beyond standard OS capabilities.

2/10/2022

This post announces the acquisition of Vectrix and its integration into the Cloudflare Zero Trust platform. Vectrix provides API-driven CASB functionality to detect security issues within SaaS applications, focusing on data security, user activity, misconfigurations, compliance, and shadow IT. This capability will be integrated with Cloudflare's existing Zero Trust offerings like Access, Gateway, and Browser Isolation to provide a unified platform for securing SaaS applications.

2/1/2022

This post details the evolution of Cloudflare's bug bounty program from a vulnerability disclosure program to a private bounty program and finally to a public, paid bug bounty program. It outlines the challenges faced in the early stages, such as a low signal-to-noise ratio due to insufficient documentation for researchers, and the lessons learned. The post describes the transition to a private bounty program to gain experience with financial rewards and refine internal processes. It highlights the success of the private program, including the total bounty payouts and improved report validity. Finally, it announces the public launch, emphasizing the commitment to providing better documentation, testing platforms, and interaction with security teams to enhance the researcher experience. A key technical contribution mentioned is the creation of CumulusFire, a testing sandbox built on Cloudflare Workers, to provide a standardized environment for researchers and aid in vulnerability reproduction.

1/26/2022

This post details an incident where a product migration for Cloudflare for SaaS resulted in 24 hostnames, including www.cloudflare.com, being incorrectly proxied to the wrong origin (clickfunnels.com). It highlights a critical failure in the migration process for 'blocked' hostnames, leading to unintended traffic redirection. The post outlines the immediate remediation steps, the scale of the impact, and crucial procedural and technical follow-ups to prevent recurrence, such as stricter validation for blocked hostnames and enhanced monitoring during migrations.

1/17/2022

This post extends the availability of real-time DDoS alerts to Cloudflare's Free plan users. It details how these alerts are configured via notification policies in the Cloudflare dashboard and reiterates Cloudflare's unmetered DDoS mitigation commitment and the underlying network infrastructure and analysis mechanisms used for detection and mitigation.

1/10/2022

This post details the DDoS attack trends observed on the Cloudflare network during Q4 2021 and the full year. It highlights the increase in ransom DDoS attacks, application-layer DDoS attacks (particularly against the Manufacturing industry), and network-layer DDoS attacks, including terabit-strong attacks. It also identifies key attack origins (China for application-layer, Moldova for network-layer) and common attack vectors (SYN floods, UDP floods). The post also mentions the emergence of the Meris botnet and the impact of the Log4j2 vulnerability.

12/16/2021

This post introduces 'Crawler Hints,' a new capability aimed at reducing the environmental impact of web searches by informing search indexers about content changes. It details the engineering challenges and solutions involved in building this system, including leveraging cache misses as a signal, using Kafka for data pipelines, Redis for distributed buffering and deduplication, and a 'Hinter' interface for dispatching signals to search partners. The post emphasizes customer opt-in, monitoring, and system resilience as key aspects of its rollout.

12/15/2021

Released WAF rules (IDs 100514, 6b1cc72dff9746469d4695a474430f12; 100515, 0c054d4e4dd5455c9ff8f01efe5abb10; 100516, 5f6744fa026a4638bda5b3d7d5e015dd) to block Log4j RCE exploits targeting HTTP headers, body, and URL. Also released an advanced rule (IDs 100517, 2c5413e155db4365befe0df160ba67d7) for broader protection with a higher false positive rate.

12/14/2021

This post details the real-time exploitation of CVE-2021-44228 (Log4Shell) observed by Cloudflare, including exploitation attempts prior to public disclosure. It analyzes WAF evasion patterns using Log4j's lookup language and standard encoding techniques, and provides examples of data exfiltration attempts. The post also presents trend data on blocked exploitation attempts and their geographical origins, highlighting the rapid evolution of attacker tactics and the need for robust WAF rule sets and system patching.

12/14/2021

This post details the implementation of a new feature within Cloudflare Logs to automatically redact the `${` token, which is a key indicator for the Log4j vulnerability (CVE-2021-44228). This mitigation is applied to logs sent to customers via Logpush jobs by enabling a `CVE-2021-44228=true` option through the API. The post explains the attack vector and the necessity of redacting obfuscated variants of the token, highlighting the challenge of balancing security with the need to preserve legitimate log data.

12/13/2021

This post introduces 'Bulk Redirects', a new product that allows administrators to upload and manage hundreds of thousands of URL redirects via the dashboard without writing code. This significantly expands the capabilities beyond the previous Page Rule limit of 125 redirects and offers a more user-friendly alternative to custom Cloudflare Workers for implementing redirects. It addresses common use cases like website migrations, vanity URLs, and security enforcement (e.g., forcing HTTPS).

12/11/2021

This post introduces HTTP Applications and Routing Rules, a new system for managing and deploying configuration changes to Cloudflare's edge network. It addresses the challenges of manual configuration management and configuration drift between staging and production environments by allowing users to version configurations, create staging and production routing rules, and test changes in isolation before a full rollout. This provides a more robust and safer workflow for managing edge configurations, including firewall rules, page rules, and cache settings.

12/11/2021

This post significantly enhances the 'Website Security & Threat Management' thread by detailing the evolution of Cloudflare's notification system. It highlights the shift from email-only notifications to robust webhook support for various messaging and monitoring platforms (Slack, Teams, Discord, DataDog, Splunk, etc.), enabling real-time alerts directly within customer workflows. Furthermore, it introduces notification history, providing a crucial log of past alerts for 30-90 days, addressing the issue of lost or missed notifications and improving overall system observability and recovery capabilities.

12/11/2021

This post details Cloudflare's internal response to the Log4j2 vulnerability (CVE-2021-44228). It outlines the process of identifying vulnerable systems (ElasticSearch, LogStash, Bitbucket), applying mitigation strategies (removing JndiLookup class, setting system property), and reviewing external reports. It also describes the internal investigation using asset inventory, code scanning, log analysis, network analytics, and endpoint analysis to confirm no compromise. The post highlights the effectiveness of defense-in-depth strategies like restricting outbound traffic and using Cloudflare Access for internal services.

12/10/2021

This post details the immediate response to the Log4j vulnerability (CVE-2021-44228) by updating Cloudflare's WAF to block malicious strings. It also introduces and elaborates on the use of Cloudflare Gateway for protective DNS filtering and logging, and Cloudflare One's network firewall for securing outbound network traffic (Layers 3-5) via GRE, IPsec, direct connections, or device clients. Additionally, it describes the Secure Web Gateway for HTTP inspection, virus scanning, and logging of outbound HTTP requests, emphasizing a defense-in-depth strategy with positive security models (allow-listing).

12/10/2021

This post details the analysis of actual exploit payloads captured in the wild for the Log4Shell vulnerability (CVE-2021-44228). It provides statistics on blocked exploit requests per minute, the number of actively scanning IP addresses, and the geographical origins of these attacks. The post categorizes and analyzes various payload types, including reconnaissance attempts, User-Agent exploits, and evasion techniques using Log4j features like `${lower}`. It also highlights the use of DNS and Java/Linux command-line tools in some attacks, and the ongoing efforts by Cloudflare's security teams to update WAF and firewall rules in response to evolving exploit attempts.

12/10/2021

This post details the Log4j2 vulnerability (CVE-2021-44228), explaining its history, how it was introduced via the JNDILookup plugin in Log4j 2.0-beta9, and how it can be exploited through JNDI and LDAP. It provides mitigation techniques (upgrading Log4j or removing the JndiLookup class) and outlines Cloudflare's immediate response by rolling out firewall rules to block the 'jndi' Lookup in common HTTP request locations to protect customers.

12/10/2021

This post introduces Cloudflare Domain Protection, a new service for Enterprise customers that aims to prevent domain compromise. It details the common attack vectors for domain hijacking (unauthorized transfers, name server updates, suspensions/deletions) and outlines Cloudflare's 'triple-locked' approach to securing domains, which includes EPP Registrar Locks, internal API locks, and Registry Locks. The service is offered for free to eligible Enterprise customers, including registration and renewal fees, and builds upon existing offerings like Cloudflare Registrar and Custom Domain Protection.

12/10/2021

This post details the immediate deployment of three new Cloudflare WAF rules (IDs 100514, 100515, 100516) to mitigate the Log4j RCE vulnerability (CVE-2021-44228). The rules inspect HTTP headers, body, and URL for exploit attempts, with a default action of BLOCK. It also provides context on the vulnerability and mitigation strategies for users not using Cloudflare WAF.

12/9/2021

Introduced Cloudflare Security Center, a unified security intelligence solution that brings together Cloudflare's security products, expertise, and internet intelligence. Security Center offers Security Insights for reviewing and managing potential security risks and vulnerabilities, and an Infrastructure view for inventorying IT assets on Cloudflare. It enables users to map their attack surface, review risks, and mitigate them with a few clicks, with automated scanning based on plan type.

12/9/2021

Introduced threat intelligence feed integration (malware, anonymizer, botnet C2) and custom IP lists for Magic Firewall rules. Added geo-blocking functionality to allow or deny traffic based on country. Released packet capture capabilities at the edge, allowing for the capture of network traffic in pcap format with filtering options.

12/8/2021

This post announces the acquisition of Zaraz, a company that provides a sandboxed environment for third-party scripts on websites. It details the security risks associated with embedding third-party JavaScript, such as performance degradation and data theft, using an analogy of a pharmacy giving keys to a stranger. The post highlights how Zaraz, built on Cloudflare Workers, mitigates these risks by strictly controlling script behavior, preventing unauthorized access to sensitive data like cookies and credentials, and ensuring that compromised scripts do not impact website rendering or security. It also mentions that Zaraz technology will be made available to Enterprise customers immediately and a free beta version will be available to all customers.

12/8/2021

This post announces the acquisition of Zaraz and the launch of Cloudflare Zaraz (beta), a product that manages and loads third-party tools in the cloud. It addresses the problems of third-party bloat, performance degradation (average 40% slowdown), and security/privacy risks associated with traditional tag managers. Zaraz aims to improve website speed, privacy, and security by running third-party scripts in the cloud instead of the browser. It offers backward compatibility with Google Tag Manager's dataLayer and includes a library of 18 third-party tools. The post highlights Instacart's success with Zaraz, achieving 0 ms Blocking Time and increased security by proxying requests through their own subdomain using Cloudflare Workers.

12/8/2021

Introduced clientless web isolation as a beta feature for Cloudflare for Teams subscribers with Browser Isolation. This capability allows users to access remote browsers via a hyperlink, integrating with Cloudflare Access and Gateway for Zero Trust Network Access (ZTNA). It protects endpoints from malicious code by executing browsing in a remote data center, resetting to a clean state after use. This model supports both managed and unmanaged devices, offering data protection controls like restricted printing, clipboard access, and file transfers.

12/8/2021

This post announces the General Availability of Page Shield, a new capability designed to protect end-user data from browser-based supply chain attacks. It details how Page Shield leverages Cloudflare's network position to monitor JavaScript files loaded by web applications, providing visibility into third-party scripts, detecting malicious behavior through threat feeds and a classifier, and outlining future plans for prevention and mitigation. The post explains the use of Content Security Policy (CSP) with report-only directives to collect script information and describes the detection mechanisms, including hostname/URL categorization and a classifier that analyzes script behavior for correlations with data exfiltration.

12/7/2021

Introduced Cloudflare Browser Isolation as a new capability within the Secure Web Gateway and Zero Trust Network Access services. This feature allows administrators to define Zero Trust policies to prohibit keyboard input and file transmission during high-risk browsing activity, thereby protecting against phishing attacks and credential theft on unknown or high-risk websites. It shifts the risk of executing untrusted code from the user's endpoint to a remote browser hosted in a Cloudflare data center.

12/6/2021

This post introduces Cloudflare One as a cloud-native firewall solution designed to replace hardware firewalls. It details the historical evolution of firewalls from stateless packet filtering to stateful inspection, deep packet inspection, and next-generation firewalls (NGFWs) with application awareness. It highlights the shift towards Zero Trust principles and the integration with identity providers. The core contribution is the description of Cloudflare One's capabilities, including flexible on-ramps, global network scalability, comprehensive policy configuration (layers 3-7), integration with Zero Trust attributes, managed lists, deep packet inspection, programmable packet filtering, protected DNS, application/content categories, and remote browser isolation.

12/6/2021

This post details the integration of eBPF with nftables within Cloudflare's Magic Firewall. It explains how eBPF programs can be loaded and executed within the kernel to provide advanced packet parsing and content matching capabilities beyond what nftables alone can offer. The post covers the technical challenges of bridging iptables' xt_bpf extension with nftables, the structure of netlink/netfilter messages required, and the process of compiling and loading eBPF programs using libraries like cilium's ebpf. This enables more sophisticated firewall rules for protocol validation and advanced field matching.

12/6/2021

This post introduces IPsec as a new on-ramp to Cloudflare One, enabling customers to securely connect their networks and devices to Cloudflare's global network using a widely supported encryption protocol. It addresses the limitations of traditional IPsec architectures (hub-and-spoke, mesh) by leveraging Cloudflare's Anycast network to provide a single, globally distributed IPsec tunnel. This enhances security by encrypting all traffic, including legacy applications, and improves performance by eliminating latency associated with centralized hubs. The implementation integrates deeply with the Cloudflare One suite, offering unified security, performance, and reliability.

12/3/2021

This post introduces the concept of 'Grinch Bots' as a specific type of seasonal bot attack targeting online inventory during the holiday season. It details the scale of bot traffic observed during Black Friday and Cyber Monday, highlighting that nearly 44% of internet traffic comes from bad bots. The post explains how Cloudflare's Bot Management and Bot Fight Mode are used to combat these threats, including the use of JS Challenges and the impact on bot operators. It also mentions the detection of over 300 billion bots attempting to 'add to cart' and 71% of login traffic originating from bots.

12/3/2021

Introduced proactive security event notifications for Business and Enterprise customers, enabling alerts via email, PagerDuty, or webhooks. These alerts leverage z-score calculations to detect significant spikes in firewall-related events, providing timely notifications within two hours for general security events and within five minutes for advanced security events on Enterprise zones. The system allows filtering by specific security services for advanced alerts and displays relevant log values for integration with SIEMs.

11/29/2021

This post introduces Cloudflare Radar Maps, which provide near real-time geographical visualizations of application-level attack origins and targets, and Sankey diagrams illustrating attack flows. This significantly enhances the visibility and understanding of cyber threats, building upon existing threat management capabilities by offering a new way to consume and analyze attack data at a global scale.

11/18/2021

Introduced HTTP Response Header Modification as a new action within Transform Rules, allowing users to set or remove HTTP response headers without writing code. This feature enables dynamic header population using Cloudflare functions (e.g., bot score, visitor country) and static values, and provides granular filtering based on various request parameters. This complements existing security mechanisms like CSP and CORS by offering a more flexible and integrated way to manage response headers.

11/13/2021

This post details the mitigation of a nearly 2 Tbps multi-vector DDoS attack combining DNS amplification and UDP floods. It explains Cloudflare's out-of-path traffic analysis for sub-second detection, real-time signature generation, and ephemeral rule propagation to the edge. Specifically, it highlights the use of eBPF/XDP in the Linux kernel for wirespeed packet dropping of attack traffic.

11/12/2021

This post introduces Cloudflare for Teams Gateway as a new layer of network security, offering DNS filtering and logging capabilities for home networks and small teams. It also highlights the 1.1.1.1 app with WARP as a free solution for securing individual device traffic through an encrypted tunnel, acting as a VPN replacement and enhancing visibility when combined with Teams.

11/9/2021

This post details the analysis of the Meris botnet, a significant threat that exploits MikroTik router vulnerabilities (CVE-2018-14847) to launch large-scale DDoS attacks. It describes the botnet's characteristics, attack vectors (HTTP pipelining, SOCKS proxies), targets (industries and countries), and compares it to the Mirai botnet. Cloudflare's existing DDoS protection systems automatically detect and mitigate these attacks, with additional rules deployed for more comprehensive mitigation and threat intelligence gathering. The post also highlights the use of Cloudflare Radar for visualizing attack data.

11/8/2021

This post introduces the challenge of post-quantum cryptography (PQ) for TLS security, specifically focusing on digital signatures. It highlights the need to transition to PQ signatures due to the threat posed by quantum computers and discusses the performance and size trade-offs of various PQ signature schemes (Dilithium, Falcon, Rainbow) compared to current standards (RSA, ECDSA). The post details Cloudflare's experimental approach to testing the impact of larger signatures on TLS handshakes by using dummy certificates, aiming to gather real-world data on client compatibility and performance.

11/4/2021

This post provides a detailed analysis of DDoS attack trends observed in Q3 2021, categorizing them into application-layer (L7) and network-layer (L3/4) attacks. It highlights the emergence of the Meris botnet and its role in large HTTP DDoS attacks, as well as the resurgence of Mirai-variant botnets responsible for terabit-scale network-layer attacks. The post also details geographical trends in attack origins and targets, industry-specific targeting, and the evolution of attack methodologies, including a significant increase in DTLS amplification attacks and larger packet rate attacks.

10/20/2021

This post introduces 'Traffic Sequence', a new dashboard feature that visually illustrates the execution order of Cloudflare products for a given HTTP request. It addresses the growing complexity of Cloudflare's product ecosystem and the difficulty users face in understanding how different features like Firewall Rules, Workers, and Transform Rules interact. The post details the development of Traffic Sequence from a 'napkin idea' to a fully integrated feature, highlighting its benefits for customer understanding, product discoverability, and navigation. It also provides a concrete example of how understanding traffic sequence is crucial for effective configuration, particularly with the interplay between URL rewriting and Firewall Rules.

10/15/2021

This post introduces 'multi-user IP address detection' as a new capability within Cloudflare's security offerings. It explains the challenges posed by shared IP addresses due to NAT and CG-NAT, where a single IP can represent multiple users. The post details the technical approach to identifying these multi-user IP prefixes by analyzing distinct source ports and user agents, and leveraging external data sources like PeeringDB and IRR. This feature allows customers to make more informed security decisions, reducing false positives and improving the accuracy of threat detection by differentiating between legitimate traffic from shared IPs and potentially malicious automated traffic.

10/15/2021

This post details the evolution and scaling challenges of Geo Key Manager, a service allowing customers to control the geographic storage of their TLS certificate private keys. It describes how the service, initially a research project leveraging Keyless SSL and identity-based encryption, faced performance issues and TLS handshake failures due to increased scale and trans-pacific latency. The post delves into the technical architecture of TLS termination, the roles of services like keynotto and gokeyless, and the performance implications of head-of-line blocking and remote key signing. It also includes a comparative analysis of Go vs. Rust for cryptographic operations, highlighting the performance benefits of Rust in keynotto for CPU and memory consumption.

10/14/2021

This post details Cloudflare Research's exploration into advanced authentication methods to combat password reuse and credential stuffing attacks. It introduces Password Authenticated Key Exchanges (PAKEs), specifically focusing on Strong Asymmetric PAKEs (saPAKEs) like OPAQUE, which aim to establish secure keys without revealing plaintext passwords to the server. It also highlights the rollout of the Exposed Credential Checks feature in the WAF, powered by the Might I Get Pwned (MIGP) protocol, which detects compromised credentials and variants by using a private membership test protocol and generating password variants.

10/13/2021

This post introduces Exported Authenticators (EAs) as a new extension to TLS. EAs enable application-layer authentication that is as strong as TLS authentication and can be tied to the TLS channel via channel binding. This allows for advanced authentication possibilities such as TLS connections with multiple certificates and logging into websites without revealing passwords. The design of EAs closely follows the TLS 1.3 handshake to ensure security and leverages existing cryptographic primitives.

10/12/2021

This post introduces the SSL/TLS Recommender tool, which guides users to stronger configurations for the backend connection from Cloudflare to origin servers. It explains the importance of securing this connection, detailing the different SSL/TLS encryption modes (Off, Flexible, Full, Full (strict), Strict) and the challenges in detecting and enforcing HTTPS support on origin servers. The post highlights how this tool builds upon the earlier initiative of Universal SSL to further enhance website security by ensuring encrypted communication between Cloudflare's edge and customer origins.

10/12/2021

This post details the initial deployment of TLS Encrypted Client Hello (ECH), an extension to TLS that encrypts sensitive metadata in the ClientHello message. It explains the privacy benefits of ECH by preventing the visibility of target server names to network observers, contrasting it with DNS-over-HTTPS (DoH). The post also delves into the evolving threat model for ECH, discussing active and passive attacks and how ECH's design aims to mitigate them, particularly concerning the anonymity set and preventing domain fronting.

10/12/2021

This post announces Privacy Pass Extension v3.0, detailing significant refactoring of the browser extension for improved maintainability and extensibility. Key technical changes include implementing the extension in TypeScript, using a module bundler, refactoring the API for cryptographic primitives, and treating provider-specific code as encapsulated modules rather than configuration properties. This modular approach allows for easier integration of future service providers by enabling provider-specific WebRequest API event listeners and moving from configuration files to programmable modularization. The post also discusses the evolution of the Privacy Pass protocol, its standardization at IETF, and future work on metadata to address hoarding attacks, including exploring key rotation as a potential solution.

10/8/2021

This post details how Cloudflare's Web Application Firewall (WAF) and URL normalization features provided protection against CVE-2021-41773, a zero-day path traversal vulnerability in Apache HTTP Server. It explains the vulnerability's mechanism, which involves missing path normalization logic, and provides specific WAF rule IDs and descriptions that mitigate the exploit. The post also includes observed exploit attempts and emphasizes the importance of layered security measures.

10/7/2021

This post introduces Cloudflare Waiting Room's new 'random queueing' feature, offering an alternative to the existing FIFO (First-In-First-Out) queueing method. Random queueing provides a fairer distribution of access during high-demand events by selecting users randomly, regardless of their arrival time, thus encouraging users to stay on the site longer. The post also details the technical implementation of both FIFO and random queueing, explaining how cookies, bucket IDs, and available slots are managed, and how the system can seamlessly transition between queueing methods. Additionally, it announces the general availability of Waiting Room to Enterprise customers and its support for custom web/mobile applications.

10/7/2021

This post details common attack patterns against VoIP infrastructure, including TCP floods targeting stateful firewalls, UDP floods and reflection targeting SIP infrastructure, and SIP protocol-specific application layer attacks. It recommends proactive deployment of always-on DDoS mitigation services like Cloudflare Magic Transit, enforcement of positive security models, custom mitigation strategy development with vendors, and employee education on ransom demands. It highlights Cloudflare's capacity and existing mitigations for these attacks.

10/6/2021

This post introduces a new capability for Enterprise customers to stage custom uploaded TLS certificates in a staging environment before deploying them to production. This feature aims to de-risk certificate deployments by allowing users to test new certificates against staging IPs, verify hostname coverage, and ensure compatibility with certificate pinning configurations. It also provides a rollback mechanism in case of deployment issues and outlines future plans to extend staging capabilities to certificate renewals and TLS configuration changes.

10/1/2021

This post details the rise of VoIP DDoS attacks, explaining how attackers exploit UDP and SIP protocols to overwhelm VoIP servers. It highlights Cloudflare's Magic Transit service and its Anycast architecture for mitigating these attacks without impacting latency. The post also describes the use of XDP for wire-speed packet dropping and the development of specific mitigation rules for UDP traffic to identify and drop invalid SIP traffic, ensuring the protection of VoIP services.

9/8/2021

This post details Cloudflare's rapid response to the Atlassian Confluence OGNL injection vulnerability (CVE-2021-26084). It describes the process of analyzing a Proof-of-Concept, developing and deploying a WAF rule with `BLOCK` action within hours of the PoC's release, and protecting customers using the WAF and Cloudflare Access. It also analyzes traffic patterns, showing that malicious probing began days before the PoC was public, and details the types of attacks observed (command injection, request port anomalies, fake bot signatures, OWASP ModSecurity Core Ruleset matches, HTTP request anomalies) before the specific WAF rule was deployed.

8/20/2021

Introduced Tenant Control in Cloudflare Gateway, allowing administrators to enforce corporate application usage and data boundaries. This is achieved by appending specific headers, including a tenant ID, to requests, which SaaS applications use to block consumer/personal usage or logins to accounts not part of the specified tenant. This feature leverages HTTP filtering policies within Cloudflare Gateway and integrates with corporate devices via the WARP agent, offering a more performant alternative to traditional VPN backhauling.

8/19/2021

This post details the detection and mitigation of a record-breaking 17.2 million rps DDoS attack by Cloudflare's autonomous edge DDoS protection systems. It highlights the role of the 'dosd' daemon in analyzing traffic samples out-of-path, generating real-time mitigation rules, and propagating them to optimal stack locations (e.g., L4 iptables) for efficient mitigation. The post also discusses the resurgence of Mirai and other botnets, providing statistics on attack volumes and sources, and emphasizes the importance of always-on, automated protection for businesses and IoT devices.

8/16/2021

Introduced Shadow IT Discovery feature within Cloudflare for Teams Gateway. This feature analyzes HTTP requests logged by Gateway to identify and categorize SaaS applications used by an organization. It allows administrators to review applications, mark them as approved or unapproved, and then apply Gateway rules to block unapproved applications. The feature also provides user count data for applications to aid in license management.

8/12/2021

This post expands the Cryptographic Attestation of Personhood experiment to support a wider range of devices, including biometric authenticators (Apple's Face ID, Microsoft Hello, Android Biometric Authentication) and FIDO-certified USB and NFC keys. It introduces the use of Zero Knowledge Proofs (ZKP) to further enhance privacy by only revealing the fact that a valid security key is present without disclosing other information. The post also details user testing and production usage data demonstrating improved solve times and user preference for these new authentication methods.

8/2/2021

This post details Cloudflare's partnership with Accenture Federal Services to deliver a protective DNS resolver solution to the Department of Homeland Security (DHS). This initiative leverages Cloudflare's extensive DNS query data, combined with Accenture's threat intelligence and AI/ML analysis, to block malicious hostnames and protect federal government agencies from cyberattacks. It highlights the application of Cloudflare's security expertise to a critical government sector, building on previous efforts like the Athenian Project.

7/24/2021

This post details Cloudflare's response to a Remote Code Execution (RCE) vulnerability discovered in cdnjs, a platform that utilizes Cloudflare's services. It highlights Cloudflare's rapid incident response, including blocking exploitation, revoking credentials, and investigating potential abuse. The post also outlines the remediation efforts, which involved fixing path traversal issues, implementing AppArmor profiles, and a complete redesign of the auto-update pipeline using a microservices architecture with sandboxed Docker containers to enhance security and prevent future vulnerabilities.

7/20/2021

This post details DDoS attack trends observed on Cloudflare's network during Q2 2021. It highlights a significant increase in HTTP DDoS attacks targeting government administration and consumer services, with China and the US being prominent sources and targets. Emerging threats include amplification attacks abusing QOTD and an increase in QUIC-based attacks. Network-layer DDoS attacks in the 10-100 Gbps range also saw an increase. The post provides detailed statistics on attack distribution by market industry, source country, target country, attack size (bit rate and packet rate), and duration, emphasizing the need for always-on, automated DDoS protection.

7/8/2021

This post introduces Origin Error Rate notifications, a significant enhancement to website availability monitoring. It moves beyond simple 'origin down' alerts to sophisticated anomaly detection using Service Level Objectives (SLOs) and burn rate calculations. This allows for proactive notification of elevated 5xx errors from origin servers, even when they are not a complete outage, by analyzing error rates against user-defined SLOs and employing both short and long-term indicators to minimize false positives and ensure timely alerts.

7/7/2021

This post introduces Transform Rules, a new feature that allows users to modify HTTP requests at the edge without writing Cloudflare Workers. It covers three main capabilities: URL Normalization (decoding encoded URLs to prevent security bypasses), URL Rewrite (static and dynamic modification of URL paths and query strings based on request attributes), and Header Modify (adding or removing static or dynamic headers, including bot scores, to requests sent to origin servers. This provides a more accessible way to manage request shaping for security and application optimization.

7/1/2021

Introduced new WAF rules (100197 and 100197B) to detect and block reGeorg web shell variants. Expanded the availability of the Exposed Credential Check feature of Account Takeover Protection to all paid plans, which adds an `Exposed-Credential-Check: 1` header to requests when compromised credentials are detected. This header can be used by origin servers to enforce additional security measures like MFA or password resets. The feature can also be used in logging mode for brute-force attack identification via Firewall Analytics.

6/16/2021

This post introduces and details the Cloudflare Waiting Room feature, a new capability designed to manage extreme traffic spikes for web applications. It explains the functionality, configuration options (Total Active Users, New Users Per Minute, Session Duration), and the underlying technical implementation using Cloudflare Workers and Durable Objects. The post elaborates on how Waiting Room protects origin servers by creating an orderly queue, issuing encrypted cookies as tickets, and managing user slots across data centers using historical traffic data and a clustering mechanism for queue position tracking. It also details the structure of the user cookie and the concept of Waiting Room state management.

6/15/2021

This post details an integration between Cloudflare's Web Application Firewall (WAF) and Azure Active Directory B2C (Azure AD B2C). It explains how customers can use Cloudflare WAF to protect custom domains hosting their Azure AD B2C authentication endpoints, thereby enhancing security for B2C applications. The integration leverages Cloudflare's WAF capabilities, such as custom rule writing, rate limiting, DDoS mitigation, and bot management, in conjunction with Azure AD B2C's native Identity Protection features to provide a defense-in-depth approach against cyberattacks.

6/8/2021

Introduced HTTP Request Header Modification as a new action within Transform Rules, allowing administrators to set or remove HTTP request headers without writing code. This feature supports dynamic header values (e.g., bot score, country code), static values, and header removal. It also integrates with Cloudflare functions like `concat()` and `to_string()` for dynamic value construction. This provides an alternative to Cloudflare Workers for header manipulation.

5/25/2021

This post introduces Cloudflare's SOC as a Service, which augments existing security products with a dedicated team of cybersecurity experts for 24x7x365 monitoring, threat detection, incident response, and mitigation. It details the service's capabilities, including proprietary algorithm-based alerting that uses baselining to detect anomalies and reduce false positives. The service also offers integration with partners for managed security services.

5/13/2021

Introduced Cryptographic Attestation of Personhood as an experiment to replace CAPTCHAs. This system leverages WebAuthn and hardware security keys (like YubiKey) to provide a privacy-preserving proof of humanity. The technical explanation details the use of public-key cryptography and digital certificates, specifically focusing on the WebAuthn Attestation API and how manufacturers sign attestation public keys with digital certificates to verify device legitimacy without revealing user identity.

5/11/2021

This post details the redesign of the Cloudflare Web Application Firewall (WAF) dashboard experience. It focuses on improving the user journey for enabling the WAF and configuring rules by addressing two key customer job stories: 'quickly turn on the WAF and use the default settings' and 'only configure the rules I'm interested in.' The redesign simplifies the enablement process to a single click, reduces the risk of misconfiguration by making the overall WAF switch and ruleset enablement a unified action, and introduces bulk editing capabilities for rules within a ruleset. It also introduces the concept of a 'Ruleset Action' to apply a single action to all rules within a ruleset and improves the rule browser for selecting and modifying multiple rules simultaneously.

4/19/2021

This post provides a detailed analysis of DDoS attack trends observed in Q1 2021. It breaks down application-layer attacks by industry, source country, and target country, and discusses ransom DDoS attacks. For network-layer attacks, it covers the number of attacks, size (bit rate and packet rate), duration, common attack vectors (SYN, RST, UDP, DNS amplification), and emerging threats like QUIC version negotiation floods and attacks targeting Jenkins and TeamSpeak3 servers. The post also highlights the underlying technologies used for detection and mitigation, such as the autonomous edge DDoS protection system and its asynchronous traffic analysis.

4/15/2021

This post introduces Cloudflare Tunnel (formerly Argo Tunnel) as a free service for establishing secure, outbound-only connections from origin servers to Cloudflare. This significantly enhances Zero Trust security by eliminating the need to expose origin IPs or manage complex firewall rules, allowing all traffic to be inspected and controlled by Cloudflare. The post also details improvements to Tunnel's stability and persistence, including the removal of internal dependencies, migration to Cloudflare's edge load balancer Unimog, and the introduction of Named Tunnels for autonomous reconnection, further strengthening the security and reliability of origin connectivity.

4/15/2021

This post announces the evolution of 'SSL for SaaS' into 'Cloudflare for SaaS', making advanced security and performance features previously exclusive to Enterprise customers available to all SaaS providers. It highlights how Cloudflare for SaaS extends the benefits of Cloudflare's network (DDoS mitigation, WAF, performance optimizations) to SaaS providers and their customers, simplifying infrastructure management, certificate provisioning, and enabling custom domain support. The post also showcases how this integrates with Cloudflare Workers to provide a comprehensive platform for SaaS development.

3/30/2021

This post highlights the Cloudflare WAF's recognition as a Gartner Peer Insights Customers' Choice for WAF 2021, emphasizing its ease of use, scale, and innovative controls. It also lists several recent WAF-related product releases and enhancements: IP lists for network list management, Payload Encryption for WAF-blocked request forensics, streaming security events to SIEMs, the Data Localization Suite for data storage and protection rules, regex capabilities for HTTP headers and bodies in Firewall Rules, API Shield for mutual TLS authentication on API endpoints, and gRPC proxy support.

3/30/2021

This post introduces several new features aimed at enhancing end-user account security and preventing account takeovers. These include: a managed list of open proxy IPs for firewall rules, Super Bot Fight Mode for Pro and Business plans to combat credential stuffing, Exposed Credential Checks within the WAF to identify and flag logins using compromised credentials (using a privacy-preserving cryptographic protocol), Cloudflare Access integration with managed device serial numbers for stricter access control, and rate limiting on failed login attempts to slow down brute-force attacks.

3/29/2021

This post introduces a complete rewrite of the Cloudflare Web Application Firewall (WAF) engine in Rust, utilizing the wirefilter syntax. It details improvements in rule browsing and configuration with a new UI, updated rulesets including a modernized OWASP Core Ruleset with paranoia levels and better false positive rates, and the introduction of global configuration capabilities for managing rulesets across an entire account. The new engine aims for better performance, scalability, and security.

3/27/2021

This post announces the integration of Keyless SSL with FIPS 140-2 Level 3 validated HSMs from major cloud providers (AWS, Google Cloud, IBM Cloud, Microsoft Azure) and other PKCS#11 compliant HSMs. It details the architecture of Keyless SSL, the role of HSMs in cryptographic operations, and provides a step-by-step guide for setting up and using Microsoft Azure Managed HSM with the gokeyless daemon. This extends Cloudflare's ability to secure HTTPS connections for customers with strict key custody requirements.

3/27/2021

This post revisits the Heartbleed vulnerability from 2014, highlighting how Cloudflare has incorporated its lessons into its security posture. It details advancements in TLS/SSL key protection and management, including Keyless SSL, Geo Key Manager, Keyless Everywhere, and Delegated Credentials, which provide defense-in-depth against key compromise. It also discusses improvements in certificate revocation mechanisms, such as OCSP stapling and OCSP Must-staple, to mitigate the impact of future key compromises. The post contrasts the security landscape of 2014 with the present, showcasing Cloudflare's continuous innovation in TLS/SSL security.

3/27/2021

This post introduces Advanced Certificate Manager (ACM), a significant upgrade to Cloudflare's TLS certificate management capabilities. ACM allows for granular control over certificate validity periods (down to 14 days), custom cipher suite selection for TLS connections, and the generation of Certificate Signing Requests (CSRs) for customers who wish to use their own Certificate Authorities. It also expands the ability to issue multiple edge certificates per zone and offers flexibility in validation methods and CA choices, directly contributing to enhanced website security and customization.

3/26/2021

Introduced 'Super Bot Fight Mode' as an evolution of 'Bot Fight Mode'. This new feature provides enhanced bot detection and mitigation capabilities for Pro and Business plan users. Pro plans gain access to a real-time Bot Report, with options to challenge or block 'definitely automated' traffic and enable JavaScript Detections. Business plans receive Bot Analytics, the ability to target 'likely automated' traffic (identified by machine learning), and more granular control over challenges and blocks. Enterprise Bot Management continues to offer advanced features like API Abuse Detection.

3/26/2021

Introduced API Discovery and API Abuse Detection. API Discovery maps API endpoints by normalizing paths using unsupervised learning and cardinality. API Abuse Detection uses volumetric anomaly detection (adaptive rate limiting based on request frequency per endpoint) and sequential anomaly detection (using Markov Chains to model valid request flows and flag deviations) to identify malicious bot traffic targeting APIs.

3/26/2021

This post details the evolution and application of Cloudflare's Bot Management product. It describes the initial development using machine learning for predicting challenge solutions, its use in protecting Cloudflare's own landing pages from form spam and SEO abuse, and its role in securing the dashboard for domain signups and the billing system for payment card validation. The post highlights the use of Anomaly Detection for API abuse and the introduction of Super Bot Fight Mode. It also emphasizes the importance of global data for training bot detection models.

3/25/2021

Introduced Page Shield, a client-side security product to detect attacks in end-user browsers. The first feature, Script Monitor, records JavaScript dependencies over time and alerts customers to new, unexpected dependencies. It works by adding a `Content-Security-Policy-Report-Only` header to pages, allowing browsers to send reports of JavaScript execution to Cloudflare for analysis. Future plans include code change detection and intelligent analysis of JavaScript files to classify malicious samples, and implementing a negative security model for blocking individual scripts.

3/24/2021

This post introduces Cloudflare's Data Loss Prevention (DLP) platform as a new capability within Cloudflare One. It details how DLP leverages Cloudflare's network for inline inspection of all traffic to build Zero Trust controls over enterprise data. Key features include capturing and logging DNS queries, requests, and file uploads/downloads for audit trails, layering on the Secure Web Gateway for context, and building RBAC rules for SaaS applications. It also introduces WAF rules to scan and block responses containing sensitive data from external-facing applications and promises future capabilities to scan all traffic leaving devices and locations for data loss without performance compromise.

3/24/2021

This post introduces and expands upon Cloudflare's API Shield product, adding four key features to enhance API security and prevent data exfiltration: Schema Validation (now generally available for Enterprise customers), Data Loss Prevention (DLP) in beta, a managed 'Cloudflare Open Proxies' IP List, and enhanced client certificate lifecycle management for revocation. Schema Validation uses OpenAPI v3 schemas to enforce a positive security model, logging or blocking non-compliant requests. DLP identifies sensitive data in egress traffic, with initial logging capabilities and plans for obfuscation and blocking. The managed IP List leverages Cloudflare's threat intelligence to block traffic from open proxies. Enhanced certificate management provides a code-free solution for revoking and restoring client certificates.

3/24/2021

This post details Cloudflare's approach to Data Loss Prevention (DLP) by leveraging existing products like Access, Gateway, and Browser Isolation, and introducing API Shield with new data obfuscation capabilities and shadow API discovery. It emphasizes a multi-layered, Zero Trust model to prevent data exfiltration through internal or external threats, including accidental breaches and compromised accounts. Specific technical details include using Gateway firewall rules for DNS-based malicious domain blocking, Browser Isolation for restricting user actions like copy-pasting and file downloads, and API Shield for schema validation, certificate-based authentication, and noise filtering.

3/23/2021

Introduced Cloudflare Browser Isolation as an add-on to Cloudflare for Teams. This feature leverages Chromium and a novel Network Vector Rendering technique to provide secure and performant remote browser isolation. It aims to protect users and data from zero-day vulnerabilities and other browser-based threats by executing web code on Cloudflare's global network, reducing latency and bandwidth usage for end-users, especially those on low-bandwidth connections. The integration into Cloudflare for Teams provides a consolidated policy management and threat monitoring interface.

3/23/2021

This post details the anatomy of targeted ransomware attacks, including initial compromise vectors like RDP/VPN compromise, unpatched vulnerabilities, and spear-phishing. It highlights how Cloudflare's Gateway with AV, Access, and WAF can be used to detect and mitigate these threats, and discusses the importance of DDoS mitigation against Ransom DDoS attacks.

3/23/2021

This post introduces antivirus scanning capabilities within Cloudflare Gateway. This feature scans inbound files from the internet at Cloudflare's edge, leveraging a malware scanning engine with daily updated definitions. When malware is detected, the file transfer is blocked by resetting the connection, and logs are generated with details of the blocked file and URL. This adds a new layer of defense to Gateway's existing DNS filtering and HTTP traffic inspection.

3/22/2021

This post announces the expansion of Cloudflare One's network connectivity options through new 'Network On-ramp Partnerships' with leading WAN and SD-WAN providers (VMware, Aruba, Infovista) and additional Network Interconnect partners. This allows customers to connect their existing infrastructure to Cloudflare's global network more easily and securely, leveraging features like Magic WAN and Magic Firewall. The post highlights the move away from MPLS and towards a more integrated, software-defined networking approach, with future plans for self-configuration and enhanced Zero Trust security integration.

3/22/2021

This post introduces Magic WAN and Magic Firewall as foundational components of Cloudflare One, extending network security and connectivity to the edge for entire corporate networks. It details how these services replace traditional, complex, and expensive solutions like MPLS and VPNs by providing secure, performant connectivity and centralized firewall policy enforcement as a service. The post highlights use cases for replacing MPLS between branches and data centers, and securing remote employee access, emphasizing the shift towards an edge-based, Zero Trust security model.

3/18/2021

This post details a sophisticated Microsoft 365 spoofing campaign targeting financial departments and executives, which bypassed native email defenses. It highlights the use of advanced phishing kits, spoofed Microsoft domains, and targeted credential harvesting. The post contributes to the understanding of evolving threat vectors, particularly Business Email Compromise (BEC) attacks, and the need for advanced email security solutions that can detect and block these sophisticated social engineering tactics.

3/18/2021

Introduced an autonomous edge DDoS protection system powered by the 'dosd' daemon, deployed across all 200+ data centers. This system detects and mitigates L3-7 DDoS attacks in real-time using eBPF programs in L4Drop and iptables for wire-speed packet dropping. It complements existing core detection mechanisms like Gatebot by enabling faster, more localized attack detection and mitigation.

3/12/2021

This post details the development and scaling of Cloudflare's Anomaly Detection platform, a key component of its Bot Management system. It explains the underlying technology (HBOS, ClickHouse, Redis, HyperLogLog), the platform's architecture (microservices), and the lessons learned during its evolution from a monolithic service to a highly scalable system capable of processing 500K requests per second. Key contributions include insights into optimizing Redis performance (PFMERGE, recency register, key encoding) and the strategic shift to a microservices architecture to improve resilience and reduce load on shared dependencies.

3/9/2021

Introduced the ability to manage Cloudflare Gateway HTTP firewall rules based on pre-defined 'Applications' (collections of hostnames for specific cloud services like Salesforce) and 'App Types' (collections of applications like File Sharing). This significantly simplifies policy creation by allowing administrators to block or allow entire applications with a single rule, rather than manually managing hundreds of hostnames. Cloudflare maintains and updates these application collections.

3/7/2021

This post details the deployment of Cloudflare WAF managed rules (specifically rule IDs 100179 and 100181 within the Cloudflare Specials ruleset) to protect against four specific Microsoft Exchange Server vulnerabilities (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065). It explains that these rules were deployed in 'Block' mode due to active exploitation in the wild and provides instructions for customers to enable or disable them. It also references server-side mitigation recommendations from Microsoft and details the technical chaining of the CVEs (SSRF, insecure deserialization, arbitrary file upload) that attackers exploit.

3/2/2021

This post details Cloudflare's advanced DDoS mitigation techniques, including the use of eBPF rules deployed via XDP for L3-7 protection, flowtrackd for L3/L4 attack defense, and IP Jails for cost-efficient mitigation of volumetric attacks. It also highlights the release of Firewall Analytics and Network Analytics dashboards for improved visibility and real-time DDoS alerts.

2/27/2021

Introduces flow-based monitoring for Magic Transit on-demand customers. This feature allows customers to send NetFlow or sFlow data from their routers to Cloudflare for analysis. Cloudflare can then detect volumetric DDoS attacks and notify customers via email, webhook, or PagerDuty. This enables customers to activate Magic Transit for protection, either manually or automatically, minimizing the time to mitigation.

2/19/2021

This post introduces the integration of Hybrid Public Key Encryption (HPKE) into Cloudflare's Firewall Rules feature. This allows Enterprise users to securely debug Firewall Rules by viewing encrypted request payloads that matched a rule. The implementation leverages HPKE for client-side encryption and decryption, ensuring that sensitive data is only accessible to the user and not Cloudflare itself. This enhances the debugging capabilities of the WAF, providing greater transparency and control to users.

2/9/2021

This post details the application of Cloudflare's website security and threat management capabilities, specifically WAF and DDoS protection, to election-related websites during the 2020 U.S. election. It highlights the success of Project Galileo and the Athenian Project in protecting these critical infrastructure sites from over 10 million attacks, demonstrating the effectiveness of these services in ensuring the integrity of the electoral process.

1/27/2021

This post details a specific phishing campaign that exploited concerns over COVID-19 vaccine availability. It analyzes the attacker's techniques, including display name spoofing, SMTP HELO command manipulation, the use of domains without email authentication protocols, and the compromise of legitimate IPs. The post also examines the phishing website's infrastructure, including the use of newly registered domains (NRDs) and cPanel, and the process.php script used to exfiltrate victim data. It highlights how these advanced techniques bypassed traditional defenses like Microsoft Office 365's native filters, necessitating more sophisticated detection methods.

1/22/2021

This post introduces 'Project Fair Shot', a free offering of Cloudflare's new 'Waiting Room' service to government and medical organizations responsible for COVID-19 vaccine distribution. The Waiting Room service, previously in development for managing demand for scarce items, was rapidly deployed to prevent vaccine registration websites from crashing under high traffic loads. This demonstrates an extension of Cloudflare's traffic management capabilities to critical public services during times of high demand.

1/22/2021

Introduced Cloudflare Waiting Room, a new product built on Cloudflare's edge network and Workers. It protects origin servers from overwhelming demand by placing incoming requests into a virtual queue. The system leverages Workers and Durable Objects for a no-code setup, automatic enablement, and dynamic outflow. It syncs with global demand to determine when to activate the waiting room, ensuring low latency and accurate estimated wait times. The setup involves configuring a hostname, maximum active users, new users per minute, and session duration, with options for default or custom branding.

1/22/2021

This post details network-layer DDoS attack trends observed in Q4 2020. It highlights an increase in large DDoS attacks (over 500Mbps and 50K pps), a 3-10x increase in protocol-based attacks, and a significant rise in attack durations exceeding 24 hours. Specific attack vectors like NetBIOS, ISAKMP, and SPSS saw substantial increases. The post also analyzes global DDoS activity, noting higher percentages of attack traffic relative to non-attack traffic in Mauritius, Romania, and Brunei, and discusses potential geopolitical or societal factors influencing these trends. A unique 'Beat' attack, inspired by acoustics, is also detailed.

1/14/2021

This post details several advancements in Cloudflare's web security offerings during 2020, focusing on WAF, Bot Management, and DDoS mitigation. Key technical contributions include: - WAF: Decoupling configuration from the zone/domain model for granular control, introduction of IP Lists for rule creation, upgrade of edge-logging framework for real-time security logs to SIEMs, encryption of sensitive log payloads using HPKE, and the Data Localization Suite. A new Rate Limiting engine implemented in Rust for performance and memory safety, with added HMAC functions and regex-based HTTP header/body inspection. - Bot Management: Complete rewrite of the Machine Learning engine with an increased number of features, enhanced behavioral analysis engine with histogram-based outlier scoring, development of a lightweight JavaScript element for browser fingerprinting and User Agent misrepresentation detection, and a rewrite of the CAPTCHA challenge platform. Introduction of dedicated Bot Management analytics. Deprecation of the __cfduid cookie.

1/7/2021

This post details the experience of a Fortune Global 500 company targeted by a Ransom DDoS (RDDoS) attack. It highlights the company's initial reliance on an on-demand DDoS protection service, which proved too slow to react, leading to significant network failures. Following this incident, the company onboarded to Cloudflare's Magic Transit, an automated always-on DDoS protection service for network infrastructure. The post emphasizes the benefits of automated, always-on protection over reactive, on-demand services and provides recommendations for organizations to prepare for similar attacks, including utilizing automated DDoS protection, building threat models with vendors, and educating employees.

12/22/2020

This post details the 'Beat' attack, a unique ACK DDoS attack inspired by acoustic beat phenomena, which targeted a Magic Transit customer. It explains the mathematical basis of the attack's wave-shaped packet rate, reverse-engineers the attacker's likely equation, and describes how Cloudflare's 'flowtrackd' system, a unidirectional TCP state tracking machine, detected and mitigated the attack by identifying out-of-state ACK packets. This highlights the challenge of stateful TCP attacks in asymmetric routing topologies and the necessity of custom software solutions like flowtrackd for effective mitigation.

12/21/2020

Introduced identity-based policies in Cloudflare Gateway, allowing administrators to create rules based on user attributes (username, email, group name/email/ID) integrated with Cloudflare Access and identity providers. This enables fine-grained rule enforcement and user-level visibility in Gateway HTTP logs for auditing and incident investigations. Also announced integration with Cloudflare Isolated Browser for enhanced security against zero-day threats.

12/18/2020

This post details Cloudflare's analysis of the SUNBURST malware's Domain Generation Algorithm (DGA), uncovering a novel technique where hostnames are split across multiple DNS queries. Cloudflare identified how these fragmented queries are reassembled using XOR operations on their headers, revealing a previously unknown quirk in the malware's communication strategy. This analysis contributes to Cloudflare's ongoing efforts in threat intelligence and the development of advanced security measures to detect and neutralize sophisticated malware.

12/16/2020

This post details the analysis of DNS query traffic to malicious hostnames associated with the SolarWinds Orion compromise, observed through Cloudflare's 1.1.1.1 resolver. It highlights the use of Domain Generation Algorithms (DGAs) for C2 server discovery and data exfiltration, and the observed trends in query volume, subdomain generation, and geographic distribution of the attack. It also outlines Cloudflare Gateway's role in blocking these C2 domains and assisting customers in identifying potential compromises.

12/11/2020

Introduced encrypted WAF matched payload logging using Hybrid Public Key Encryption (HPKE). This feature allows customers to provide their own public key (or generate a key pair) to encrypt sensitive parts of requests that trigger WAF rules. The encrypted payloads are logged as base64 blobs in the metadata field and can be decrypted client-side via the dashboard or using a command-line utility with the customer's private key. This enhances user privacy by ensuring only the customer can decrypt the matched payload data.

12/11/2020

This post details a new wave of Microsoft SharePoint phishing campaigns that leverage COVID-19 restrictions to steal victim login information. The campaign utilizes cloud computing services for hosting credential harvesters and abuses reputable email providers like SendGrid to bypass traditional email security gateways. The spoofed login pages are hosted on platforms like AWS, Google App Engine, and Firebase, and are designed to closely mimic legitimate Microsoft login pages. The analysis includes details on the JavaScript used to extract victim emails from URLs and the methods used to exfiltrate credentials. Indicators of compromise for malicious links and sites are provided.

12/11/2020

This post introduces the emerging threat of quantum computing to internet security, specifically its potential to break current cryptographic algorithms like RSA. It highlights Cloudflare's proactive engagement in researching and preparing for post-quantum cryptography, including participation in NIST's standardization efforts, conducting TLS experiments with post-quantum algorithms, and developing high-speed implementations in their CIRCL library. The post signals Cloudflare's commitment to integrating post-quantum cryptography into its internal services and offering it to customers as standards emerge, thus extending its threat management capabilities to future cryptographic landscapes.

12/9/2020

This post details the deprecation of the __cfduid cookie, which was previously used as one signal in Cloudflare's bot detection machine learning models. The cookie's value was derived from an MD5 hash of various user attributes, but it did not tie a cookie to a specific person. Cloudflare is transitioning away from this cookie to enhance privacy, relying on other signals and evolving its bot detection algorithms to not require end-user IP addresses.

12/8/2020

Introduces Encrypted Client Hello (ECH) as a successor to Encrypted SNI (ESNI). ECH encrypts the entire TLS handshake, protecting sensitive metadata like SNI and ALPN from network observers. It builds upon the lessons learned from ESNI and TLS 1.3's handshake encryption attempts, addressing key distribution challenges and the need for handshake parameters essential for authentication to be sent in the clear. ECH aims to enhance privacy and lay the groundwork for future security and performance features in TLS.

12/8/2020

This post introduces and explains the OPAQUE and PAKE cryptographic protocols as a solution to the inherent security vulnerabilities of traditional password-based authentication. It details the problems with password storage and transmission, including cleartext handling on servers, salted hashing, and rainbow tables. The post then elaborates on the principles of Password-Authenticated Key Exchange (PAKE) and its asymmetric variant (aPAKE), highlighting how OPAQUE enables password-based authentication without the server ever seeing plaintext passwords, thus improving security against data breaches.

11/18/2020

This post details network-layer DDoS attack trends observed in Q3 2020, noting a 4x increase in attacks compared to Q1. It highlights the dominance of SYN, RST, and UDP floods, alongside a surge in protocol-specific attacks like mDNS, Memcached, and Jenkins DoS. The analysis covers attack size (bit rate and packet rate), duration, common attack vectors, and geographical distribution, emphasizing the importance of automated, real-time defense mechanisms.

11/13/2020

This post introduces the `origin-ca-issuer`, an extension for cert-manager that integrates with Cloudflare Origin CA. This allows for automated creation and renewal of TLS certificates for domains managed by Cloudflare, specifically for applications deployed within Kubernetes. This enhances the security and manageability of origin servers by simplifying TLS certificate lifecycle management, which is a crucial component of overall website security and threat management.

11/9/2020

This post details a specific phishing campaign that leverages Bazar and Buer malware, distributed via Trickbot. It analyzes the social engineering tactics used, the decoy mechanisms (Google Docs, Constant Contact), and the malware's payload decryption and anti-reversing techniques (RC4 cipher, 'dave' signature for custom packer). It also discusses the operational resilience of such malware operations despite disruption efforts by security organizations.

11/7/2020

Introduced DDoS Insights & Trends card for dynamic analysis of attack trends over time, including number of attacks, attack traffic percentage, maximum attack rates, mitigated bytes, main attack origin country, and attack duration. Added Group-by Filtering to the main time series chart, allowing users to customize the Y-axis by criteria such as IP protocols, TCP flags, and source country for easier identification of traffic anomalies. Expanded Network Analytics dashboard to Spectrum customers on Enterprise plan, providing visibility into Layer 3/4 traffic patterns and DDoS attacks for configured TCP/UDP applications, including attack size, vectors, source location, and permitted traffic. Introduced real-time alerts for DDoS attacks on configured services. Added CSV export, zoom-in feature for time series charts, drop-down view for average rate and total volume, increased Top N views for source and destination values, and addition of country and data center for source values.

10/29/2020

This post introduces Bot Analytics, a new tool that visualizes automated traffic reaching a website. It allows users to see traffic broken down by bot score, understand the distribution of bot scores, and examine the detection engines responsible for scoring. The post details how to use the tool to identify bot attacks by analyzing IP addresses, user agents, and ASNs, and suggests setting thresholds for challenging or blocking suspicious traffic. It also notes that Enterprise sites without Bot Management can see a real-time snapshot of their bot traffic.

10/21/2020

This post introduces the Cloudflare Radar 2020 Elections Dashboard, a public-facing tool that provides real-time insights into traffic and cyberattack trends targeting US election and campaign websites. It highlights Cloudflare's proactive protection efforts through the Athenian Project and Cloudflare for Campaigns, and uses the dashboard to demonstrate that, as of the publication date, cyberattacks have not significantly impacted these critical websites, with observed attack traffic being lower than in previous elections. This post showcases Cloudflare's commitment to ensuring the stability and security of democratic processes by making relevant data publicly accessible.

10/20/2020

This post analyzes bot attack trends from January to July 2020, categorizing bot traffic into Verified, Definitely Automated, Likely Automated, and Likely Human. It provides global and regional breakdowns of bot traffic, examines daily and weekly fluctuations, and discusses the impact of the COVID-19 pandemic on bot activity. The post also details Cloudflare's bot scoring system and challenge mechanisms.

10/20/2020

This post highlights the critical security risks associated with expired domain registrations for election-sensitive organizations. It details specific instances of election-related domains expiring and the potential for these expirations to be exploited for phishing attacks and disruption of voter information. Recommendations include proactive domain renewal and adherence to email security best practices outlined in previous reports.

10/19/2020

This post details a customer success story where Cloudflare's Bot Management solution was implemented for an online property portal. The solution successfully reduced scraper bot traffic and significantly decreased false positives, improving the user experience by reducing unnecessary challenges for legitimate users. The customer also benefited from consolidating their bot management with Cloudflare's existing DDoS and WAF offerings.

10/17/2020

Introduces Cloudflare Intrusion Detection System (IDS) as a new product integrated with Cloudflare One. IDS analyzes entire network traffic (internal and external) for suspicious behavior beyond static firewall rules, leveraging traffic shape and traffic inspection. It learns from global attack patterns and external threat feeds, offering offload of CPU-intensive IDS tasks to Cloudflare's network. Remediation is simplified via one-click blocking of detected intrusion attempts.

10/16/2020

Introduced Magic Firewall, a network-level firewall delivered through Cloudflare's global network to secure enterprise environments including remote users, branch offices, data centers, and cloud infrastructure. Magic Firewall integrates with Cloudflare One and Magic Transit, enabling self-service configuration of static Layer 3 & 4 mitigations using Wireshark syntax. It aims to replace on-premises firewall appliances by pushing filtering capabilities to Cloudflare's edge data centers, reducing latency and providing a unified view of network traffic.

10/15/2020

Introduced Cloudflare Browser Isolation, a new capability that runs browser sessions in sandboxed environments within Cloudflare data centers. This approach sends only draw commands to the user's device, enhancing security by preventing threats from reaching the endpoint. The service is designed to be low-latency and compatible with any HTML5 compliant browser.

10/14/2020

Introduced Cloudflare One Intel, a platform that converts network data into actionable insights for network and security operations. This includes two new features within Cloudflare Gateway: DNS tunneling detection and domain insights. DNS tunneling detection uses machine learning to identify anomalous DNS request patterns and blocks associated hostnames. Domain insights provide administrators with a comprehensive breakdown of site information by linking to Cloudflare Radar Domain Insights.

10/14/2020

Introduced L7 HTTP traffic filtering capabilities to Cloudflare Gateway, allowing for granular policy enforcement based on URL, path, query string, HTTP method, response code, file type, MIME type, and security/content categories. Integrated Cloudflare Gateway with the Cloudflare WARP desktop client to provide secure, performant connections for distributed workforces, eliminating the need for backhauling traffic to a centralized security boundary. This enables enterprise-level security directly from the Cloudflare edge.

10/13/2020

This post details advanced phishing tactics observed during Amazon Prime Day, including the use of newly registered domains (NRDs), abuse of legitimate services like Sniply for hosting malicious content, and dynamic URL generation to evade detection. It highlights specific patterns in sender email addresses and malicious links, and describes the multi-step victim journey in a phishing attack that aims to steal credit card details and personally identifying information (PII). The analysis also uncovers unique artifacts within the attacker's code, such as specific div class naming conventions and profanity-laced code, which can aid in future attribution.

10/6/2020

This post details a sophisticated phishing campaign leveraging stolen Political Action Committee (PAC) email content and compromised legitimate email accounts to deliver the Emotet banking trojan. The campaign bypasses traditional security by using valid DMARC, DKIM, and SPF records, and employs techniques like display name spoofing. The malware delivery mechanism involves a Microsoft Word document with VBA macros that execute obfuscated PowerShell commands to download Emotet from compromised WordPress sites. Indicators of compromise include specific compromised sender email addresses, IP addresses, domains, Emotet websites, attachment hashes, file names, and PowerShell executable names.

10/5/2020

Introduced real-time DDoS attack alerts for all Cloudflare customers on paid plans. Alerts are delivered via email (Pro, Business, Enterprise) and PagerDuty (Business, Enterprise). Two types of alerts are available: HTTP DDoS alerts (for WAF/CDN) and L3/4 DDoS alerts (for Spectrum, Spectrum BYOIP, Magic Transit, coming soon). Alert policies can be created in the Cloudflare dashboard, providing details on attack detection, mitigation time, type, max rate, and target, along with links to view the attack and provide feedback.

10/1/2020

Introduced API Shield, a new offering for API security. API Shield combines client certificate-based identity (mutual TLS) with schema validation to enforce a positive security model for APIs. It simplifies client certificate issuance via a hosted PKI and allows for blocking requests that do not conform to defined API schemas. The post also details a demonstration using Cloudflare Workers and Workers KV to secure an IoT temperature sensor API.

10/1/2020

This post introduces beta support for proxying gRPC traffic through Cloudflare. This involved changes to the request processing pipeline to identify gRPC traffic, adding functionality to the WAF to understand gRPC, and enabling HTTP/2 connections to customer origins for gRPC traffic. This allows Cloudflare's security, reliability, and performance features to be applied to gRPC APIs.

9/24/2020

This post details significant performance optimizations made to Cloudflare's Wirefilter engine, which powers Firewall Rules and is planned for broader use in products like the Web Application Firewall (WAF). It describes the development of a performance measurement framework using hardware counters and the `perf_event_open` API, inspired by Rust compiler benchmarks. The post highlights optimizations to the `contains` operator by leveraging specialized substring search algorithms, inspired by Rust's regex library, and discusses strategies for making benchmarks faster and more representative, such as deduplication, sampling, and partitioning. This directly contributes to the evolution of Cloudflare's WAF by improving the underlying engine's speed and efficiency.

9/23/2020

This post details a new phishing campaign that uses GDPR compliance as a lure to harvest credentials. It analyzes the technical aspects of the attack, including sender spoofing techniques (both visible FROM and envelope MAIL FROM), the use of Virtual Private Servers (VPS) for anonymity, and the exploitation of a compromised WordPress site for hosting the credential harvesting page. The analysis includes specific IP addresses and URLs used in the campaign, as well as the observed missteps by the attacker (e.g., Gmail account in MAIL FROM, 'Disposition-Notification-To' header) and their subsequent rectifications. It also discusses the use of SMTP HELO commands to spoof legitimate domains and bypass legacy security solutions. The post recommends employee education on phishing and the use of dedicated security solutions like Cloudflare's email security services.

9/18/2020

Introduced an open-source Go library, 'rakelimit', for UDP service flood mitigation. The framework utilizes eBPF socket filters to analyze traffic patterns, employing hierarchical heavy hitters and CountMin sketches to identify and rate-limit attack traffic based on source/destination addresses and ports. It addresses challenges of spoofed IPs and IPv6 scalability by using probabilistic algorithms and a two-dimensional hierarchical structure for addresses and ports. The implementation uses fixed-point arithmetic to overcome BPF's lack of floating-point support.

9/17/2020

This post introduces a significant enhancement to website resilience by detailing the partnership between Cloudflare's Always Online service and the Internet Archive. It explains how Always Online, originally developed to combat frequent downtime for early customers, now leverages the Wayback Machine to serve archived content when an origin server is unreachable. This partnership not only improves the user experience during outages but also contributes to the Internet Archive's mission of preserving web content and expands the archive's reach.

9/16/2020

This post details the automatic detection and mitigation of a 654 Gbps UDP-based DDoS attack generated by the Moobot botnet, targeting a Magic Transit customer. It highlights the effectiveness of Cloudflare's Gatebot and dosd systems in mitigating volumetric attacks without human intervention, leveraging the global network capacity of over 42 Tbps and Anycast routing. The post also describes Moobot's self-propagation and synchronized attack capabilities, and the data collection methods used by Cloudflare's DDoS protection systems.

9/9/2020

This post details a sophisticated phishing campaign impersonating the US Small Business Administration (SBA) to steal financial details. It highlights the use of newly registered domains (NRDs), spoofed sender addresses, and a seemingly legitimate PDF form to trick victims. The analysis includes technical details on email header manipulation (HELO command), NRD registration information, and the PDF's creation properties (Skia engine) as indicators of compromise. The post also outlines Area 1 Security's (now Cloudflare) advanced techniques for detecting such threats, including analysis of NRDs, domain obfuscation, look-alike domains, lexical analysis, and header validation (SPF, DKIM, DMARC). Recommendations are provided for users to protect themselves from SBA-themed phishing attacks.

8/27/2020

This post details a specific phishing campaign that uses Agent Tesla malware, disguised as a face mask manufacturer, to target companies. It analyzes the campaign's social engineering tactics, evasion techniques (rotating IP addresses, modifying malware hashes, exploiting email authentication flaws), and the malware's functionality (keylogging, information stealing via SMTP). It also highlights the limitations of legacy security vendors and traditional AV, emphasizing the need for advanced, real-time detection like that provided by Area 1 Security's ML/AI technology.

8/17/2020

This post details the application of Cloudflare's Web Application Firewall (WAF) and threat analysis to election-related websites. It identifies trends in DDoS attacks against political campaigns and SQL injection attempts against government election sites, and highlights the effectiveness of Cloudflare's WAF in mitigating these threats. It also discusses the Athenian Project and Cloudflare for Campaigns initiatives, which provide security protections to election websites and political campaigns.

8/5/2020

This post details the significant increase and acceleration of network-layer (L3/4) DDoS attacks observed in Q2 2020, doubling from the previous quarter. It highlights the emergence of some of the largest attacks ever recorded on Cloudflare's network, increased attack vector diversity, and greater geographical distribution. The post also analyzes attack characteristics such as size (both bit and packet rates), duration, and common attack vectors like SYN floods, while emphasizing Cloudflare's automated mitigation capabilities through Gatebot and dosd.

8/4/2020

This post introduces Cloudflare Network Interconnect (CNI), a new capability that allows direct, private interconnection between customer on-premise networks and Cloudflare's global network. CNI enhances existing security and performance features by providing dedicated on-ramps to Cloudflare's network, bypassing the public internet. This improves performance for CDN and Workers, and significantly enhances security for Magic Transit and Cloudflare Access by reducing threat exposure and increasing reliability through private connectivity.

7/26/2020

This post, originally from Area 1 Security before their acquisition by Cloudflare, highlights significant phishing vulnerabilities among U.S. state and local election administrators. It underscores the critical need for advanced email security controls, recommending an end to the use of vulnerable email servers like Exim and personal email accounts for official duties, and advocating for a transition to cloud email infrastructure. This contributes to the broader theme of website security by emphasizing the foundational importance of secure email communications as a primary attack vector.

7/22/2020

Introduced IP Lists, a new data structure for managing lists of IPs, ASNs, or countries. IP Lists can be used within Firewall Rules to enforce network-level access controls. Key improvements over legacy IP Access rules include support for arbitrary IP prefix lengths, flexible order of evaluation with Firewall Rules, account-level storage for cross-zone reusability, and bulk uploading via CSV or API. Planned enhancements include increased quotas, additional list types (Country, ASN), expiring list entries, and managed lists.

7/20/2020

This post details a specific phishing campaign that utilized typosquatting to impersonate the Bill & Melinda Gates Foundation. It analyzes the malicious domain 'gatesfoundatlon[.]com', its creation date, and its SPF record. The post also references a related Twitter hack and highlights Area 1 Security's capabilities in detecting such threats through proactive web crawling and early identification of attacker infrastructure.

7/14/2020

Introduced flowtrackd, a new software-defined DDoS protection system for Magic Transit that implements unidirectional TCP flow tracking. This system uses a state machine to analyze ingress traffic and determine whether to forward or drop TCP packets based on connection state, enabling mitigation of complex TCP-based DDoS attacks that were previously challenging due to the lack of bidirectional visibility. This complements existing stateless and bidirectional stateful mitigation methods.

7/9/2020

This post details the automatic mitigation of a 754 million PPS DDoS attack using Cloudflare's Gatebot and dosd systems. It explains the attack vectors (SYN floods, ACK floods, SYN-ACK floods) and the distinction between bit-intensive, packet-intensive, and request-intensive DDoS attacks. It highlights the use of BGP Anycast for global traffic distribution, kernel-level packet dropping for efficiency, and L4 load balancing with Unimog to handle massive packet rates without manual intervention.

7/8/2020

This post introduces Linux seccomp as a powerful tool for sandboxing applications without writing code. It explains system calls and how seccomp allows applications to declare their intended system call usage to the kernel, with the kernel terminating or signaling violations. The post demonstrates this with a C code example, showing how to prohibit the 'uname' system call and return a custom error code, effectively preventing arbitrary code execution and enhancing security.

7/7/2020

This post details the deployment of a new managed WAF rule (100315) to protect Cloudflare customers against the F5 BIG-IP TMUI RCE vulnerability (CVE-2020-5902). It explains the vulnerability, the attack patterns observed (e.g., `/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp`), and the mitigation strategy using a regular expression (`.*\.\.;.*`) to block malicious URLs. It also guides users on how to manage this rule within the Cloudflare WAF.

7/1/2020

This post details performance improvements to the WAF engine. Key contributions include: 1. Transitioning from PCRE to RE2 for regular expression matching, improving execution time predictability. 2. Implementing a regex cache to manage memory consumption. 3. Optimizing rule execution by introducing pre-filtering checks and leveraging memoization to cache intermediate function results. 4. Rewriting over 40 rules to improve cache hit rates and efficiency. 5. Observing a 40% reduction in average WAF request processing time and a 4.3% drop in edge CPU consumption. 6. Announcing plans to port the WAF to the wirefilter execution engine.

5/15/2020

This post analyzes network-layer DDoS attack trends for Q1 2020, noting a rise in smaller, shorter attacks (under 10 Gbps, under 1 million pps, 30-60 minutes duration) attributed to DDoS-as-a-service and the ROI for attackers. It also highlights the persistence of larger attacks (up to 550 Gbps) and a decrease in attacker persistence compared to Q4 2019. The analysis details top attack vectors (SYN, ACK, CLDAP) and observes an increase in attacks during the COVID-19 crisis, with a surge in large-sized attacks in late March. Cloudflare's mitigation strategies are discussed in relation to these trends, emphasizing rapid Time To Mitigate SLAs, distributed architecture, and massive network capacity.

5/6/2020

This post introduces the Cloudflare Bot Management platform, detailing its product and technical requirements. It explains the concept of 'The Score' as a unified metric for bot detection, ranging from 0 (bot) to 100 (human). The post outlines the architecture, highlighting the use of microservices, Kafka, ClickHouse, Postgres, Redis, and Ceph for data processing and storage. It also details the Edge Bot Management module's real-time detection capabilities, producing fields like `cf.bot_management.score`, `cf.bot_management.verified_bot`, and `cf.bot_management.static_resource`, as well as the `cf_bm` cookie and JS challenges.

4/30/2020

This post details the evolution of DDoS attacks, noting the rise of frequent, smaller network-level attacks (under 10 Gbps) and the continued prevalence of large volumetric attacks (over 500 Gbps). It highlights Cloudflare's massive network capacity (35 Tbps), globally distributed architecture with full DDoS mitigation in 200 cities, fast time to mitigation (under 10s), seamless integration with other security products, and unmetered/unlimited mitigation. It also references Gartner's report on DDoS Cloud Scrubbing Centers, where Cloudflare received the most 'High' ratings.

4/24/2020

This post introduces the ability to stream specific Firewall Events directly to SIEM platforms using Cloudflare Logs and Logpush jobs. Previously, users had to ingest all request logs and filter them client-side, which was costly and inefficient. This new feature allows for targeted delivery of security-related events, arriving much faster (within 60 seconds) and reducing the volume of data processed by SIEMs and security teams. The post also provides a practical guide on setting this up using Terraform and Sumo Logic.

4/21/2020

This post details the deployment of Cloudflare Gateway for DNS filtering on a home network using a Raspberry Pi, Pi-hole, and DNS over HTTPS (DoH). It explains how to configure Gateway locations, enable DoH in browsers (Chrome, Firefox), and set up a Raspberry Pi as a DNS and DHCP server with Pi-hole and dnscrypt-proxy to route all network DNS queries through Cloudflare Gateway.

4/13/2020

This post introduces Cloudflare Spectrum as a way to extend DDoS protection and traffic acceleration to non-HTTP protocols like SSH, RDP, and Minecraft for Pro and Business plan customers. This marks an expansion of Cloudflare's security and performance offerings beyond traditional web traffic to include critical server management and gaming applications, addressing the need for reliable and performant access to these services, especially during periods of increased remote work and online gaming.

4/10/2020

This post details the evolution of Cloudflare's DDoS mitigation strategies in response to shifting attack trends. It introduces 'dosd', a decentralized, edge-analyzed, edge-enforced DDoS mitigation system designed to detect and mitigate smaller, localized attacks rapidly (0-3 seconds). It also introduces 'IP Jails', a Gatebot capability that efficiently mitigates rate-intensive HTTP DDoS attacks by dropping connections at Layer 4 instead of Layer 7, significantly reducing CPU, memory, and bandwidth consumption. The post provides examples and metrics demonstrating the effectiveness of these systems in handling both L3/L4 and L7 DDoS attacks.

4/8/2020

This post details the migration from Google's reCAPTCHA to hCaptcha for CAPTCHA challenges. The rationale includes addressing customer privacy concerns related to Google's data usage, overcoming regional blocking issues (e.g., in China), and avoiding significant cost increases from Google's new charging model. The post highlights the benefits of hCaptcha, including its privacy-focused data handling, performance, accessibility features, support for Privacy Pass, and global availability. It also explains how Cloudflare leveraged its Workers platform to reduce hCaptcha's operational costs and negotiated a payment model. The post breaks down the usage of CAPTCHAs across various Cloudflare features like Firewall Rules, Bot Management, IP Firewall, Security Level, and DDoS protection, noting that free customers and paying customers utilize CAPTCHAs with roughly even distribution. Finally, it provides channels for users to report issues with the new implementation and reiterates the ongoing effort to minimize CAPTCHA usage.

4/6/2020

This post delves into the intricacies of Linux's 'conntrack' subsystem, a critical component for stateful firewalling and network security. It explains how 'conntrack' tracks network connections and highlights the potential for performance degradation and packet loss when the 'conntrack' table becomes full. The post details experimental methods for testing 'conntrack' behavior, demonstrating that exceeding its capacity can lead to silent packet drops and even application errors like EPERM, without explicit firewall rules. This deep dive into low-level network behavior is crucial for understanding and optimizing the performance and reliability of Cloudflare's security infrastructure.

4/1/2020

This post introduces support for security keys as a two-factor authentication (2FA) method for Cloudflare user accounts, leveraging the Web Authentication (WebAuthn) protocol. It explains the WebAuthn protocol, its advantages over other 2FA methods (resistance to SIM swapping, phishing, and ease of use), and its privacy guarantees. The implementation allows users to register hardware security keys or use built-in biometrics for authentication.

3/27/2020

This post announces that Cloudflare's Content Delivery Network, Cloudflare Access, and Time Service have been certified under PCI DSS. It details how these services help customers meet specific PCI DSS requirements: WAF for requirement 6.6, Access for requirement 8.1.8 (session timeouts), and Time Service for requirement 10.4.3 (accurate audit logging). It also highlights the support for TLS 1.3, exceeding requirement 4.1.

3/12/2020

Introduced secure DNS filtering capabilities within Cloudflare Gateway, a product within the Cloudflare for Teams offering. This feature leverages the global network and the speed of 1.1.1.1 to block threats like malware and phishing by checking DNS queries against threat intelligence and categorized domains before they are resolved. The implementation avoids traffic backhauling, offering a faster and more scalable security model compared to legacy hardware firewalls.

3/3/2020

This post details the integration of Tala's client-side security solution with Cloudflare Workers. Tala's "web module" capabilities are deployed serverlessly via Cloudflare Workers, allowing for instantaneous activation of enterprise-grade website security from Cloudflare's edge locations. The Tala Service Worker parses HTML content and inserts security controls like CSP, SRI, and HSTS, and periodically polls the Tala cloud service for policy updates. This integration aims to combat client-side attacks like Magecart and XSS without impacting website performance or requiring application code changes.

1/12/2020

This post details how Cloudflare Access can be used as an identity proxy to protect administrator portals of third-party devices like Citrix NetScaler, mitigating a specific CVE by preventing unauthenticated access to login pages and administrative interfaces. It highlights the use of Argo Tunnel for secure outbound connections and the integration with the Cloudflare WAF for layered security.

1/7/2020

This post details Cloudflare's acquisition of S2 Systems Corporation and its remote browser isolation (RBI) solution. It explains the security risks inherent in web browsing, the limitations of traditional security approaches, and the advantages of RBI. The post describes how cloud-based RBI works by executing browsers in the cloud and streaming content to the endpoint, contrasting pixel-pushing with DOM reconstruction and highlighting the security and performance implications of each remoting technology.

12/18/2019

This post announces the launch of the CSAM Scanning Tool, a new feature available to all Cloudflare customers. It leverages fuzzy hashing technology, building upon existing security and threat management capabilities, to proactively identify and flag Child Sexual Abuse Material (CSAM) uploaded to customer sites. This tool aims to protect customers from legal and reputational risks associated with such content and contributes to Cloudflare's broader efforts in combating illegal online material.

12/11/2019

This post introduces three new tools to enhance origin server reliability and avoid downtime: Standalone Health Checks for proactive monitoring of origin server health, Passive Origin Monitoring for automatic email notifications when origin downtime is detected, and Zero-Downtime Failover which automatically retries requests to an alternate origin server if the primary fails, improving availability without user intervention. These features complement existing security and traffic management capabilities by focusing on the availability and resilience of the origin infrastructure.

12/9/2019

Introduced Firewall Analytics to all paid plans, increasing data retention to 30 days (90 days in coming months), and 3 days for Professional plans. Implemented adaptive sampling for real-time query results under load. Enhanced event-based logging to show all firewall events generated by a specific rule. Added Challenge Solve Rate (CSR) for each rule to help tune CAPTCHA challenges and reduce false positives. Enabled exporting of 500 events for Business and Enterprise customers. Introduced column customization for the Activity Log.

11/21/2019

Introduced Flan Scan, an open-source, lightweight network vulnerability scanner built as a wrapper around Nmap. Flan Scan enhances Nmap by integrating with the 'vulners' script to map detected services to CVEs, packaging Nmap into a Docker container for easy deployment, and enabling results to be pushed to cloud storage (GCS/S3). It also generates actionable reports structured around vulnerable services rather than individual IP addresses, improving clarity and remediation efforts. Flan Scan was used to identify and prioritize updates for outdated Apache versions on FreeIPA nodes and a leftover PostgreSQL instance.

11/20/2019

This post introduces the concept of 0-RTT connection resumption for TLS 1.3 and QUIC, highlighting its potential for faster connection establishment by allowing application data to be sent before the handshake is complete. It details the associated risks, particularly replay attacks on non-idempotent requests, and explains Cloudflare's mitigation strategies, including rejecting certain request types and using the 'Early-Data: 1' header to signal origins. The post also announces the availability of a toggle on the Cloudflare dashboard to enable this feature.

11/17/2019

This post introduces per-request logging for Cloudflare Access, allowing administrators to capture detailed audit logs of every request made to resources protected by Access. This enhances security by enabling session reconstruction in case of compromised accounts or devices, and provides standardized logs for SIEM integration. The feature leverages the Logpush platform to export these logs, including user identity via JWTs appended as request headers.

11/1/2019

This post details a multi-year project to enhance Cloudflare's resilience against memory disclosure vulnerabilities like Heartbleed and Cloudbleed. It explains the concept of process isolation and how these vulnerabilities exploit it. The core contribution is the 'Keyless Everywhere' initiative, which moves private keys out of internet-facing processes by using separate key servers (leveraging Keyless SSL and Geo Key Manager). This significantly reduces the risk of private key exposure, even if other memory disclosure bugs are found in web server applications. The post also touches on the technical implementation details, including the use of gokeyless-internal, lazy loading, and the tableflip package for graceful upgrades, and how this was applied to TLS 1.3 and Spectrum.

11/1/2019

Introduced support for Delegated Credentials for TLS, a new cryptographic protocol developed with industry partners. This feature allows for short-lived authorization keys to be pushed to edge servers, enabling faster and more reliable TLS termination compared to pull-based systems like Keyless SSL. This reduces latency and improves availability by eliminating the need for remote key operations during every TLS handshake. The implementation also opens avenues for experimenting with new authentication algorithms and post-quantum cryptography.

10/24/2019

This post details Cloudflare's response to newly disclosed Cache Poisoning Denial of Service (CPDoS) vulnerabilities. It explains the three specific attacks (HTTP Header Method Override, Oversized HTTP Headers, and HTTP Meta Characters) and outlines Cloudflare's existing mitigations, which largely prevent customer impact. It also provides specific recommendations for customers running unpatched Microsoft IIS with request filtering enabled or those using Cloudflare Workers for forced caching of 400 responses. The post reinforces Cloudflare's commitment to maintaining caching integrity and proactively defending against emerging cache attack techniques.

10/24/2019

This post details the dogfooding of Cloudflare's Magic Transit service by intentionally DDoS'ing the company's Austin office. It highlights how Magic Transit, by announcing IP prefixes via BGP and routing traffic to Cloudflare's global network edge, provides always-on DDoS mitigation and network acceleration for entire network infrastructures. The post demonstrates the effectiveness of the system's multi-layered protection, including XDP, eBPF, iptables, and dynamic rule generation by Gatebot and the newly deployed DoSD, in detecting and mitigating attacks in near real-time with minimal service degradation.

10/9/2019

This post introduces the adoption of infrastructure-as-code (IaC) practices using Terraform and Terragrunt to manage Cloudflare configurations. It details the journey of implementing a modular and declarative approach for managing various Cloudflare resources like access rules, zone settings, account members, and rate limits across multiple domains and environments. The post highlights different strategies for resource implementation (static, parameterized, dynamic) and the benefits of using modules for code reusability and maintainability, thereby enhancing the overall management and consistency of Cloudflare's security setup.

10/8/2019

This post details Cloudflare's internal security culture, including a blame-free incident reporting system, the use of HackerOne for external reporting, and a private bug bounty program. It also highlights the critical role of identity and authentication, with Cloudflare building its own solutions like Cloudflare Access, and enforcing strong password policies and multi-factor authentication (Yubikeys, TOTP, no SMS). The post emphasizes the importance of transparency in security, citing the Cloudbleed incident and subsequent detailed blog posts as examples of how openness builds trust. It also discusses the shift towards memory-safe languages like Go and Rust for software development to prevent future vulnerabilities, and the top-down commitment to security, with the CSO reporting to the CEO.

9/29/2019

Introduced a new rule (ruleId: 100166) within Cloudflare Specials Rulesets to protect against CVE-2019-16759, a zero-day Remote Code Execution vulnerability in vBulletin. This rule is automatically applied to customers with Managed Rulesets and Cloudflare Specials enabled.

9/25/2019

This post announces the public release of WARP, a mobile application designed to secure all of a phone's internet traffic using Cloudflare's global network and the WireGuard protocol. It details the technical challenges encountered during development, the rationale behind choosing WireGuard, and the privacy principles guiding the service. The post also introduces WARP+ as a premium offering that leverages Cloudflare's Argo network for enhanced speed and explains the referral program for earning WARP+ data.

9/23/2019

Introduced 'Bot Fight Mode' to the Firewall settings, which when enabled, applies three actions to detected bad bots: 1) Tarpitting with computationally intensive challenges to increase bot maker CPU costs, 2) Sharing bot IPs with Bandwidth Alliance partners for takedowns, and 3) Offsetting carbon emissions from bot activity by planting trees. Detailed the four components of Cloudflare's bot detection: identification of legitimate bots, handwritten rules, the Bot Activity Detector model, and the Trusted Client model. Also mentioned Gatebot for DDoS bot fingerprinting and Firewall Rules for granular blocking. Explained the carbon offsetting calculation based on server CO2 emissions and tree sequestration capacity.

8/22/2019

This post introduces a completely overhauled Firewall Event log for Free, Pro, and Business customers. Key improvements include a more user-friendly interface without modals, expanded details per event with 'Additional matches' for complex rule triggers, powerful freeform search capabilities across any field within an event, and the ability to scope searches to specific date and time windows. This significantly enhances self-serve capabilities for understanding and diagnosing firewall events.

8/13/2019

This post details Cloudflare's immediate protection of its customers against a set of newly disclosed HTTP/2 Denial of Service (DoS) vulnerabilities. It highlights Cloudflare's proactive security posture, rapid patching of its NGINX implementation, and the successful mitigation of these specific threats before they could impact customers. The post also serves as a notification to customers hosting services outside of Cloudflare to apply necessary security updates.

8/13/2019

This post introduces Magic Transit, a new capability that extends Cloudflare's network functions to operate at the IP layer for any IP traffic. It leverages Cloudflare's existing global network, anycast, and homogeneous server architecture to provide customers with DoS mitigation, firewalling, and routing at the edge. The implementation details highlight the use of network namespaces for isolation and control, and GRE tunneling over anycast for delivering traffic to customer networks, effectively making Cloudflare's edge their own network edge.

8/9/2019

This post introduces Certificate Transparency Monitoring, a new feature that leverages public Certificate Transparency logs to proactively alert customers about newly issued certificates for their domains. This adds a crucial layer of security by enabling early detection of potentially malicious or unauthorized certificate issuances, complementing existing WAF and threat management capabilities.

7/12/2019

This post details a major outage caused by a single, poorly written regular expression in a WAF Managed Rule that led to global CPU exhaustion. It outlines the sequence of events, the impact on services, the challenges in responding due to internal system dependencies (Access service, control panel authentication), and the eventual rollback and re-enabling of the WAF. It also discusses the deployment process for WAF Managed Rules, contrasting it with the more cautious software release process, and includes an appendix on regular expression backtracking.

7/2/2019

This post details a critical incident where a misconfigured regular expression in a new Cloudflare WAF Managed rule caused a global outage due to 100% CPU utilization across the network. It describes the simulated mode deployment, the impact on traffic (82% drop), the rapid rollback ('global termination' of WAF Managed Rulesets), and the subsequent review and re-enabling of the rules. The post emphasizes the insufficiency of existing testing processes and the commitment to improving them to prevent future incidents.

6/18/2019

This post introduces a new tool for Certificate Authorities (CAs) to enhance the security of Domain Control Validation (DCV) for certificate issuance. It details two primary BGP hijacking attack vectors (Sub-Prefix Attack and Equally-Specific-Prefix Attack) that can be used to obtain fraudulent certificates. It also discusses DNS spoofing as another method to compromise DCV. The proposed solution involves multipath domain control validation, ensuring that DCV requests are validated through multiple, independent network paths to mitigate the risks posed by network-level adversaries.

6/15/2019

This post introduces a free tier for Argo Tunnel, a service that allows users to expose servers to the internet without opening ports by creating outbound tunnels to the Cloudflare network. This significantly simplifies server security and connectivity, especially for development and testing, by reducing the need for manual DNS, network, and firewall configuration. It makes a previously paid service accessible to anyone, enhancing the overall security posture by ensuring traffic is proxied through Cloudflare's network and its security features.

6/13/2019

This post details the specific application and effectiveness of Cloudflare's existing website security features (WAF, Gatebot for DoS, Firewall Rules, Access Rules, Zone Lockdown, Rate Limiting, Security Level) in protecting Project Galileo websites from HTTP attacks. It provides quantitative data on blocked requests, rule matches, and attack frequency, illustrating the impact of these features through heat maps and line plots. The post highlights how these tools collectively provide comprehensive and automated security, ensuring the availability of critical websites.

5/28/2019

This post details Cloudflare's rapid response to CVE-2019-0604, a critical RCE vulnerability in Microsoft SharePoint. It describes the process of analyzing the vulnerability, identifying its exploitable paths (including unauthenticated external access), deploying a firewall rule (100157) in log mode for traffic analysis, and subsequently enabling default block mode to protect customers before a stable patch was widely adopted. The post also analyzes the observed reconnaissance probes and exploit attempts, highlighting the targeted nature of attacks against enterprise businesses and the importance of timely patching and access management solutions like Cloudflare Access.

4/1/2019

This post introduces WARP, a new technology integrated into the 1.1.1.1 app, which significantly enhances mobile internet security and performance. WARP acts as a VPN for all mobile traffic, encrypting unencrypted connections to Cloudflare's edge, improving performance through a UDP-based protocol optimized for mobile, and increasing reliability by recovering faster from network loss. It also addresses battery drain concerns by using an efficient protocol and minimizing radio usage. The free version of WARP is offered to make these improvements accessible, with a premium WARP+ version for enhanced speed.

3/27/2019

This post introduces BoringTun, a userspace implementation of the WireGuard protocol written in Rust. It highlights the need for a fast, cross-platform, and secure VPN solution, explaining the choice of Rust over C/C++ and Go for its memory safety and performance. BoringTun aims to provide a robust alternative to existing WireGuard implementations and contribute to the broader adoption of secure VPN technologies.

3/20/2019

This post introduces Spectrum for UDP, extending Cloudflare's DDoS protection and IP firewalling capabilities to UDP-based services. It highlights the challenges of securing UDP applications and introduces a custom 'Simple Proxy Protocol' to enable origins to retrieve client IP information, similar to the Proxy Protocol for TCP. This expands the scope of Spectrum beyond TCP to encompass a wider range of applications, including gaming and custom protocols.

3/20/2019

This post introduces the CDN-Loop header, a new standardized mechanism developed in collaboration with other CDNs to prevent request loops. It details the limitations of previous solutions like the Via header (performance issues) and ad-hoc methods using CF-Connecting-IP and X-Forwarded-For (lack of standardization, friction for valid looping). The post explains the syntax and implementation of CDN-Loop at Cloudflare, highlighting its benefits for granular loop detection and prevention of DoS attacks.

3/18/2019

Introduced MITMEngine, an open-source Golang library for detecting HTTPS interception by comparing TLS Client Hello signatures against known browser and middlebox implementations. Also introduced MALCOLM, a dashboard displaying metrics about observed HTTPS interception on Cloudflare's network. Detailed the mechanics of TLS-terminating forward proxies and reverse proxies, and explained the security implications of HTTPS interception, including weakened security, hindered TLS adoption, and potential for spoofing and data exfiltration.

3/5/2019

This post details Cloudflare's rapid response to the Drupal SA-CORE-2019-003 vulnerability. It describes the process of analyzing the Drupal patch to identify the deserialization exploit, developing WAF rules to mitigate it, and deploying these rules in simulate and then drop modes. The post highlights the speed of detection and mitigation, blocking attacks within 48 hours of the vulnerability announcement, and showcases specific exploit payloads and their impact.

3/4/2019

This post details the technical evolution leading to the creation of Cloudflare's Firewall Rules. It describes the limitations of previous single-attribute firewall features (IP Access Rules, ASN matching, CIDR blocking, GeoIP matching, Page Rules) and the challenges of combining them. The post introduces a new, unified matching engine implemented in Rust, designed to handle complex expressions with multiple attributes. It highlights the inspiration drawn from Wireshark's display filter syntax for creating a human-readable and machine-parseable DSL for defining firewall rules. The post also details the internal data structures used to represent HTTP request properties for matching.

3/1/2019

Introduced a new Firewall tab structure (Events, Firewall Rules, Managed Rules, Tools, Settings) and a new Firewall Analytics feature for Enterprise customers. Firewall Analytics provides visualization and analysis of Firewall Events to understand threat landscapes, identify and mitigate attacks, and tailor security configurations. It offers insights into event types, service breakdowns, and granular details like targeted networks, IPs, User-Agents, and Paths, enabling users to answer questions like 'Why did I have a spike in threats?' and identify both threats and false positives.

2/27/2019

This post details Cloudflare's principled approach to handling abuse reports for new products, differentiating between conduit services (CDN, proxy) and storage services. For conduit services, it outlines forwarding complaints to hosting providers and addressing service abuse (phishing, malware) at the URL/domain level. For storage services (Stream, Workers), it describes reviewing complaints and disabling access based on valid legal takedown requests, particularly for copyright infringement. It also details the principled approach to government takedown requests, emphasizing narrow application and transparency.

2/20/2019

This post introduces Cloudflare's practical application of Machine Learning (ML) to combat bot attacks, specifically credential stuffing. It outlines a three-stage framework (Business Intelligence, Standalone Machine Learning, Machine Learning Productization) for integrating ML into products. For Cloudflare, this translates to using vast network data to train ML models for bot detection, achieving high accuracy in identifying malicious traffic, and developing predictive models to proactively warn companies of potential attacks based on their risk profile.

2/2/2019

This post details the Cloudbleed incident, a critical security vulnerability involving a memory leak that exposed sensitive data. It describes the discovery of the leak, the rapid response to stop it within 45 minutes, the subsequent massive cleanup effort involving search engines, and the transparent public disclosure. The post emphasizes the challenges of unknown impact, the importance of statistical analysis of limited logs to detect exploitation, and how the incident reinforced Cloudflare's culture of openness and customer trust.

1/23/2019

This post highlights a critical aspect of website security by detailing how Cloudflare leverages its Certificate Transparency (CT) monitor, Merkle Town, to identify and track soon-to-expire and expired TLS certificates on .gov websites. It emphasizes the importance of automated certificate renewal and the role of CT logs and monitors in ensuring the integrity and trustworthiness of secure connections, especially during unexpected events like government shutdowns. The post also details technical challenges and unexpected misconfigurations found during the analysis.

1/21/2019

This post introduces the integration of Cloudflare Argo Tunnel with Mesosphere DC/OS. It highlights how Argo Tunnel provides a secure, private connection between services running on DC/OS and Cloudflare's network, enabling load balancing and access to these services without opening inbound ports. This enhances the security and manageability of multi-cloud deployments by leveraging Cloudflare's edge security features for services managed by DC/OS.

12/21/2018

This post details the first year of the Athenian Project, which provided free Enterprise-level service to over 100 US state and local government election websites. It highlights the project's success in protecting these sites from DoS attacks, SQL injection, and other threats. The post also notes the significant spikes in legitimate traffic on election days, demonstrating the value of Cloudflare's CDN for managing unpredictable traffic loads. The Web Application Firewall (WAF) successfully blocked various malicious bot scans and other attack vectors, reinforcing the need for ongoing cybersecurity vigilance. Future efforts will focus on increasing SSL/TLS adoption among these websites.

12/21/2018

Introduced the ability for customers to change the ordering of Firewall Rules, offering both drag-and-drop ordering (with a 200-rule limit) and priority numbering (using an integer between 1 and 2,147,483,647) to override the default rule precedence. This addresses feedback regarding rule execution order for complex security use cases.

12/20/2018

This post analyzes the security risks associated with partial password validation, demonstrating through simulations that it offers negligible protection against credential stuffing attacks. It highlights that this practice often indicates insecure password storage and incentivizes password reuse. The post advocates for multi-factor authentication (MFA) as a superior alternative for account security, contrasting it with the limitations of SMS-based one-time passwords.

11/28/2018

Introduced L4Drop, a new XDP-based DDoS mitigation tool that replaces the previous Floodgate kernel bypass system. L4Drop leverages eBPF to run packet filtering logic directly in the network card driver, enabling high-speed packet dropping and sampling without kernel bypass or busy polling. It includes a BPF to C compiler for easier integration of existing BPF filters and a mechanism to modify ELF files for dynamic rule enabling/disabling based on location.

11/12/2018

This post details the evolution of DDoS attack vectors observed by Cloudflare, specifically focusing on Layer 3/4 attacks. It highlights a massive 942Gbps SYN flood attributed to Xor.DDoS malware, noting its distributed nature and partially spoofed sources. The post also observes a decline in SSDP and memcached amplification attacks, while noting an increase in 'multivector' attacks that combine multiple amplification techniques to achieve high volumes. The analysis provides insights into the changing landscape of DDoS threats and Cloudflare's ongoing efforts to mitigate them.

10/25/2018

This post announces the full integration of Cloudflare Spectrum with Load Balancing. It introduces the ability to configure TCP health checks for non-HTTP applications, allowing for intelligent failover and traffic distribution based on connection status. It also details how existing load balancing features like origin weights and steering modes (failover, dynamic, geo) are now applicable to TCP traffic proxied by Spectrum, enabling customers to build scalable and reliable TCP applications.

10/23/2018

This post announces the general availability of Cloudflare's integration with IBM Cloud Internet Services (CIS) Enterprise. It highlights how Cloudflare's network, including its DDoS mitigation and WAF capabilities, is now accessible directly within the IBM Cloud user interface for enterprise customers. The post emphasizes the combined strength of Cloudflare's global network capacity and IBM Cloud's data centers in protecting applications and improving performance, as well as the benefit of waiving data transfer fees through the Bandwidth Alliance.

10/18/2018

This post details the implementation and user-facing enablement of Encrypted Server Name Indication (ESNI) in Firefox, in collaboration with Mozilla. It provides instructions on how to enable ESNI in Firefox Nightly via `about:config` and how to verify its functionality using the `encryptedsni.com` test page. It also touches upon the necessity of DNS over HTTPS (DoH) for complete privacy and discusses potential fallback mechanisms and challenges in ESNI key management and synchronization between DNS and TLS servers.

10/3/2018

Introduced Firewall Rules, a new feature allowing customers to create custom rules based on multiple HTTP request attributes (e.g., IP address, User-Agent, Threat Score, AS Number) using a Wireshark-inspired expression language. This enables flexible and granular traffic control, including pattern matching with regular expressions, and supports both positive (allowlist) and negative (blocklist) security models. New actions like 'allow' were added, and the `cf.client.bot` field was introduced to identify known good bots.

9/29/2018

This post, presented as a fictional statement, reinforces Cloudflare's commitment to secure encryption practices and robust randomness generation. It contrasts Cloudflare's secure methods (multiple sources of randomness, adherence to industry standards like AES, and avoiding custom encryption algorithms) with a fictional competitor's insecure implementation involving a single point of failure and custom encryption. It implicitly highlights the importance of secure randomness and standard encryption in preventing security breaches.

9/24/2018

This post introduces and explains Encrypted SNI (ESNI), a new privacy-enhancing feature for TLS 1.3. It details how ESNI works by encrypting the SNI extension using public-key cryptography published via DNS, preventing on-path observers from identifying visited websites. The post also highlights the importance of encrypted DNS (DoT/DoH) and DNSSEC for ESNI's effectiveness and discusses the ongoing challenge of IP address-based tracking.

9/24/2018

This post introduces and announces the launch of Encrypted SNI (ESNI), a protocol designed to fix a core internet privacy bug where the Server Name Indication (SNI) extension, used to host multiple encrypted websites on a single IP, was itself unencrypted. This allowed ISPs and others to see which websites users visited, even over HTTPS. Cloudflare, in collaboration with industry partners, has implemented ESNI across its network and is working with browser vendors like Mozilla to integrate it, aiming to make the encrypted web more private and secure.

9/20/2018

This post introduces the Cloudflare Onion Service, a new feature that enhances privacy and anonymity for Tor Browser users visiting Cloudflare-protected websites. It leverages HTTP Alternative Services and Tor's onion service protocol to establish direct, encrypted connections, bypassing exit nodes and improving security and performance for anonymous users while also enabling more fine-grained rate-limiting against malicious traffic.

9/5/2018

This post details the immediate mitigation of the Apache Struts S2-057 vulnerability by Cloudflare's Web Application Firewall (WAF). It explains the nature of OGNL expressions used in RCE payloads and how S2-057 differs from previous Struts vulnerabilities by exploiting the 'namespace' parameter. Cloudflare's WAF was updated with specific rules to block these attacks, leveraging general OGNL signature rules and targeted payload vector rules. The post also shares observed attack patterns, including probing and attempts to execute commands.

8/30/2018

This post introduces the use of Cloudflare Workers to detect and prevent data loss by inspecting the content of HTTP responses for sensitive 'canary' data. It demonstrates how Workers can be configured to block responses containing leaked sensitive information, return a static 'Blocked' response, and trigger external alerts (e.g., PagerDuty) via `event.waitUntil()` to notify of potential data breaches. It also touches upon rate-limiting responses as a secondary measure.

8/11/2018

This post details the release and significance of TLS 1.3 (RFC 8446), highlighting its substantial security and performance improvements over previous TLS versions. It explains how TLS 1.3 addresses vulnerabilities inherent in TLS 1.2 (and earlier) by removing legacy features, fixing key exchange mechanisms (like RSA key exchange), and reducing handshake latency. This directly contributes to Cloudflare's ongoing efforts to provide robust website security by adopting and advocating for the latest, most secure encryption standards.

7/26/2018

Introduced CAPTCHA and JS Challenge as new actions for Rate Limiting, allowing for more sophisticated responses to threshold violations. Added matching Header attributes in the response as a new trigger for Rate Limiting, enabling more granular control over which requests are counted towards rate limits.

7/24/2018

This post details Cloudflare's proactive efforts to drive encryption adoption (HTTPS) by developing intelligent systems like HelperBot to automate support and debugging for common SSL misconfigurations. It also introduces the SSL Test Tool, a public-facing utility powered by HelperBot-External, designed to help website owners identify and fix issues preventing them from enabling HTTPS. The post highlights the shift from reactive support to proactive outreach through emails and tools to improve internet security.

7/24/2018

This post, authored by Troy Hunt, highlights a significant milestone in the push for a secure web: Chrome 68 flagging all non-secure connections as 'Not secure.' It frames this as addressing a fundamental design flaw of the original unencrypted web and emphasizes the increasing adoption of HTTPS, citing data on its rapid growth. The post details the risks of unencrypted sites, even static ones, and positions Cloudflare as a solution for easily enabling HTTPS, which also unlocks performance benefits like HTTP/2 and Brotli. Cloudflare's note further emphasizes their commitment to democratizing modern web technologies with Universal SSL and a free SSL test tool.

6/28/2018

This post highlights the critical juncture where Chrome began flagging HTTP sites as 'Not Secure', emphasizing the importance of HTTPS adoption. It debunks common myths surrounding HTTPS deployment difficulty, necessity, and performance, showcasing Cloudflare's role in simplifying SSL certificate management and offering free, performant HTTPS through its edge network. It also details Cloudflare's solutions for individual sites and SaaS providers, and encourages users to adopt HTTPS by enabling features like 'Always Use HTTPS' and 'Automatic HTTPS Rewrites'.

6/1/2018

This post details an incident where Cloudflare's internal DDoS mitigation system, Gatebot, mistakenly identified legitimate traffic to the 1.1.1.1 DNS resolver as an attack due to a new integration with the Provision API. This led to a 17-minute outage of the 1.1.1.1 service. The post highlights the complexity of Gatebot's reactive automation stage and the importance of thorough testing when integrating new systems, especially those that interact with critical infrastructure like DNS resolvers. It underscores a lesson learned in improving internal systems and testing procedures for future mitigation efforts.

5/21/2018

Introduced new challenge actions (JavaScript Challenge, Google reCAPTCHA) for Rate Limiting, allowing for more nuanced traffic management beyond simple blocking. Added dynamic scalability for Rate Limiting by enabling matching on Origin Response Headers. Provided detailed examples and tiered rule configurations for protecting against credential stuffing, enumeration attacks, and content scraping.

5/16/2018

This post announces the general availability and default enablement of TLS 1.3 for all new Cloudflare zones, marking a significant milestone in the adoption of this improved security protocol. It details the technical challenges overcome, particularly with middleboxes, and the strategies employed to ensure compatibility. The post also highlights the increasing adoption metrics of TLS 1.3 across Cloudflare's network and reaffirms the company's commitment to its widespread use.

4/20/2018

This post details the implementation and effectiveness of a specific WAF rule (D0003) deployed to mitigate the Drupalgeddon 2 vulnerability (CVE-2018-7600). It analyzes attack patterns, including POST requests targeting the 'mail' and 'name' fields, and provides code snippets of malicious payloads. The post quantifies the rule's success by reporting over 500,000 blocked attacks in the first week and over 56,000 per day subsequently, highlighting the WAF's role in protecting against critical remote code execution exploits.

4/12/2018

This post introduces Cloudflare Spectrum, a new product that extends Cloudflare's DDoS protection, TLS termination, and IP firewall capabilities to all TCP ports and protocols, not just HTTP/S. This significantly broadens the scope of Cloudflare's security and acceleration offerings to encompass any internet-connected service, including email, file transfer, and custom protocols, addressing a previously unmet need for comprehensive protection of diverse network infrastructure.

4/12/2018

This post introduces Cloudflare Spectrum, a new feature that extends DDoS protection, load balancing, and content acceleration to any TCP-based protocol. It details the technical challenges of accepting connections on any port (1-65535) and IP address on Linux edge servers, and how these were overcome using the 'AnyIP' trick for IP address assignment and the obscure 'TPROXY' iptables module combined with the IP_TRANSPARENT socket option. This allows for binding to any port without relying on conntrack or custom kernel patches, demonstrating a novel application of Linux networking capabilities for enhanced security and flexibility.

4/5/2018

This post introduces Argo Tunnel, a new product that provides a secure, private connection between a web server and Cloudflare. It aims to replace older, more complex, and expensive methods like GRE tunnels by offering a simpler, faster, and more secure alternative. Argo Tunnel reduces the attack surface by making origin servers unroutable to the public internet and leverages Cloudflare's Argo smart routing for performance benefits. It is bundled with Argo and offers a free tier consideration.

4/3/2018

This post announces the integration of Cloudflare's security data with Google Cloud Security Command Center (Cloud SCC). It details how Cloudflare's API endpoints push data to Cloud SCC, mapping domain name information to Google Cloud assets. The Cloudflare card in Cloud SCC displays a summary of top threat origins, threat types, and WAF events. Each Cloudflare finding provides detailed information such as country source, IP source, hostname, URI, User Agent, protocol, method, action taken, and rule triggered. Users can take action on this data by logging into the Cloudflare dashboard or using the Cloudflare API.

3/29/2018

This post details the immediate addition of a new Web Application Firewall (WAF) rule (ID D0003) to the Cloudflare ruleset, categorized under 'Drupal'. This rule is designed to block requests specifically matching the conditions of the critical remote code execution exploit announced by Drupal (SA-CORE-2018-002/CVE-2018-7600).

3/27/2018

Introduced `cf-nocompress`, a proof-of-concept NGINX plugin that selectively disables compression for data identified as secret by regular expressions. This mitigates compression oracle attacks (CRIME, BREACH, TIME, HEIST) by preventing sensitive data like CSRF tokens from being added to the compression dictionary, thus preventing attackers from inferring secret content based on response length. The solution aims for transparency and minimal impact on overall compression effectiveness.

3/24/2018

This post introduces Cloudflare's role as a Certificate Transparency (CT) log operator and details their publicly accessible dashboard, Merkle Town. Merkle Town provides insights into the health, performance, and statistics of CT logs, including certificate breakdown by type, root CAs, global issuance rates, and log utilization by large CAs. This contributes to the broader website security narrative by focusing on the underlying infrastructure that supports SSL certificate trust and transparency.

3/23/2018

This post introduces Cloudflare's support for Certificate Transparency (CT) by launching Nimbus, a free public CT log, and Merkle Town, a dashboard for exploring the CT ecosystem. It explains the importance of CT in improving online security by making certificate issuance accountable, addressing the risks of mis-issued certificates due to Certificate Authority (CA) misbehavior or breaches, and detailing the roles of log operators, auditors, and monitors within the CT ecosystem. The post also outlines how CT is integrated into the web PKI, including the use of Signed Certificate Timestamps (SCTs) and browser requirements for CT qualification.

3/12/2018

This post details the deprecation of TLS 1.0 and 1.1 on api.cloudflare.com and the Cloudflare dashboard, moving towards a mandatory TLS 1.2 or higher standard. It outlines the timeline for these changes, including warnings, a brownout period, and permanent disabling. The post also introduces upcoming features like 'Minimum TLS Version' controls and enhanced TLS analytics for customer traffic, allowing users to enforce modern TLS versions for their own sites.

3/6/2018

This post delves into the root cause of large-scale Distributed Denial of Service (DDoS) attacks, identifying IP spoofing as the primary enabler. It explains how IP spoofing works in both direct and amplification attacks, illustrating the technical challenges and internet design properties that make it possible. The post details how Cloudflare analyzes spoofed IP patterns and discusses solutions like BCP38 and the role of internet carriers in mitigating these threats, thereby expanding the understanding of network-level vulnerabilities within the security thread.

2/27/2018

This post details a newly discovered and significant amplification attack vector using the memcached protocol over UDP port 11211. It explains the mechanics of such attacks, highlights the massive bandwidth generated (up to 260Gbps observed), identifies common sources of vulnerable memcached servers (OVH, Digital Ocean, Sakura), and provides actionable advice for memcached users, system administrators, and ISPs to mitigate these threats. It also emphasizes the ongoing challenge of IP spoofing and the need for developers to be cautious with UDP protocols.

2/21/2018

This post details Cloudflare's technical contribution to the 'Have I Been Pwned' service by developing an API that uses k-anonymity and range queries to validate leaked passwords. This approach allows clients to check if a password has been breached without sending the complete unsalted password hash to the service, thereby enhancing user privacy and security. It also highlights the broader context of password security issues like credential stuffing and the limitations of traditional password composition rules.

2/16/2018

This post details Cloudflare's strategies for protecting user credentials, including secure password storage using bcrypt, robust API key generation and secure storage, comprehensive audit logging for sensitive database access, and ensuring all connections are made over HTTPS. It also introduces enhanced user interface security measures such as CAPTCHAs for viewing API keys and IP-based alerts with multi-factor authentication for dashboard logins to combat credential theft via phishing and malicious software.

2/14/2018

This post details Google Chrome's initiative to label all HTTP sites as 'Not Secure' starting in July 2018, marking a significant step in the push for universal HTTPS adoption. It highlights Cloudflare's role in this evolution, referencing its Universal SSL offering and its position in the broader webPKI ecosystem. The post also outlines historical milestones and predicts future developments in browser security indicators, emphasizing the importance of HTTPS for user trust and security.

12/28/2017

This post delves into the performance and cost of cryptographic operations within TLS deployments at Cloudflare's scale. It provides detailed profiling data on CPU usage for various ciphersuites, public key algorithms (RSA, ECDHE, ECDSA), and hash functions (SHA1, SHA2). The analysis highlights that while modern cryptography is generally efficient, RSA remains a significant resource consumer, and it advocates for the adoption of ECDSA certificates. The post also touches upon the future of TLS in the context of quantum computing, indicating proactive research into post-quantum cryptography.

12/26/2017

This post details the challenges and technical reasons behind the delayed adoption of TLS 1.3 in major browsers. It explains the historical context of TLS version negotiation, the impact of the POODLE vulnerability and insecure downgrade attacks, and how these issues led to middlebox ossification and incompatibility with TLS 1.3's design. The post highlights the need for correct implementation of version negotiation and the role of middleboxes in hindering protocol upgrades.

12/26/2017

This post contributes to the website security and threat management thread by presenting practical cryptography challenges. It demonstrates how to crack BCrypt password hashes, explains the implications of HSTS in preventing SSL stripping attacks, and provides a detailed walkthrough of reversing AES-256 encryption. These challenges highlight the importance of understanding and implementing secure cryptographic practices within the context of web security.

12/24/2017

This post highlights the growing threat of DDoS attacks originating from compromised IoT devices and identifies two key security challenges: unreliable software updates for IoT devices and the overhead associated with traditional TLS implementations. It proposes network-level filtering as a solution for update issues and advocates for TLS 1.3, elliptic curve cryptography, and secure protocols like MQTT/CoAP with DTLS to address TLS-related challenges in IoT, thereby extending Cloudflare's security focus to the burgeoning IoT landscape.

12/14/2017

This post provides a retrospective analysis of the Mirai IoT botnet, detailing its genesis, propagation methods (default credentials), attack capabilities (DDoS techniques), and its impact on major services like Krebs on Security and OVH. It highlights the scale of the threat (hundreds of thousands of compromised IoT devices) and the collaborative research effort involving Cloudflare to understand and document this significant event. This contributes to the understanding of large-scale, botnet-driven DDoS attacks and the evolving threat landscape that Cloudflare actively manages.

12/12/2017

This post introduces a new technique for combating phishing by dynamically rewriting DMARC DNS records to reject emails originating from malicious domains that abuse Cloudflare's DNS services. It explains the underlying email authentication protocols (SPF, DKIM, DMARC) and how manipulating the DMARC policy can effectively stop phishing attempts at the email client level, adding a DNS-based email security layer to Cloudflare's threat management capabilities.

12/7/2017

This post highlights Cloudflare's recognition as a leader in DDoS mitigation by Forrester. It details the advancements in Cloudflare's DDoS mitigation capabilities, including architectural improvements for high-volume attacks, the introduction of unmetered mitigation, and the use of automated and data-driven approaches to detect and block attacks. It also emphasizes the integration of DDoS mitigation with other security and performance features.

12/7/2017

This post details Cloudflare's adoption and rollout of the Certification Authority Authorization (CAA) Resource Record standard. It explains the purpose of CAA records in enhancing SSL certificate issuance security by allowing domain owners to specify authorized Certificate Authorities (CAs). The post highlights Cloudflare's beta program for testing CAA support, its eventual removal of the beta flag for all users, and its integration with Universal SSL. It also delves into the complexities and potential issues with the CAA record processing algorithm, particularly concerning CNAME records and wildcard domains, demonstrating Cloudflare's proactive approach to supporting and refining new internet security standards.

12/6/2017

This post details Cloudflare's migration of its edge SSL connection termination stack to BoringSSL. This move enabled support for TLS 1.3 across the board, improved key negotiation with X25519 for TLS 1.2 and earlier, and introduced RSA-PSS for TLS 1.2. It also highlights internal improvements to features like Keyless SSL, distributed session ID caches, and cipher grouping, as well as the development of a more reliable OCSP stapling pipeline. The post also touches on addressing performance issues with base64 decoding in BoringSSL and maintaining support for legacy ChaCha20-Poly1305 ciphers for older clients.

12/5/2017

This post introduces the Cloudflare Warp Ingress Controller for Kubernetes, a new integration that allows Kubernetes-managed services to be securely exposed to the internet through Cloudflare's network. This extends Cloudflare's security and performance benefits (DDoS protection, WAF, global load balancing) to containerized applications, simplifying the process of connecting them to the outside world and ensuring they are protected and accelerated by Cloudflare's services. It also highlights the collaboration with StackPointCloud for seamless integration.

11/23/2017

This post details the evolving landscape of DDoS attacks, noting a significant shift from volumetric network-layer attacks (Layer 3/4) to more sophisticated application-layer attacks. It explains the mechanisms behind botnets, IoT devices, and DNS amplification as sources of attack capacity, and contrasts older mitigation priorities focused on network capacity with the new reality of application-layer threats. The post highlights Cloudflare's 'Unmetered Mitigation' policy as a response to the increasing size and sophistication of attacks, ensuring continuous service availability.

11/13/2017

This post details specific Remote Code Execution (RCE) vulnerabilities in Apache Struts (CVE-2017-5638, CVE-2017-9805) and explains how Cloudflare's Web Application Firewall (WAF) rules, such as rule 100054 in Cloudflare Specials, protect against these exploits. It also discusses SQL Injection (SQLi) attacks, providing examples of how they work and highlighting the volume of such attacks seen on the Cloudflare network, particularly against WordPress sites. The post emphasizes the role of the WAF in virtual patching these vulnerabilities to protect customers.

11/10/2017

This post investigates the performance degradation observed when using Intel's AVX-512 instruction set with cryptographic operations like ChaCha20-Poly1305. It details how dynamic frequency scaling, triggered by AVX-512 usage, can significantly reduce CPU performance, leading to a decrease in server throughput even when AVX-512 code constitutes a small percentage of the workload. The post highlights the trade-offs between using modern, high-performance ciphers and the potential for performance penalties due to hardware frequency scaling, and suggests disabling AVX-512 for general-purpose workloads if not strictly required for specific high-performance tasks.

11/9/2017

This post introduces and details the 'Privacy Pass' protocol, a novel cryptographic approach developed to improve website accessibility for users interacting with Cloudflare's network. It explains the mathematical underpinnings of the protocol, moving from blind RSA to more efficient elliptic curve cryptography and Oblivious PRFs. Privacy Pass allows users to obtain cryptographically blinded tokens after solving a challenge (like a CAPTCHA), which can then be used to bypass future challenges without revealing the user's identity to the server, thus enhancing privacy and reducing friction.

11/9/2017

This post introduces Cloudflare's support for Privacy Pass, a privacy-preserving protocol that uses zero-knowledge proofs. This initiative aims to improve the browsing experience for users of anonymity services or shared IPs by reducing the number of challenge pages they encounter. It represents an effort to balance security with user privacy and convenience, particularly for vulnerable internet users, and is part of a broader effort to make the internet more accessible.

11/6/2017

This post details the technical implementation of LavaRand, a system that uses a wall of lava lamps as a source of true randomness for cryptographic operations. It explains the concepts of true vs. pseudorandomness, the importance of randomness in cryptography, and how LavaRand integrates with Cloudflare's production systems to provide an additional layer of security by mixing entropy from physical processes with existing entropy sources.

11/6/2017

This post introduces LavaRand, a novel system that uses lava lamps as a secondary source of cryptographic randomness for Cloudflare's production servers. It explains the critical need for unpredictable randomness in cryptography, the challenges computers face in generating it, and how CSPRNGs combined with real-world unpredictable inputs (like the chaotic flow of lava lamps captured by a camera) can provide a robust solution. LavaRand serves as a 'hedge' to ensure security even if primary randomness sources are compromised, highlighting Cloudflare's proactive and layered approach to security.

10/20/2017

This post provides a plain-English explanation of SSL stripping attacks and how they exploit the transition from HTTP to HTTPS. It details the evolution of encryption protocols (SSL/TLS) and the mechanisms designed to prevent such attacks, including HTTP Strict Transport Security (HSTS) and HSTS preloading. It highlights the importance of end-to-end HTTPS and the ongoing challenges in securing web traffic against evolving threats.

10/6/2017

This post highlights Cloudflare's role in securing cloud migrations, specifically detailing how LUSH migrated to Google Cloud Platform. It emphasizes the use of Cloudflare's load balancing across cloud providers, Web Application Firewall (WAF), SSL/TLS encryption, and rate limiting as key security measures during and after migration. The post also touches upon the benefits of direct interconnections between Cloudflare and Google Cloud Platform data centers for performance and cost savings, and reinforces the importance of SSL best practices.

9/28/2017

This post introduces Cloudflare Warp (later renamed Argo Tunnel), a new security-conscious tool that allows web applications to be exposed without exposing the underlying server. It achieves this by creating a private, encrypted virtual tunnel from the Cloudflare edge to the application's origin. This effectively hides the origin server from the internet, allowing Cloudflare's edge to act as a network shield and enforce security policies before traffic reaches the server. The tool also offers side benefits like service discovery and the ability to tag tunnels for future routing configurations.

9/26/2017

Introduced Geo Key Manager, a feature that allows customers to control where their private SSL keys are stored on Cloudflare's network. This builds on Keyless SSL by hosting key servers in chosen locations, reducing complexity and latency. The architecture leverages Identity-Based Broadcast Encryption (IBBE) and Identity-Based Revocation (IBR) to provide granular control over key distribution based on regions and specific data center locations, addressing diverse regulatory and risk profile requirements.

9/26/2017

This post introduces Geo Key Manager, a new feature that allows customers to control the geographic distribution of their SSL private keys. This addresses geopolitical concerns and regulatory requirements by enabling customers to restrict key access to specific regions (e.g., U.S. Only, E.U. Only) or to Cloudflare's highest security data centers. The post also details the security requirements for these data centers and explains the performance implications of using Keyless SSL when keys are not locally accessible, highlighting the use of session resumption to mitigate latency for subsequent requests.

9/25/2017

This post details Cloudflare's architectural approach to DDoS mitigation, highlighting the shift away from traditional 'scrubbing centers' towards an integrated, network-wide solution. It explains the challenges of bandwidth, cost, and knowledge associated with scrubbing centers and presents Cloudflare's 'unmetered mitigation' strategy. This involves leveraging every server in the network for mitigation, load balancing attacks across data centers and servers, and employing custom software (iptables, EFVI) for efficient packet processing. The post also emphasizes the benefits of this integrated approach, including cost-effectiveness, always-on protection, and continuous improvement of the entire software stack through real-world attack mitigation. It also touches upon Cloudflare's commitment to open-sourcing security tools.

9/25/2017

This post introduces Gatebot, an automated mitigation system designed to handle large-scale DDoS attacks. It details the evolution from manual SRE intervention to an automated 'detection/logic/mitigation' pipeline. The post explains various mitigation techniques employed, including scattering, iptables extensions, kernel bypass with floodgate, and HTTP-layer adjustments. It highlights how Gatebot's automation improves response time, precision, and allows for consistent DDoS protection for all users, and notes the reuse of this model in other systems like the Automatic Network System.

9/25/2017

Introduced 'Unmetered Mitigation' for DDoS protection, eliminating surge pricing and customer termination regardless of attack size or plan level. This represents a significant shift in DDoS mitigation strategy, moving towards a default, unlimited service.

9/14/2017

This post introduces the emerging threat of quantum computing to current cryptographic methods and Cloudflare's proactive engagement with post-quantum cryptography. It highlights the need for new algorithms and discusses the practical implications of computing on encrypted data, including potential new functionalities for services like medical and financial data analysis. The post also touches upon the development of quantum-resistant algorithms and the ongoing efforts to integrate them into systems like TLS.

9/12/2017

This post details a study on the prevalence of HTTPS interception, finding that 4-10% of encrypted web traffic is intercepted. It explains the mechanisms of local and remote interception, how interceptors forge certificates by adding their own root CA to trust stores, and the security implications of weakened encryption. The study used TLS fingerprinting to identify interceptors and found Windows to be intercepted more often than macOS, with mobile OSes being least intercepted. Firefox showed a different distribution with mobile carrier providers being a significant source of interception due to its separate certificate store. Interceptions are attributed to security improvement efforts (antivirus, firewalls) and malicious activities (malware).

9/1/2017

This post introduces the implementation of Supersingular Isogeny Diffie-Hellman (SIDH) in Go for quantum-resistant TLS 1.3. It details the quantum threat to current cryptography, explains the principles of SIDH, and describes its integration into Cloudflare's TLS 1.3 client and the challenges of implementing high-performance cryptographic primitives in Go.

8/28/2017

This post details Cloudflare's involvement in a collaborative effort to disrupt the WireX botnet, a large-scale DDoS attack originating from Android devices. It highlights the importance of industry-wide information sharing and cooperation between security companies, CDNs, and content providers to effectively combat sophisticated threats. The post showcases Cloudflare's role in analyzing attack vectors, identifying malicious applications, and working with partners like Google to remove them, underscoring the evolution of threat management to include proactive, collaborative disruption of botnets.

7/10/2017

Introduced a redesigned, robust, and reliable OCSP stapling infrastructure that serves valid OCSP stapled responses for all connections where the certificate authority has set up OCSP, improving connection times and enabling reliable certificate revocation checking.

6/28/2017

This post details a significant 100 Gbps+ Distributed Denial of Service (DDoS) attack leveraging the Simple Service Discovery Protocol (SSDP), commonly used by UPnP. It explains how misconfigured firewalls can expose UPnP-enabled devices to the internet, allowing attackers to spoof source IPs and trigger large amplification responses from these devices. The post provides technical details on the attack, including packet analysis, reflector IP distribution, and the amplification factors achieved by SSDP, highlighting the ongoing challenge of mitigating novel DDoS vectors.

6/23/2017

This post introduces 'Project Jengo', Cloudflare's initiative to combat patent trolls by challenging the validity of patents through USPTO administrative proceedings like Inter Partes Review (IPR) and ex parte reexamination. It details the mechanics and advantages of these processes compared to traditional court litigation, highlighting how they can be used to invalidate 'bad patents' that stifle innovation. This represents a new facet of Cloudflare's threat management, extending beyond technical defenses to legal and administrative challenges against entities that leverage patents to hinder technological progress.

6/7/2017

This post details the implementation of Cloudflare's rate limiting system, designed to scale to millions of domains. It describes the challenges of distributed rate limiting across an anycast network, the use of a Twemproxy cluster with memcached for shared counters within each PoP, and the adoption of a sliding window algorithm for accurate rate approximation. The system leverages asynchronous counter increments and in-memory caching of mitigation states to handle high-volume L7 attacks efficiently without impacting legitimate traffic.

5/25/2017

This post details Cloudflare's intensified efforts against patent trolls, specifically Blackbird Tech. It highlights the success of 'Project Jengo' in gathering prior art submissions from the community, the doubling of financial commitment to invalidate patents, and the initiation of actions to address potential ethical violations by Blackbird Tech's attorneys. The post also discusses legislative efforts in Illinois and Massachusetts to combat patent trolling and criticizes Blackbird Tech's inconsistent claims about its operational structure.

5/24/2017

This post details the analysis of reflection attacks, specifically NTP and SSDP, including their mechanics, prevalence, and statistics gathered from Cloudflare's logs. It explains how these attacks work, lists popular reflection vectors, and provides detailed statistics on NTP and SSDP attacks, including duration, number of reflectors, and peak bandwidth. It also touches on Cloudflare's automated defenses against such attacks.

5/11/2017

This post introduces Project Jengo, a prior art search bounty program initiated by Cloudflare to combat patent trolls like Blackbird Technologies. It highlights Cloudflare's commitment to protecting innovative companies by seeking evidence to invalidate patents that are used to sue businesses. The program offers financial rewards for identifying prior art that demonstrates patents were issued improperly, thereby aiming to level the playing field against patent trolls and prevent them from stifling innovation.

5/3/2017

This post details how eero uses Cloudflare as a 'cloud canary' to test internet availability from their devices. They store a small file in Amazon S3, protected by Cloudflare, to serve as a secondary internet check. This allows eero devices to continuously verify internet access without relying on third-party sites, preserving user privacy and providing an out-of-band, highly available, and low-cost method. Cloudflare's CDN serves this file from the edge, minimizing S3 costs.

5/2/2017

This post contributes to the website security and threat management feature thread by extending the discussion to the emerging security landscape of the Internet of Things (IoT). It identifies and explains four key security anti-patterns prevalent in IoT device development: insecure HTTP Pub/Sub leading to DDoS vulnerabilities, the risks of IoT devices acting as TLS servers with self-signed certificates, the critical vulnerability of unencrypted bootloaders, and the performance and security issues arising from using databases as inter-process communication (IPC). This expands the scope of threat management to encompass connected devices.

5/1/2017

This post introduces TLS with client authentication as a new security capability for enterprise customers. It explains how this feature allows servers to authenticate clients, enhancing security for scenarios like IoT devices, mobile apps, and enterprise networks. The post details the handshake process, the benefits of offloading this CPU-intensive operation to Cloudflare's edge, and the available modes (enforce and report). It also highlights the availability of Cloudflare's open-sourced CFSSL tool for PKI setup and mentions that this functionality will be incorporated into Cloudflare Access.

4/27/2017

Introduced Cloudflare Orbit, a private network for IoT devices that acts as a security shield at the edge. Orbit allows IoT companies to apply security logic and firewall rules to protect devices from exploits, even if they are unpatched. This is achieved by filtering malicious requests before they reach the device. Additionally, Orbit introduces TLS Client Authentication handled at the edge, which validates client certificates from IoT devices, ensuring only authorized devices can communicate with IoT infrastructure.

4/21/2017

This post details the significant decline in the use of AES-CBC cipher suites on Cloudflare's network, marking a milestone where more secure alternatives like AES-GCM and ChaCha20-Poly1305 have surpassed it. It also highlights the increasing adoption of ECDSA over RSA for digital signatures and the continued dominance of Perfect Forward Secrecy (PFS), indicating a positive trend towards safer and faster cryptography on the web.

4/19/2017

This post introduces 'SSL for SaaS,' a new capability that allows SaaS providers to easily extend Cloudflare's security benefits, specifically automated SSL certificate provisioning and management, to their customers' custom domains. This addresses the complexity of manually managing SSL certificates for white-labeled SaaS applications, enabling HTTPS for these custom domains with a simple API call and CNAME setup. It highlights how this feature enhances security, SEO, and performance for end-users by leveraging Cloudflare's edge network and advanced TLS implementations.

4/13/2017

This post announces the general availability of Cloudflare's Rate Limiting service to all customers, extending its previous availability to Enterprise customers. It details how Rate Limiting helps mitigate Layer 7 DDoS attacks, brute-force login attempts, and bot scraping by blocking offending IP addresses at the network edge. The post outlines how to enable and configure Rate Limiting through the dashboard, including path-specific rules and HTTP method limitations for Business+ plans. It also introduces a 'simulate' mode for Pro+ plans to test rules before live deployment and mentions upcoming analytics for insights into traffic patterns and rule efficacy.

3/1/2017

This post details the analysis and mitigation of the 'Cloudbleed' vulnerability, which involved a parser bug causing memory leaks of customer data, including headers and cookies, onto web pages. The analysis focused on quantifying the impact, identifying the root cause in a new parser version triggered by specific HTML flaws and enabled features, and investigating potential malicious exploitation through log data review. The findings indicated no evidence of malicious exploitation before patching and limited data leakage for the majority of customers.

2/24/2017

This post details a critical security incident where a memory leak in Cloudflare's HTML parser (Ragel-based) led to the potential exposure of sensitive data like cookies and POST bodies. It highlights the rapid response to identify the root cause, disable affected features (email obfuscation, server-side excludes, automatic HTTPS rewrites), and deploy a global patch within hours. The post also provides a deep technical dive into the bug's origin in pointer arithmetic and buffer handling, and explains why it manifested after the introduction of a new parser (cf-html). This incident underscores Cloudflare's commitment to transparency and its ability to quickly address security vulnerabilities impacting its infrastructure.

2/15/2017

This post details Cloudflare's implementation of TLS 1.3, including an independent audit by NCC Group. It highlights the use of Go's standard library for a secure and efficient implementation, the focus on modern cryptographic algorithms, and the commitment to upstreaming improvements to the Go project. This demonstrates a commitment to advancing the security of internet connections through the adoption and refinement of the latest encryption standards.

2/6/2017

This post details the emergence and tactics of DDoS ransom groups, specifically noting their use of demonstration attacks and ransom emails referencing Mirai. It reinforces Cloudflare's stance against paying ransoms, explains the typical attack vectors and volumes observed in demonstration attacks, and advises users to have a proactive action plan for DDoS mitigation.

2/1/2017

This post details the proactive rollout of two specific WAF rules (WP0025A and WP0025B) to protect against a newly announced WordPress content injection vulnerability. These rules were developed in collaboration with the WordPress Security Team and Sucuri, and were enabled for all customers, including free tier users, before the vulnerability was publicly disclosed.

1/10/2017

Introduced Token Authentication as a feature to control access to cached private content and APIs. This feature leverages HMAC tokens generated from a shared secret, resource path, and timestamp. Tokens can be passed as URL parameters or HTTP headers. The validation occurs at the edge, preventing invalid requests from reaching the origin and enabling caching of protected content. The post provides implementation examples in PHP for generating tokens and mentions configuration options within the WAF Custom User Rule Set Package.

1/9/2017

This post details the investigation and analysis of the 'Porcupine Attack', a novel threat characterized by millions of junk HTTP requests per second that bypassed traditional HTTP DDoS mitigation systems. It highlights Cloudflare's internal monitoring tools (Grafana), debugging techniques (tcpdump), and the detailed analysis of the malformed HTTP payload, revealing a patterned binary junk. The post also discusses the scale, global geographic distribution, and aggressive IP rotation of the attacking sources, suggesting a sophisticated botnet. It concludes with the identification of the payload generation algorithm and ongoing investigation into the nature of the attack.

12/2/2016

This post details a ten-day period of massive DDoS attacks, observing new attacker patterns like working regular business hours and using non-Mirai botnet software. It highlights Cloudflare's ability to automatically mitigate these large-scale, sustained attacks (peaking at 400Gbps and 172Mpps) without impacting customers, reinforcing the effectiveness of its architectural design for handling such threats.

10/26/2016

This post details Cloudflare's architectural approach to scaling its DDoS mitigation capabilities, contrasting it with legacy hardware-based solutions. It explains how Cloudflare's distributed, software-defined network, built on commodity hardware and BGP routing, allows for cost-effective scaling and the ability to absorb massive attacks. The post also highlights how Cloudflare's bandwidth purchasing model (95th percentile billing) makes DDoS mitigation effectively free for the company, enabling services like Project Galileo.

10/12/2016

This post details the evolution of nonce management in TLS, explaining its importance for cryptographic security. It traces the progression from RC4's lack of nonces, through CBC's vulnerabilities in TLS 1.0 (BEAST attack) and its fixes in TLS 1.1 and 1.2, to the improved nonce handling in TLS 1.2 AES-GCM and the final robust implementation in TLS 1.3. It also highlights the "Nonce-Disrespecting Adversaries" vulnerability and the ongoing research into nonce reuse resistance.

10/11/2016

This post details a significant shift in DDoS attack vectors, highlighting the emergence of large-scale attacks originating from IoT botnets, specifically mentioning the Mirai botnet and similar threats. It provides concrete data on two major L7 HTTP-based DDoS attacks, one peaking at 1.75 million requests per second and another generating 360Gbps of inbound traffic with large HTTP payloads. The post analyzes the geographical distribution of these attacks, the Autonomous Systems (AS) involved, and provides evidence suggesting the compromised devices are primarily IoT cameras and potentially NAS devices. It also discusses the evolution of DDoS mitigation strategies to counter these new L7 threats, including the deployment of a new system that recognizes and blocks these attacks across the network.

9/30/2016

Introduced Cloudflare Rate Limiting, a feature to control traffic based on request rates per client IP address, cookie, or other attributes. The post details configuration options including URL patterns (with wildcards), threshold (requests per minute), action (block/simulate), timeout, and response body type/content. It also mentions potential future enhancements like specifying methods, response codes, headers, and cookies, and extending mitigation options to CAPTCHA.

9/30/2016

This post introduces Dedicated SSL Certificates and Dedicated SSL Certificates with Custom Hostnames. These offerings provide customers with non-shared, customizable SSL certificates issued on-demand with a new private key exclusively for their domain. This addresses customer requests for more control over certificate issuance, branding (showing their domain name instead of cloudflaressl.com), protection of multiple levels of subdomains, and granular control over SSL/TLS features. It complements the existing Universal SSL by offering a higher degree of personalization and isolation for specific use cases like agencies, SaaS providers, and those requiring advanced subdomain coverage.

9/29/2016

Introduced Rate Limiting to control traffic based on request counts per IP, URI, or authentication token, and Traffic Manager for load balancing across multiple origin servers and geographies with health checks and geo-steering.

9/24/2016

This post details Cloudflare's initiative to automatically rewrite HTTP dependencies to HTTPS on the server-side to combat mixed content issues. It explains the challenges of naive rewriting and how Cloudflare developed a custom, high-performance engine inspired by the HTTPS Everywhere browser extension. The post dives into the technical details of how the engine parses domain wildcards efficiently using Ragel and state machines, optimizing for performance at scale.

9/23/2016

This post introduces TLS 1.3 as a significant advancement in secure communication protocols, detailing its improvements over TLS 1.2. It explains how TLS 1.3 reduces handshake round-trips from two to one, and enables 0-RTT connections for even faster initial data transfer. It also highlights the removal of outdated and insecure cryptographic algorithms and features, making the protocol more robust and less prone to implementation errors and vulnerabilities.

9/20/2016

This post introduces TLS 1.3 as a significant upgrade to encrypted internet traffic, available to all Cloudflare customers. It highlights TLS 1.3's key benefits: enhanced security through the removal of outdated and vulnerable cryptographic features (like RSA key transport, CBC mode ciphers, RC4, SHA-1, and arbitrary Diffie-Hellman groups) and improved speed by reducing the handshake process from two round-trips to one, with a future plan for zero round-trip mode (0-RTT). This directly contributes to the ongoing effort to secure and optimize web traffic.

9/20/2016

This post, 'Encryption Week,' introduces three major features that significantly advance Cloudflare's commitment to encryption and web security: TLS 1.3 for faster and more secure connections, Automatic HTTPS Rewrites to automatically fix mixed content issues and enable HTTPS adoption, and Opportunistic Encryption to provide HTTP/2 benefits to unencrypted HTTP sites. These features collectively aim to make encryption more accessible and widespread, contributing to the goal of an encrypted internet.

9/19/2016

Introduced a new Cloudflare WordPress plugin that simplifies the integration of Cloudflare's performance and security benefits for WordPress sites. The plugin offers one-click, WordPress-optimized settings, including Web Application Firewall (WAF) rulesets specifically designed to mitigate WordPress threats and vulnerabilities. It also provides automatic cache purging upon website appearance changes and allows users to manage Cloudflare settings and view analytics directly from within the WordPress dashboard. Additionally, it restores original visitor IP addresses in WordPress logs.

8/2/2016

This post introduces the p0f BPF compiler, an open-source component of Cloudflare's bpftools. It details how Cloudflare uses the p0f tool to analyze network traffic and generate signatures for identifying different operating systems and, crucially, attack patterns like SYN floods. The post explains the p0f signature format and demonstrates how the new compiler translates these signatures into BPF bytecode for iptables. This enables Cloudflare to efficiently rate-limit or drop malicious SYN packets based on their specific characteristics, significantly enhancing their SYN flood mitigation capabilities.

7/18/2016

Introduced automatic protection for the httpoxy vulnerability for all customers by modifying requests to be harmless. Provided an optional WAF rule (100050) for customers to explicitly block such requests.

5/17/2016

This post details a SQL injection vulnerability that can be exploited through the User-Agent HTTP header, specifically using a 'sleep' command to cause a delay. It illustrates how attackers can use this technique for blind SQL injection and demonstrates a vulnerable PHP code example. The post also provides a secure alternative using prepared statements and parameter binding to prevent such attacks. Cloudflare's WAF is mentioned as a mitigation for injection attacks.

5/10/2016

This post introduces the Cloudflare Origin CA, a new feature that allows users to obtain certificates directly from Cloudflare to encrypt the connection between Cloudflare and their origin servers. It highlights the use of the Web Crypto API for client-side private key generation, enhancing both security and usability by eliminating the need for users to manage private keys or interact with third-party certificate authorities for this specific purpose.

5/9/2016

This post details the discovery and analysis of the ImageTragick vulnerability (CVE-2016-3714) in ImageMagick, which allows for arbitrary code execution through specially crafted image files. It describes the reconnaissance and remote access payloads used by attackers, including examples of how attackers leverage wget and python scripts to gain shell access. Cloudflare's response involved the rapid deployment of a WAF rule to protect customers from these exploits, highlighting the importance of timely threat intelligence and automated protection mechanisms.

5/4/2016

This post details a specific padding oracle vulnerability (CVE-2016-2107) found in OpenSSL's CBC mode cipher suites, which was a fix for a previous vulnerability (Lucky13). It explains the technical details of the vulnerability, how it exploits constant-time programming practices, and how Cloudflare engineers analyze and address such cryptographic weaknesses to maintain the security of its network and customer connections.

5/3/2016

This post introduces Cloudflare Origin CA, a new service that provides free and performant encryption from Cloudflare's edge to the customer's origin server. It addresses the complexities of obtaining and renewing certificates by offering simplified issuance, wildcard certificate support, faster and more reliable revocation, and optimized certificates that reduce handshake size and origin bandwidth consumption. This enhances the overall security posture by making end-to-end encryption more accessible and efficient.

5/2/2016

This post introduces version 6.0 of the Cloudflare cPanel plugin, re-architected using cPanel PHP-based APIs for easier feature addition and more frequent updates. It enables Full Zone Provisioning for root domain protection, including DDoS mitigation. New security controls directly from cPanel include selecting security levels (Essentially Off, Low, Medium, High), configuring Challenge Passage duration, and enabling Browser Integrity Check. It also adds performance controls like cache management (setting level, purging) and Auto-minify for CSS, JavaScript, and HTML.

4/25/2016

This post details Cloudflare's analysis of the Armada Collective's DDoS extortion threats. It highlights that the current incarnation of the group has not followed through on its threats, despite collecting significant extorted funds. The post also contrasts this with the original Armada Collective (suspected to be DD4BC) which did launch attacks, and emphasizes Cloudflare's ability to mitigate even large-scale DDoS attacks. It serves to inform customers about the nature of these threats and Cloudflare's protective capabilities.

4/18/2016

This post details Cloudflare's active participation in an IETF Hackathon to implement and test TLS 1.3 in browsers. It highlights the collaborative effort to integrate TLS 1.3 with Firefox and Cloudflare's test infrastructure, focusing on achieving interoperability for features like PSK-based resumption and 0-RTT. This contribution showcases Cloudflare's commitment to advancing and deploying cutting-edge security protocols to enhance internet security.

4/4/2016

This post details Cloudflare's early adoption and ongoing support for the ChaCha20-Poly1305 AEAD cipher suite. It explains the technical aspects of AEADs, the history and standardization of ChaCha20-Poly1305, its advantages over AES-GCM, and the differences between draft and RFC versions. Cloudflare's contribution includes an open-sourced patch for OpenSSL that supports both versions, ensuring compatibility with existing and upcoming browsers, and highlighting their role in pioneering this technology for improved web performance and security, especially on mobile devices.

3/30/2016

This post details Cloudflare's approach to handling traffic from the Tor network, which presents a unique challenge due to the high percentage of malicious requests originating from Tor exit nodes and the inherent anonymity that prevents traditional reputation-based filtering. The post discusses the trade-offs between security, anonymity, and convenience, and the implementation of CAPTCHAs (specifically Google's reCAPTCHA) as a primary mechanism to distinguish automated malicious traffic from legitimate human users. It also introduces open-sourced tools like 'torhoney' and 'torexit' for analyzing Tor exit node reputation and longevity, and discusses potential future improvements such as treating GET requests differently and allowing customers to configure rules for Tor traffic.

3/23/2016

This post details Cloudflare's 'no browser left behind' initiative, specifically focusing on the technical implementation of TLS certificate optimization. It explains the complex logic required to dynamically serve the most appropriate certificate (SHA-1 RSA, SHA-2 RSA, or SHA-2 ECDSA) based on the client's capabilities, as communicated in the TLS ClientHello message. This ensures secure connections for all users, regardless of their browser's support for newer cryptographic standards, while also optimizing for performance.

3/3/2016

This post details Cloudflare's advancements in automatically mitigating large-scale Layer 3 DDoS attacks, reporting peak traffic of over 400Gbps and 180Mpps. It highlights how their network capacity and automated systems allow them to absorb and accurately measure these attacks, improving their mitigation capabilities with each event and enabling them to withstand even larger future attacks.

3/1/2016

This post highlights Cloudflare's proactive protection against the DROWN attack by ensuring SSLv2 is not enabled on its own infrastructure and by testing customer origin servers for vulnerabilities. It reinforces the ongoing commitment to secure encryption protocols and threat mitigation.

2/24/2016

This post introduces Cloudflare Registrar, a new service designed to address the critical security vulnerability of domain hijacking at the registrar level. It details the historical context of domain registration, the inherent security weaknesses in existing mass-market registrars, and Cloudflare's solution which involves implementing robust security measures like registrar and registry locks, multi-user offline confirmation, two-factor authentication, and automatic DNSSEC. This marks an expansion of Cloudflare's security offerings beyond website traffic to the ownership and management of domains themselves.

2/12/2016

This post details the vulnerability of CBC-mode cipher suites to padding oracle attacks, a significant threat to TLS security. It explains the mechanics of these attacks and highlights Cloudflare's role in mitigating them by promoting the adoption of more secure AEAD cipher suites, thereby enhancing website security and threat management.

2/11/2016

This post details Cloudflare's investigation and deconstruction of a bug within Microsoft's SChannel TLS implementation. The bug caused connection failures or security downgrades (TLS 1.2 to TLS 1.0) when clients using SChannel encountered TLS session tickets being renewed during an abbreviated handshake. Cloudflare's proactive approach to TLS session ticket management, including frequent key regeneration for security and scalability, exposed this underlying issue in Microsoft's implementation. The post highlights Cloudflare's role in identifying, troubleshooting, and ultimately contributing to the resolution of this critical security vulnerability affecting a wide range of Microsoft products.

1/21/2016

This post addresses a specific threat vector: malicious request loops caused by non-compliant reverse proxy services. It details how Cloudflare uses the 'Via' header to prevent these loops for its own service and calls for industry-wide adoption of RFC 7230 standards to ensure a more secure and stable web ecosystem. It highlights the importance of standards compliance in preventing resource exhaustion and denial-of-service attacks.

12/22/2015

This post explains why forging a SHA-1 certificate is significantly harder than finding a SHA-1 collision. It details the mechanics of digital signatures, the security properties of hash functions (collision resistance, second pre-image resistance, pre-image resistance), and how MD5 collisions were exploited using chosen-prefix attacks to forge certificates. The post highlights the importance of strong cryptographic primitives for maintaining trust on the internet and the ongoing efforts to deprecate insecure algorithms like SHA-1, contributing to the broader theme of securing web infrastructure.

12/17/2015

This post details the analysis of a zero-day vulnerability (CVE-2015-8562) in Joomla's unserialize functionality, which allows for remote code execution via crafted User-Agent or X-Forwarded-For headers. It explains the POP chain exploit mechanism, the vulnerable code paths in Joomla, and demonstrates how Cloudflare's Web Application Firewall (WAF) was updated with specific rules to block these attacks by default for Pro and higher plan customers. The post includes examples of observed attack payloads and WAF activity.

12/9/2015

This post details Cloudflare's proactive approach to deprecating the SHA-1 hashing algorithm for SSL certificates. It highlights the security risks associated with SHA-1, the challenges of transitioning to SHA-2 (particularly for users in developing countries with older devices), and Cloudflare's solution: implementing SHA-1 fallback for legacy browsers while serving SHA-256 to modern ones. This demonstrates a commitment to both advancing security standards and ensuring broad accessibility.

10/16/2015

This post details a new WordPress brute force amplification attack vector that abuses the `system.multicall` functionality within XML-RPC to perform a large number of login attempts with a single HTTP request. It explains the XML-RPC protocol, the `system.multicall` abuse, and provides a Cloudflare WAF rule (WP0018) to mitigate this specific attack by checking for consistencies that line up with known malicious activities. A manual solution by disabling `system.multicall` in `functions.php` is also provided.

9/25/2015

This post details a novel DDoS attack vector utilizing mobile ad networks to distribute malicious JavaScript, which then floods Cloudflare customer sites with HTTP requests. It provides a case study of such an attack, analyzing the request patterns, the attack page, and the likely distribution mechanism through ad networks. This highlights a new type of threat that Cloudflare's platform is capable of detecting and mitigating automatically.

9/8/2015

This post details the debugging and resolution of an issue where the Twitter in-app browser failed to load Cloudflare-protected sites when transitioning from an HTTPS link in a tweet to an HTTP link on a Cloudflare customer's site. The root cause was identified as the Twitter app blanking out the Referer header, which violated RFC 7231. Cloudflare's Browser Integrity Check was flagging this as an error. The fix involved relaxing the Referer header check for this specific client behavior, demonstrating an adaptation of security policies to accommodate real-world client quirks while adhering to Postel's Law.

5/21/2015

This post explains the Logjam vulnerability, a novel downgrade attack against the TLS protocol that exploits EXPORT cryptography. It highlights how Cloudflare customers are protected because Cloudflare does not support non-EC Diffie-Hellman cipher suites or EXPORT-grade cryptography, and instead relies on Elliptic Curve Diffie-Hellman (ECDHE) for forward secrecy. The post details the technical workings of Diffie-Hellman and the Logjam attack, emphasizing the importance of strong, non-reused cryptographic parameters and the server's role in accepting weak parameters.

4/30/2015

This post introduces JavaScript-based DDoS attacks as a new and evolving threat. It explains how malicious JavaScript can be used to enlist unsuspecting web users into DDoS attacks, either through compromised websites, hijacked third-party scripts, or man-in-the-middle attacks. It also highlights Subresource Integrity (SRI) as a proposed solution to mitigate risks from compromised third-party scripts and emphasizes the importance of HTTPS for preventing man-in-the-middle attacks and protecting against JavaScript DDoS.

4/25/2015

Introduced a new ModSecurity rule to the Web Application Firewall (WAF) to protect against a specific Remote Code Execution (RCE) vulnerability in Magento versions 1.9.1.0 CE and 1.14.1.0 EE. This rule is available to customers using the WAF and requires manual enablement via the WAF Settings. The post also stresses the importance of users applying the SUPEE-5344 patch from Magento.

4/24/2015

This post details the analysis of a phishing campaign that exploited a WordPress 0-day vulnerability. It describes the typical phishing attack lifecycle, from email distribution to compromised landing pages, and explains how Cloudflare detected and neutralized the attack by analyzing malicious links and collaborating with hosting providers. The post also discusses various advanced phishing techniques used for URL obfuscation, such as image maps, misspelled domains, homoglyphs, reflection, redirection, JavaScript, and Punycode, providing technical examples of each.

4/15/2015

This post details the immediate deployment of a Web Application Firewall (WAF) rule to block requests exploiting the MS15-034 vulnerability in Windows servers. The rule specifically targets HTTP Range headers with large byte offsets, which were known to cause Denial of Service (DoS) or Remote Code Execution (RCE) on vulnerable systems. Customers on paid plans with WAF enabled are automatically protected.

3/19/2015

This post details Cloudflare's immediate response to multiple OpenSSL vulnerabilities discovered in March 2015. It highlights Cloudflare's process of analyzing the vulnerabilities, determining their impact (primarily Denial of Service rather than information disclosure for Cloudflare's infrastructure), and rapidly deploying patches to their production environment. It also emphasizes the importance of such timely updates for maintaining the security of the internet infrastructure and encourages customers to do the same.

3/4/2015

This post highlights Cloudflare's proactive security measures against the FREAK vulnerability by not supporting weak 'export grade' cryptography and maintaining updated OpenSSL versions. It reinforces their ongoing commitment to disabling outdated protocols and ciphers (like SSLv3 and RC4) and adopting modern, secure ones (like ChaCha-Poly, forward secrecy, and elliptic curves).

2/28/2015

Introduced Authenticated Origin Pulls, a feature that leverages TLS client authentication to allow origin servers to verify the identity of Cloudflare. This is achieved by adding support to nginx for client certificate verification, enabling origin servers to drop requests not originating from Cloudflare's certificate. The feature is opt-in and available across all Cloudflare plans.

2/26/2015

Introduced HTTP Strict Transport Security (HSTS) as a feature within Cloudflare's dashboard. This enables users to enforce HTTPS connections by sending HSTS headers to browsers. The post details the parameters of HSTS (max-age, includeSubDomains) and explains its role in preventing SSL stripping attacks. It also guides users on how to enable HSTS through the new beta dashboard.

2/24/2015

This post announces the public beta of Cloudflare's Origin CA service, which provides free, limited-function certificates for customer origin servers. This enables full encryption of traffic from the browser to the origin server, complementing the existing Universal SSL feature. It details the three SSL modes (Flexible, Full, Strict), explains the creation and validation process for Origin CA certificates, and provides instructions on how to create Certificate Signing Requests (CSRs) using CFSSL.

2/24/2015

This post details Cloudflare's implementation of TLS session resumption (both Session IDs and Session Tickets) to improve the performance of Universal SSL. It explains the technical challenges of sharing session data across multiple hosts within a Point of Presence (PoP) and Cloudflare's solutions using memcached for Session IDs and a secure, rotated key distribution system for Session Tickets. The post highlights the performance benefits of session resumption, reducing handshake costs and improving user experience, especially for mobile users.

2/23/2015

This post introduces the adoption of ChaCha20-Poly1305 cipher suites to improve mobile performance and security. It highlights the limitations of existing ciphers like AES for mobile devices and explains how ChaCha20-Poly1305 offers a faster and more battery-efficient alternative. The post details the security benefits of these new algorithms, their performance advantages, and Cloudflare's intelligent client-based selection of cipher suites.

2/23/2015

This post details the complete disabling of the RC4 encryption algorithm for all SSL/TLS connections to Cloudflare sites. It explains the phased approach taken over the past year, including disabling it for TLS 1.1 and above, and then deprecating it. The post highlights the remaining use cases for RC4 (old mobile phones, Windows XP, and SSL-intercepting proxy software) and the rationale for its complete removal due to security vulnerabilities, even for the remaining small percentage of connections.

2/23/2015

This post announces 'SSL Week' and highlights Cloudflare's ongoing commitment to improving encryption on the internet. It details efforts to make encryption easy, fast, and secure, including the rollout of Universal SSL, making connections to origin servers secure and cryptographically verifiable, and the addition of new, faster ciphers while deprecating older, less secure ones.

1/21/2015

Introduced protocol rewriting in the Cloudflare WordPress plugin to automatically change HTTP asset links to relative protocols (e.g., `//www.example.com/...`). This resolves "Mixed Content" errors for websites using Flexible SSL, where the connection between the visitor and Cloudflare is HTTPS, but between Cloudflare and the origin server is HTTP. Recommended adding a page rule to redirect all HTTP traffic to HTTPS for comprehensive security.

1/7/2015

This post contributes to website security by detailing the forensic analysis of a DDoS attack. It uncovers specific, non-obvious relationships between packet fields (TTL, source IP, DNS ID, and IPv4 ID) used by attackers, demonstrating a sophisticated method of spoofing and potentially generating source IPs. This deep dive into packet-level manipulation enhances the understanding of attack vectors and informs the development of more advanced threat detection mechanisms.

12/31/2014

This post details Cloudflare's significant security advancements in 2014, including the introduction of Strict SSL mode, proactive protection against Heartbleed and Shellshock vulnerabilities, the revocation and reissuance of all SSL certificates, the removal of RC4 cipher support, achieving PCI certification, and the landmark launch of Universal SSL, making SSL free for all customers. It also highlights the introduction of Keyless SSL, enhancing customer control over private keys.

12/22/2014

This post details the integration of mutually-authenticated TLS encryption into Kyoto Tycoon, a key-value store used by Cloudflare for replicating sensitive data between data centers. This enhancement protects data in transit over the public internet, preventing eavesdropping and modification by securing the replication pipeline for critical information like session ticket keys and DNS data.

11/11/2014

This post details Cloudflare's proactive response to upcoming browser policy changes (Chrome and Firefox) deprecating SHA-1 certificates. It explains the technical implications of SHA-1 vs. SHA-2, the compatibility challenges with older operating systems like Windows XP SP2, and Cloudflare's strategy to manage this by issuing SHA-1 certificates expiring before 2016 for paid customers and SHA-2 for free customers. It also outlines a future plan to offer SNI certificates with SHA-1 fallback for paid customers to maximize reach and security.

10/16/2014

This post details the immediate mitigation of a critical SQL injection vulnerability (SA-CORE-2014-005) in Drupal 7 by updating Cloudflare's Web Application Firewall (WAF) rules. It specifically mentions Rule D0002 as providing protection and instructs users to enable the 'CloudFlare Drupal' ruleset if not already active. The post also strongly advises users to upgrade to the safe version of Drupal (7.32) or apply the patch, and provides an update on the severity of the vulnerability based on a Drupal Security Team PSA, indicating that sites not patched before a specific date should be assumed compromised.

10/14/2014

This post details Cloudflare's immediate response to the POODLE vulnerability affecting SSLv3. It outlines the decision to disable SSLv3 by default across the network, provides statistics on SSLv3 usage to assess impact, and discusses the technical mitigation strategies being explored, such as implementing fallback SCSV to prevent downgrade attacks. It also highlights the availability of an override option for Business and Enterprise customers.

10/14/2014

This post introduces the concept of automatically enabling WAF rulesets for common web platforms (WordPress, Drupal, Joomla, etc.) to provide immediate protection against newly discovered vulnerabilities. It highlights the benefit of enabling these technology-specific rulesets for automatic updates and protection.

10/2/2014

This post details the technical advancements enabling Cloudflare's Universal SSL, which scaled HTTPS adoption to millions of sites. It highlights the use of modern hardware with cryptographic instructions (AES-NI, CLMUL), modern cryptographic algorithms (ECDSA, ECDHE) for faster handshakes, session resumption techniques (session tickets and IDs) for returning visitors, and lazy loading of certificates to manage dynamic configurations at scale. These optimizations reduced the CPU cost of SSL to near zero, making widespread HTTPS deployment feasible.

10/1/2014

This post details Cloudflare's immediate response to the Shellshock vulnerability, including the rollout of WAF protection for Pro, Business, and Enterprise customers, followed by protection for Free plan customers. It analyzes attack vectors, sources, and common exploitation techniques (e.g., arbitrary code execution via User-Agent, data exfiltration via `cat /etc/passwd` or email, reconnaissance via `ping` or `wget`). It highlights the technical details of how the vulnerability works by passing environment variables into bash and the importance of patching bash itself.

9/30/2014

This post details the rollout of Cloudflare's Universal SSL feature, highlighting the challenges and progress in deploying SSL certificates to millions of websites. It explains the phased approach, expected delays, and potential certificate mismatch errors users might encounter during the provisioning process. The post also outlines how Cloudflare is tracking progress and communicating updates to customers, and provides examples of sites with Universal SSL enabled, noting the potential for mixed content warnings and Cloudflare's future plans to address them.

9/30/2014

This post introduces Universal SSL, enabling HTTPS support for all sites by default. It details two primary methods for securing the connection between Cloudflare and origin servers: Full SSL using self-signed certificates and Strict SSL using certificates from trusted Certificate Authorities. It also previews a future Cloudflare Origin CA and certificate pinning feature.

9/29/2014

This post announces the launch of Universal SSL, a groundbreaking initiative that automatically provisions SSL certificates for all Cloudflare customers, including those on the free plan. This significantly expands HTTPS adoption, doubling the number of SSL-enabled sites on the internet at the time. It addresses technical challenges related to CPU load and IPv4 exhaustion by leveraging modern browser features like ECDSA and SNI, and also promotes the adoption of modern browsers and operating systems. Furthermore, Universal SSL enables broader support for performance-enhancing protocols like SPDY and contributes to Cloudflare's mission of a more secure and open internet.

9/29/2014

Extended Shellshock protection to all customers, including Free plan users, by implementing a special Basic ShellShock Protection. Paying customers continue to receive more advanced protection via the Cloudflare WAF.

9/24/2014

This post details Cloudflare's immediate response to the critical CVE-2014-6271 (Shellshock) vulnerability in Bash. It describes the internal testing and deployment of a patch across Cloudflare's infrastructure to protect its own servers. Additionally, it highlights the proactive creation and default enablement of a Web Application Firewall (WAF) rule for Pro, Business, and Enterprise customers to protect their servers that may not have been patched. The post also notes the subsequent release of updated Bash packages addressing related vulnerabilities (CVE-2014-7169) and Cloudflare's continued monitoring and patching efforts.

9/19/2014

This post delves into the technical intricacies of TLS handshakes, explaining the RSA and Ephemeral Diffie-Hellman methods. It introduces Cloudflare's 'Keyless SSL' feature, which aims to enhance security by allowing TLS connections without exposing private SSL keys at the edge. This innovation addresses the security risks associated with traditional private key management during TLS handshakes, offering a more robust solution for secure communication.

9/18/2014

This post introduces Keyless SSL, a novel solution that enables cloud-based SSL termination without requiring Cloudflare to possess customers' private SSL keys. This addresses a critical security concern for financial institutions and enterprises, allowing them to benefit from Cloudflare's scalable network while maintaining strict control over their sensitive cryptographic material. The post details the genesis of the idea, the initial prototype, and the subsequent engineering effort to make it production-ready, highlighting its impact on SSL termination speed and security.

8/6/2014

This post marks a significant milestone in Cloudflare's commitment to website security by addressing the widespread adoption of HTTPS. It highlights Google's new ranking signal for HTTPS, providing a strong incentive for websites to adopt secure connections. Crucially, Cloudflare announces a technical breakthrough in 'lazy loading' SSL certificates, overcoming a major hurdle to offering free and easy HTTPS support to all customers, with a rollout planned for mid-October. This innovation is poised to dramatically increase the number of HTTPS-enabled websites.

7/10/2014

This post introduces CFSSL, Cloudflare's open-source Public Key Infrastructure (PKI) toolkit. CFSSL is used internally for TLS/SSL certificate bundling and Certificate Authority (CA) infrastructure, and is now open-sourced to help website operators create correct certificate bundles more easily. It addresses the pain points of certificate bundling, balancing performance, security, and compatibility by helping users select the optimal certificate chain for maximum browser compatibility. The post details how CFSSL works, its use as a web service with a JSON API, and its role in Cloudflare's own HTTPS service.

7/3/2014

This post introduces Cloudflare's open-sourced BPF Tools, designed for high-performance packet filtering to combat large-scale DDoS attacks. It details how these tools, including `pcap2hex`, `parsedns`, `bpfgen`, `filter`, and `iptables_bpf`, can be used to analyze pcap files, generate BPF bytecode for specific traffic patterns (like DNS floods targeting subdomains), verify the bytecode, and deploy it via iptables rules. The contribution highlights the practical application of BPF for dropping malicious traffic at the iptables level before it impacts application servers, with a focus on DNS traffic and the ability to match IPv6 packets, perform suffix matching, and handle case-insensitive domain matching.

6/18/2014

Cloudflare acquired CryptoSeal, a company specializing in Trusted Computing and VPNs. This acquisition brings expertise in protecting commodity servers from compromise and guaranteeing the integrity of server-side applications. This technology has direct applications for Cloudflare's secure edge infrastructure.

6/5/2014

This post highlights Cloudflare's immediate patching of its systems against newly discovered OpenSSL vulnerabilities, specifically CVE-2014-0224 (CCS Injection). It demonstrates Cloudflare's proactive approach to system-level security and its ability to protect customers from critical, widespread threats by applying patches across its infrastructure.

5/21/2014

This post introduces the Berkeley Packet Filter (BPF) as a powerful and flexible mechanism for packet filtering within the kernel. It details how BPF, originally developed for `tcpdump`, has evolved and is now utilized by Cloudflare for advanced threat management. Specifically, it highlights the use of the `xt_bpf` iptables module to apply custom BPF bytecode for precisely matching and dropping malicious traffic, such as DNS queries for specific domains or subdomains, and demonstrates its effectiveness in handling massive packet floods.

5/19/2014

This post details Cloudflare's ongoing efforts to deprecate the RC4 encryption protocol due to its known vulnerabilities. It analyzes the remaining usage of RC4, identifying specific user agents, devices (older phones, browsers like IE 5.01, iCab), and geographic regions where it's still prevalent. The post also highlights the unexpected use of RC4 in transparent SSL proxies within large institutions, explaining the technical reasons behind its continued necessity for certain legacy systems and the challenges in fully deprecating it.

5/7/2014

This post details Cloudflare's proactive decision to deprecate the RC4 cipher for HTTPS connections, prioritizing stronger encryption methods like AES-GCM and AES-CBC. It explains the historical context of RC4's temporary rise due to the BEAST attack and the subsequent discovery of RC4's inherent weaknesses, making it a liability for long-term data security. The post highlights the technical shift in cipher preference and provides data on the minimal impact of this change, demonstrating Cloudflare's commitment to staying ahead of cryptographic vulnerabilities.

5/3/2014

This post details Cloudflare's proactive approach to managing and evolving its SSL/TLS configuration in response to emerging security threats. It introduces a new mechanism for tracking these changes via a GitHub repository (sslconfig) and highlights specific security vulnerabilities addressed, such as Lucky 13, BEAST, and RC4 biases. The post also emphasizes the adoption of advanced cryptographic techniques like ECDSA and Perfect Forward Secrecy to enhance customer security.

4/28/2014

This post details the technical analysis of the Heartbleed vulnerability, specifically how it exposed private SSL keys by allowing attackers to extract prime numbers used in RSA encryption. It explains the underlying RSA and Montgomery Reduction algorithms, and through memory instrumentation, demonstrates how OpenSSL versions vulnerable to Heartbleed left copies of these prime numbers in memory. The post also contributes proposed patches to OpenSSL to address these memory management issues, enhancing the security of SSL/TLS implementations.

4/17/2014

This post highlights the significant hidden costs and infrastructure burden associated with SSL certificate revocation, specifically in the context of the Heartbleed vulnerability. It details the technical mechanisms of OCSP and CRL, quantifies the bandwidth and financial costs for Certificate Authorities (CAs) during mass revocations, and emphasizes Cloudflare's capability to absorb and manage this load, thereby enabling faster responses to security threats.

4/17/2014

This post details Cloudflare's response to the Heartbleed vulnerability, including the immediate patching of their systems, the investigation into potential private key compromise, and the subsequent mass revocation and reissuance of all SSL certificates they manage. It also provides a technical deep-dive into how the Heartbleed vulnerability worked, explaining the memory leakage of private keys and RSA cryptosystem components, and highlights the winners of the Cloudflare Challenge to find the private key.

4/12/2014

This post addresses the critical security implications of the Heartbleed vulnerability, specifically focusing on certificate revocation and its effectiveness. It details how Cloudflare revoked its own certificate and highlights the varying browser behaviors when encountering revoked certificates, emphasizing the importance of robust revocation checking mechanisms. The post also discusses the surge in certificate revocations due to Heartbleed and encourages users to revoke and rekey their certificates if vulnerable.

4/11/2014

This post details the results of the Cloudflare Challenge, where the community was tasked with stealing a private key from a vulnerable Nginx server using the Heartbleed exploit. It highlights the effectiveness of community-driven security research and emphasizes the ongoing danger posed by such vulnerabilities, reinforcing the need for robust threat management.

4/11/2014

This post details the discovery and impact of the Heartbleed vulnerability, a critical bug in OpenSSL that could potentially expose server memory, including private SSL keys. Cloudflare's engineers investigated the exploit's ability to extract private keys, initially believing it to be impossible due to their specific NGINX and OpenSSL configurations. They launched a public challenge to test this hypothesis and, upon confirmation that private keys could indeed be extracted, initiated a mass reissue and revocation of customer SSL keys. The post also provides a technical explanation of the Heartbleed bug and how memory allocation on the heap can influence the exploit's effectiveness.

4/10/2014

This post details the automatic rollout of a Web Application Firewall (WAF) rule to protect all Cloudflare customers against a critical security flaw in the Jetpack plugin for WordPress (CVE-2014-0173). The WAF rule provides immediate protection, allowing users time to update their Jetpack plugin to the patched version (2.9.3).

4/7/2014

This post highlights Cloudflare's proactive approach to security by patching the Heartbleed vulnerability in OpenSSL before it was publicly disclosed. It demonstrates their responsibility in managing critical cryptographic libraries used for SSL/TLS connections and their commitment to protecting customer sites through rapid fixes and responsible disclosure practices.

3/12/2014

This post highlights the critical role of Cloudflare in protecting high-profile, high-traffic events from DDoS attacks and other web threats. It showcases the immediate implementation and effectiveness of Cloudflare's security measures in handling a 10x spike in traffic for livestreamed interviews of Julian Assange and Edward Snowden, demonstrating its ability to secure and accelerate content for major global events.

3/11/2014

Introduced and detailed two specific WAF rules (WP0001 and 100000) to mitigate WordPress pingback attacks and attacks using mutating query strings. WP0001 blocks the pingback mechanism via xmlrpc.php, and 100000 blocks mutating query strings that neutralize caches. This demonstrates the WAF's capability to protect against application-layer DDoS attacks leveraging specific WordPress features.

2/24/2014

This post announces the acquisition of StopTheHacker, an anti-malware firm. The rationale behind the acquisition is to enhance Cloudflare's ability to stop malware distribution and ensure that newly signed-up sites are not already infected. StopTheHacker's malware scanning service was already available through the Cloudflare Apps Marketplace. The integration aims to provide immediate remediation of malware and vulnerabilities, and enable more frequent and thorough scans of customer networks.

2/23/2014

This post details Cloudflare's experience with a large-scale DDoS attack utilizing vulnerable NTP servers and their subsequent efforts to encourage network administrators to patch these vulnerabilities. It showcases Cloudflare's role in identifying and mitigating widespread internet threats, contributing to a more secure internet ecosystem beyond their direct WAF product. The post highlights the success of their outreach in reducing the number of vulnerable NTP servers.

2/14/2014

Introduced 'Full SSL (Strict)' mode, which adds origin server certificate validation to the existing Full SSL option. This new mode prevents on-path attacks by ensuring that Cloudflare validates the certificate chain presented by the web server against its own list of trusted certificate authorities. Changes were upstreamed to nginx to enable origin certificate validation and support SNI for multiple domains behind the same IP over TLS.

2/13/2014

This post details a significant 400Gbps NTP amplification DDoS attack mitigated by Cloudflare, highlighting it as a major new threat. It explains the mechanics of NTP amplification attacks, the scale and global distribution of this specific attack, and Cloudflare's efforts to work with network operators to address vulnerable NTP servers. It also touches upon the broader context of amplification attacks and emerging threats like SNMP amplification.

1/29/2014

This post addresses the evolution of TLS security by detailing the deprecation of RC4 cipher suites for TLS v1.1 and above. It explains the historical context of preferring RC4 to mitigate BEAST attacks, the subsequent discovery of RC4 vulnerabilities, and the challenge of selectively disabling RC4 due to limitations in open-source web servers. Cloudflare's contribution is a patch for OpenSSL that allows RC4 to be used only for TLS v1.0 connections, while disabling it for newer, more secure protocols, thereby improving overall website security and SSL Labs ratings.

1/21/2014

This post details the deployment of a new global Web Application Firewall (WAF) that supports common rule sets (like OWASP) and a custom rule language. It provides examples of how Cloudflare engineers use this custom rule language to protect specific customers from botnets and zero-day exploits by writing and deploying rules in under 30 seconds. Examples include blocking WordPress number bots, Anonymous attack messages, and POST requests to non-existent URLs. It also mentions patching a WHMCS zero-day exploit and deploying rules for Plone and PHP remote code execution vulnerabilities.

1/9/2014

This post introduces NTP-based DDoS attacks as a new threat vector, explaining their mechanism of reflection and amplification. It details how the NTP protocol, specifically the 'monlist' command, can be exploited for these attacks. The post also provides guidance on how to mitigate these attacks by configuring NTP servers and firewalls, and by implementing BCP-38 to prevent source IP spoofing. Cloudflare's role in defending against these attacks is highlighted.

1/6/2014

This post delves into the technical details of cryptographic backdoors, specifically focusing on the Dual_EC_DRBG algorithm and how a pseudo-random number generator can be intentionally weakened. It explains the concept of backdoors, the importance of unpredictable random number generation for security (especially in SSL/TLS), and illustrates how elliptic curves can be manipulated to create predictable outputs. The post highlights the risks associated with proprietary or un-auditable cryptographic components and implicitly advocates for transparency and open-source solutions in security.

10/24/2013

This post introduces Elliptic Curve Cryptography (ECC) as a key technology used by Cloudflare for securing HTTPS connections and internal data center communications. It explains ECC as a next-generation public-key cryptography system that offers significantly more security than RSA with smaller key sizes, making it ideal for performance-sensitive applications and devices with limited computational power. The post contrasts ECC with RSA by explaining the underlying mathematical principles and the limitations of RSA's trapdoor function (factoring) in the face of increasing computational resources, positioning ECC as a more sustainable and secure cryptographic foundation.

10/3/2013

Added a Web Application Firewall (WAF) ruleset to block a specific zero-day vulnerability affecting WHMCS, providing immediate protection for hosting providers using Cloudflare.

10/3/2013

This post contributes to the Website Security & Threat Management thread by detailing the critical role of a robust random number generator for secure systems. It explains how Cloudflare relies on Linux's kernel entropy pool, its mechanisms for gathering and mixing entropy (timestamps, XOR), and the use of cryptographic hash functions (SHA-1) to generate high-entropy random numbers essential for SSL connections and other cryptographic operations. It also highlights the importance of monitoring entropy levels to maintain security guarantees.

9/20/2013

This post explains the fundamental differences between symmetric and asymmetric cryptography, specifically in the context of TLS connections. It clarifies why symmetric keys (like those used in RC4 and AES) can be relatively short (e.g., 128-bit or 256-bit) because their security relies on brute-forcing a large number of random possibilities. In contrast, it details why asymmetric keys (like those used in RSA and ECDHE_RSA) must be much larger (e.g., 2048-bit) due to their reliance on mathematical problems like prime factorization, which have more efficient attack vectors. This understanding is vital for configuring and managing secure web traffic.

9/13/2013

This post significantly deepens the understanding of the foundational security mechanisms underpinning Cloudflare's offerings by explaining the critical importance of random number generation in secure systems. It details how vulnerabilities in pseudo-random number generators (PRNGs) can be exploited, using the Hacker News session ID vulnerability as a prime example. The post also outlines the role of random numbers in various cryptographic protocols like SSL/TLS and WPA2, and introduces Cloudflare's initiative to improve its own random number generation by incorporating truly random data sources to enhance customer security.

8/23/2013

This post details the technical implementation of Cloudflare's new Web Application Firewall (WAF) which is written in Lua and embedded within Nginx using the HttpLuaModule. It describes the compilation process of WAF rules from mod_security and a new Cloudflare rule language into Lua code, including optimizations like clause reordering and regex simplification. The post also highlights the use of performance analysis tools like lulip and flame graphs to identify and address bottlenecks, leading to a median WAF decision time under 1ms. It also mentions the use of local variables, memoization, and caching for further optimization.

8/19/2013

Introduced a new, traditional rules-based Web Application Firewall (WAF) to complement the existing heuristic-based WAF. This new WAF is user-configurable, accepts ModSecurity rule syntax, adds less than 1ms of latency per request when processing the full OWASP ruleset, updates globally within 30 seconds, provides data and feedback on triggered rules, and scales to handle billions of requests daily. This addresses criticisms of the previous heuristic-only approach regarding testability and the need for explicit rules for specific threats or compliance requirements.

7/30/2013

This post elaborates on Cloudflare's DDoS prevention capabilities by explaining how the proxy service shields the origin server from direct attacks. It highlights the critical need to keep the origin IP address secret and provides actionable advice on how to achieve this, including managing subdomains, reviewing DNS records, isolating services, and preventing information disclosure vulnerabilities. This adds a crucial layer of detail to the existing understanding of Cloudflare's threat management by focusing on origin protection strategies.

7/12/2013

This post details Cloudflare's proactive approach to TLS security by reevaluating and configuring ciphersuites to mitigate new attacks against the RC4 cipher. It explains the technical aspects of TLS, ciphersuites, and the importance of forward secrecy, highlighting Cloudflare's preference for ECDHE ciphers and its readiness for TLSv1.2, while acknowledging the ongoing challenges with widespread adoption and the vulnerabilities in commonly used ciphers like RC4 and AES-CBC.

6/12/2013

This post addresses concerns about government surveillance programs like PRISM and their potential impact on SSL/TLS security. It explains how Cloudflare's default use of 2048-bit keys and preference for ECDHE cipher suites (which use a different private key for each session) significantly enhances security against potential decryption of historical traffic. The post also discusses the technical feasibility of breaking SSL keys and suggests alternative theories for how surveillance might occur, emphasizing Cloudflare's commitment to trust, security, and transparency.

4/25/2013

Cloudflare automatically applied a network rule to protect all accounts against a remote code execution vulnerability in W3 Total Cache (versions 0.9.2.8 and below) and WP Super Cache (versions 1.2 and below). The vulnerability, discovered by Sucuri, allows attackers to execute arbitrary PHP code on a server by exploiting functions like mfunc, mclude, and dynamic-cached-content. The post emphasizes the importance of immediate plugin upgrades despite the network-level protection.

4/11/2013

This post details the real-time deployment of a WAF rule to detect and block a specific WordPress brute-force attack targeting administrative portals. It highlights Cloudflare's ability to 'patch the Internet in realtime' by automatically rolling out this fix to all customers, including free tier users, demonstrating a rapid response mechanism for emerging security threats.

4/8/2013

This post details the implementation of 'Project Bondage,' which involves port bonding (specifically 802.3ad Dynamic Link Aggregation) and custom IRQ handling on servers. This significantly increases network throughput and improves the ability to handle large SYN flood attacks by intelligently spreading network interrupts across multiple CPU cores and isolating internal LAN traffic from external traffic. This directly enhances Cloudflare's capacity to mitigate sophisticated DDoS attacks and protect customers.

3/27/2013

This post details Cloudflare's mitigation of the massive Spamhaus DDoS attack, which peaked at 120Gbps and threatened to disrupt internet infrastructure. It highlights Cloudflare's Anycast technology's ability to absorb such attacks and details how attackers shifted tactics to target Cloudflare's upstream peers and Internet Exchanges (IXs), including LINX, AMS-IX, and DE-CIX. The post emphasizes the scale of the attack, its impact on Tier 1 networks and IXs, and Cloudflare's role in developing best practices to secure IX infrastructure. It also reiterates the critical problem of open DNS recursors as an enabler of these large-scale attacks.

3/20/2013

This post details Cloudflare's mitigation of a massive 75Gbps Layer 3 DDoS attack against Spamhaus, highlighting the use of DNS reflection and ACK reflection techniques by attackers. It showcases how Cloudflare's Anycast network effectively dilutes and absorbs such large-scale attacks, preventing them from reaching the customer's servers. The post also emphasizes the importance of educating network operators to close vulnerabilities like open DNS resolvers, which are a major source of these attacks.

2/22/2013

This post highlights Cloudflare's proactive efforts to combat DDoS amplification attacks by identifying and working with network providers to close open DNS resolvers. It demonstrates a shift from solely absorbing attacks to addressing their underlying causes, contributing to a more secure internet infrastructure. The post also showcases the positive impact of Cloudflare's 'name-and-shame' approach and its partnerships with organizations like Team Cymru and SoftLayer in achieving this goal.

2/14/2013

This post details the evolution of Cloudflare's 'I'm Under Attack' Mode (IUAM). It highlights how the initial simple math challenge was reverse-engineered by malware named 'OutFlare', prompting Cloudflare to immediately deploy an updated, more complex version. The post also introduces the concept of 'proof of work' challenges, inspired by Bitcoin, as a future enhancement to combat sophisticated attacks, emphasizing Cloudflare's advantage in real-time updates and adaptation within its cloud service.

2/8/2013

This post details how a bug in Facebook's Connect script caused widespread website redirects, highlighting the risk of JavaScript widgets acting as single points of failure. It explains how Cloudflare's Rocket Loader feature, an on-page JavaScript optimizer with failsafes, and the Cloudflare Apps Program, which ensures apps are performant and centrally manageable, help mitigate such risks by preventing misbehaving widgets from hijacking sites and causing outages.

2/4/2013

This post details Cloudflare's proactive protection against the 'Lucky Thirteen' SSL vulnerability, which was announced shortly after Cloudflare received early notification. It highlights Cloudflare's default SSL configuration's inherent protection by deprioritizing vulnerable ciphers, and provides recommendations for users to secure their own servers by upgrading OpenSSL and prioritizing RC4 ciphers.

12/11/2012

This post details Cloudflare's efforts to significantly improve SSL/TLS handshake performance. It describes the implementation of OCSP stapling and, more importantly, the development of an automated system for intelligently bundling SSL certificates. This system optimizes certificate chains by finding the shortest, most ubiquitous, and secure path from a user-uploaded certificate to a trusted root, reducing data transmission and improving connection speeds. Cloudflare also committed to sharing their findings and tools, like an intermediate certificate directory and an SSL bundler, with the wider community.

11/28/2012

This post details Cloudflare's exploration and adoption of two-factor authentication (2FA) to enhance account security. It highlights the decision to implement Time-based One-time Password (TOTP) based solutions, specifically favoring Authy over alternatives like SMS or Google Authenticator due to security concerns (e.g., carrier network insecurity, Google's past flaws, inability to revoke tokens, sync issues, and cumbersome phone upgrades). The post emphasizes Authy's superior implementation, including better token revocation, clock synchronization, seamless phone upgrades, and stronger cryptographic standards, ultimately leading to the rollout of 2FA as a feature for all customers.

11/28/2012

This post introduces two-factor authentication (2FA) as a new layer of account security for Cloudflare customers. It details the integration with Authy to provide a free, mobile-based token generation service, significantly enhancing login security beyond just email and password.

11/28/2012

This post highlights Cloudflare's role in protecting websites on both sides of a Middle Eastern conflict, demonstrating its ability to mitigate large-scale Layer 7 cyberattacks that intensified during a ceasefire. It emphasizes Cloudflare's neutral stance as a protective proxy, ensuring website availability regardless of the political affiliations of the site owners or attackers, and underscores the company's commitment to keeping all ideas online.

11/1/2012

This post details Cloudflare's partnership with GlobalSign to significantly improve SSL performance by caching OCSP and CRL requests. This initiative reduces the latency of SSL certificate validation from an average of 500ms to under 100ms, saving approximately 1.5 years of time daily across the web. This directly contributes to making HTTPS connections faster and promotes the adoption of secure protocols like SPDY, aligning with Cloudflare's mission to create a faster and safer internet.

10/31/2012

This post details Cloudflare's infrastructure resilience during Hurricane Sandy, highlighting the robustness of its data centers against power outages and network failures. It showcases how the network automatically rerouted traffic around undersea cable failures and how the 'Always Online' feature served static content when origin servers were impacted. The post also notes the minimal impact on traffic to Cloudflare's own data centers in the affected region, suggesting that users with connectivity remained highly engaged.

10/30/2012

This post provides a deep dive into DNS amplification DDoS attacks, explaining their mechanics and how they leverage open DNS resolvers to amplify traffic. It highlights how Cloudflare's global network and wholesale bandwidth purchasing model inherently protect it and its customers from such attacks, as the distributed nature of the network dilutes the attack's impact and the cost model prevents bandwidth overages from being a concern. The post also contrasts these modern amplification attacks with older SMURF attacks, showcasing the evolution of threat vectors and Cloudflare's ability to adapt.

10/29/2012

This post introduces OCSP Stapling as a significant performance enhancement for SSL connections. It explains the overhead associated with traditional OCSP/CRL checks for certificate revocation and details how OCSP Stapling reduces this overhead by 'stapling' the OCSP response to the SSL handshake, making HTTPS connections approximately 30% faster. Cloudflare's network-wide implementation of this feature is highlighted as a key contribution to making SSL adoption more appealing.

9/16/2012

This post details a significant network outage caused by a misapplied network rate limit during a large DDoS attack. It highlights the challenges of manual mitigation during high-traffic events and underscores the importance of automated systems and rigorous testing for network changes to prevent future disruptions and ensure reliability.

8/16/2012

This post details the nature and prevalence of Layer 7 Distributed Denial of Service (DDoS) attacks against Cloudflare sites. It highlights that these attacks, while less common in terms of originating IP addresses, constitute the vast majority of DoS attacks. The post analyzes attack patterns by day of the week, time of day, and across the year, identifying specific trends and dips. It also provides insights into the geographical origins of these attacks and the types of networks commonly used. The post underscores Cloudflare's ongoing efforts to defend against these sophisticated attacks and its mission to keep customer websites online.

8/6/2012

This post analyzes attack statistics from July 2012, highlighting that a significant portion of attacks originate from 'Martian IP addresses' (invalid on the public internet, often due to spoofing or internal network usage). It details the mechanics of IP spoofing and explains how reflection attacks, particularly DNS amplification, are used to amplify attack bandwidth and obscure the true source. The post emphasizes that source IP addresses in Layer 3/4 attacks are often unreliable, contributing to Cloudflare's understanding of threat landscapes.

8/5/2012

This post introduces Always Online v.2, a significant improvement to the "Always Online" feature. It details the history of the feature, explaining its accidental origin from bot caching strategies and its initial limitations due to reliance on search engine crawlers. The post announces the release of v.2, which addresses these limitations by implementing an active crawling mechanism to build and maintain the cache, ensuring greater reliability when origin servers are down. It also outlines the different crawl frequencies for various customer plans and hints at future user control over caching.

8/3/2012

This post provides a detailed statistical analysis of Denial of Service (DoS) attacks targeting Cloudflare's network in 2012. It highlights the timing of these attacks (peaking mid-week and during US night hours), the protocols used (UDP and TCP), common attack vectors (SYN flooding, DNS and SNMP reflection), and the increasing intensity of attacks through methods like 'carpet bombing'. It also notes the emergence of 'booter' websites for short-duration attacks and the adaptation of attackers to other methods beyond simple DoS. The post underscores the continuous nature of these threats and Cloudflare's ongoing efforts to combat them.

7/1/2012

This post details the initial implementation of a process to identify and block phishing URLs hosted on Cloudflare sites. It describes the manual process of notifying site owners and serving a warning page, and outlines the benefits of this new anti-phishing process for site visitors and owners. It also provides steps for site owners to protect their sites from future hacks and phishing attempts, and instructions on how to report phishing pages on the Cloudflare network.

6/27/2012

Introduced integration with Dome9, a security management service, to enhance server firewall security. This integration allows for the creation of specific firewall rules that only permit traffic from Cloudflare's proxy servers to ports 80 and 443. Additionally, it enables on-demand opening of administrative ports (e.g., SSH, phpMyAdmin) for specific users, services, and time periods, thereby reducing the attack surface. Dome9's 'Magic IPs' feature automates the maintenance of Cloudflare's IP address lists.

6/19/2012

This post introduces and explains Kerckhoff's Principle, emphasizing that security systems should rely on the strength of their algorithms and the secrecy of keys, not on the obscurity of their design. It applies this principle to Cloudflare's password storage practices, highlighting the use of bcrypt and random salts as secure methods that do not require secrecy of the system's details.

6/18/2012

This post significantly deepens the understanding of website security by focusing on the critical aspect of password storage. It explains the evolution of password security from insecure plain text and basic hashing to more robust methods like salted hashing and finally introduces bcrypt as a solution for future-proofing against increasingly sophisticated password cracking techniques. It highlights the importance of both secure storage algorithms and strong user passwords.

6/2/2012

This post addresses the BEAST SSL attack by implementing TLS 1.1 and 1.2, and prioritizing RC4 cipher suites across the Cloudflare network. It also enhanced SSL cipher support, leading to a 30% improvement in SSL performance and achieving a 90 (A) score from SSL Labs, surpassing major websites.

5/3/2012

This post introduces the "Visitor DNSChanger Detector App," a proactive security measure developed by Cloudflare. This app, deployable via the Cloudflare Apps marketplace or as open-source JavaScript, identifies users whose systems are infected with DNSChanger malware and are using compromised DNS servers. It informs these users about their infection and directs them to resources for remediation, thereby preventing potential internet access loss and protecting them from malicious redirection. This initiative highlights Cloudflare's role in broader internet health and user safety, extending beyond direct website security to address systemic threats.

5/1/2012

This post introduces Cloudflare's foundational WebOps capabilities, covering security, metrics, acceleration, reach, and transformation. It highlights automated attack blocking, DDoS mitigation, one-click SSL enablement, and content protection against scraping. The service aims to provide enterprise-grade security and performance tools to all website owners, regardless of size, through a simple five-minute configuration change.

4/12/2012

Introduced 'I'm Under Attack Mode,' a new security level that adds an additional set of protections against potentially malicious HTTP traffic. This mode presents an interstitial page to visitors for approximately 5 seconds while automated security checks are performed, requiring JavaScript and cookies. It is designed to not negatively impact SEO or known legitimate visitors, and data from failed checks is fed back into Cloudflare's system to enhance traditional protections.

4/11/2012

Introduced ScrapeShield, a new anti-scraping service that leverages Cloudflare's existing bot profiling intelligence and infrastructure. ScrapeShield builds on the foundation of Project Honeypot, which has been profiling bots since 2004, to detect and alert website owners to content scraping. It also provides insights into how content is consumed off-site (e.g., RSS feeds, translation apps).

3/29/2012

Introduced ScrapeShield, a new app that leverages existing Cloudflare features (email obfuscation, hotlink protection) and adds new capabilities to combat content scraping. ScrapeShield uses invisible tracking beacons to detect when content is scraped and republished on other sites. This data is fed back into Cloudflare's protection system to automatically block identified content scraping bots. A new feature called 'Maze' was created to route known content scrapers into a virtual labyrinth, consuming their resources. A 'no-pinning' meta tag option was also introduced to prevent image pinning.

3/1/2012

This post addresses a common customer pain point by expanding the range of supported web ports beyond 80 and 443 to include common control panel ports. While these ports are proxied, they do not undergo caching or performance transformations. The post also clarifies why non-web protocols like FTP and SSH cannot be proxied due to the lack of HOST headers, and highlights the security benefit of this limitation. It also mentions that traffic data from attempted attacks on these blocked protocols is fed back into Cloudflare's system for learning.

2/24/2012

This post details a major incident involving a failed DNS infrastructure update that caused significant downtime for customers. It highlights the challenges of DNS propagation, the impact of external caches (like ISPs), and how concurrent DDoS attacks exacerbated the issue. The post also discusses the immediate response, the process of recovery, and the implementation of new safeguards to prevent similar incidents, particularly focusing on improving DNS update speed and hardening against DNS-directed DDoS attacks.

1/27/2012

This post highlights Cloudflare's capability to handle significant traffic surges, specifically for Khataland.com during a TODAY Show promotion. It details how Cloudflare absorbed a large majority of bandwidth usage and protected the site from potential denial-of-service attacks, ensuring the website remained fast, available, and secure. The setup process is described as simple and quick, with immediate positive results in handling over 60,000 views and significant sales within the first hour.

12/22/2011

This post quantifies a 700% increase in DDoS attacks in 2011, categorizing them by political and financial motivations. It emphasizes Cloudflare's commitment to keeping sites under attack online, reinforcing its role in threat management.

11/19/2011

This post provides troubleshooting guidance for common website issues encountered by Cloudflare users. It details how to diagnose server unavailability using `curl`, explains how to access cPanel and FTP when using Cloudflare as a reverse proxy, and addresses potential conflicts with features like Rocket Loader and Auto Minify. It also covers cache management strategies, including the use of Development Mode and cache purging, and emphasizes the importance of allowlisting Cloudflare IPs and installing `mod_cloudflare` for proper logging and IP restoration. Finally, it outlines procedures for reporting Cloudflare-specific issues and temporarily deactivating the service for debugging.

11/5/2011

This post introduces a significant simplification and enhancement to Cloudflare's SSL offering. Previously a complex, paid add-on requiring manual configuration and waiting periods, SSL is now automatically included with every paid plan at no additional cost. It introduces a 'flexible' SSL mode that encrypts traffic between visitors and Cloudflare's network, making SSL accessible even for platforms that don't support server-side certificate installation. This dramatically lowers the barrier to entry for website security.

10/18/2011

This post introduces Cloudflare's authoritative DNS service, emphasizing its robustness, speed, and free availability. It explains the distinction between recursive and authoritative DNS and highlights how Cloudflare's Anycast-powered DNS, distributed across its global data centers, provides a significant advantage in performance and reliability compared to typical registrar-provided services. This foundational DNS capability is presented as a key enabler for Cloudflare's broader mission of protecting websites.

9/16/2011

This post introduces the Cloudflare API as a tool for customers to programmatically manage their Cloudflare settings. It highlights five frequently used API calls: enabling development mode, purging the cache, pulling basic statistics, reporting spam, and updating the challenge page screen capture. The spam reporting feature is explicitly linked to improving Cloudflare's threat intelligence and making the system smarter for all users.

9/8/2011

This post introduces Cloudflare's integration with GlobalSign for SSL certificate issuance and highlights Cloudflare's capability to automatically manage and reissue SSL certificates for its users in the event of a Certificate Authority (CA) compromise. It explains the importance of SSL for encryption and identity validation and discusses the risks associated with compromised CAs, emphasizing Cloudflare's resilience and automated response mechanisms.

8/25/2011

This post details Cloudflare's rapid response to the 'Apache Killer' zero-day exploit. It highlights how Cloudflare, by analyzing the exploit's mechanism (malformed byte-range headers), was able to implement a network-wide fix within 24 hours, protecting users automatically without requiring any configuration changes. This demonstrates Cloudflare's ability to act as a shield against emerging threats by patching its network edge.

7/20/2011

This post introduces Cloudflare's capability to identify and notify users running infected machines, providing them with tools to clean up malware. This is presented as a mechanism to break the 'cycle of malware' by preventing compromised websites from distributing infectious code and by empowering websites to inform their infected users. The security settings (Low, Medium, High) are discussed in the context of challenging visitors with CAPTCHAs.

6/26/2011

This post details how Cloudflare addressed an issue where search engine crawlers were reducing crawl rates for sites behind Cloudflare due to issues with a single origin server. Cloudflare developed a new technology to automatically change a site's Cloudflare IP addresses to isolate it from other sites when a problem is detected. They also collaborated with search engine crawl teams to ensure Cloudflare's IP ranges were categorized correctly, allowing search engines to crawl at maximum velocity without overburdening origin servers. This resulted in improved SEO rankings and page speed scores for users.

5/25/2011

This post introduces Cloudflare Apps, a new service that allows users to integrate third-party web applications and widgets into their websites with a single click, without requiring code changes. This directly addresses user concerns about the performance and security risks associated with manual code insertions, enhancing the overall security posture of websites by simplifying the integration of external services and ensuring they are automatically updated.

4/21/2011

This post introduces the ability for users to query individual visitor IP addresses through the Cloudflare API. This feature allows users to gain insights into traffic origins, identify potential attacks by analyzing IP hit frequency, and proactively add malicious IPs to the Block List via the Threat Control panel. This directly contributes to the community-driven threat intelligence by enabling users to take action against identified threats.

4/5/2011

This post details the foundational approach of building a distributed security network that learns from attacks across its user base to improve protection for all sites, focusing on analyzing log data for anomalies like high 404 rates, crawler behavior, and known attack signatures, while also scoring legitimate user behavior to minimize false positives.

2/11/2011

This post introduces the 'Basic Security Level' setting, which allows users to adjust website security between High, Medium, and Low. It explains how Cloudflare protects against bots and compromised users by presenting CAPTCHA challenges. It also details 'Challenge Page Customization' for branding the challenge page and 'Development Mode' to bypass caching for immediate static file updates. Additionally, it covers 'Purge Cache' to expire cached resources and the integration with Google Analytics.

1/15/2011

This post introduces and explains the 'Threat Control' panel within Cloudflare's dashboard. It details how users can view and manage malicious traffic, categorizing threats into types like spammers, exploit attackers, botnet zombies, email harvesters, and bad bots. It outlines the information provided for each threat (type, date/time, IP, country, status, action) and explains the '!' high priority alert system. The post also details how to take action against threat alerts by blocking or trusting IP addresses, IP ranges, and countries, and explains the difference between challenge pages and blocked visitors. It provides guidance on reviewing entries, handling false positives, and managing dynamic IPs.

12/2/2010

This post details the early benefits of Cloudflare's traffic blocking and acceleration for small businesses. It quantifies the reduction in bad requests (9,000 from 1600 threats), saved visitor browsing time (10.3 days), bandwidth saved (29.9 GB), and improved average page load time (from 2.03s to 1.2s, a 40% improvement). It also mentions the ease of integration via DNS changes and the optional `mod_cloudflare` Apache module for restoring original visitor IPs.