January 2014 Summaries

CloudFlare's global network has doubled its capacity over the past six months through hard work and dedication from their team. The company faced various challenges, including unexpected obstacles in data center upgrades, supply chain issues, and international equipment shipments. Despite these hurdles, the team managed to keep the network running smoothly. Looking ahead to 2014, CloudFlare plans to expand its data center footprint into new regions such as Latin America, the Middle East, Africa, and parts of Asia, with a focus on better serving their largest markets in China and Brazil.

CloudFlare's DNS service offers unique properties that allow users to do things that would be much harder or impossible with other providers. The company uses Anycast for its DNS routing, which directs requests to the nearest of its 24 data centers worldwide, reducing latency and improving website load times. Additionally, CloudFlare has TTLs of 5 minutes on all DNS records by default, allowing for quick changes in IP addresses or other DNS settings. These features make CloudFlare's DNS service one of the best in terms of reliability and speed within the industry.

In 2011, the BEAST attack on TLS v1.0's CBC encryption mode was discovered, prompting experts to recommend using RC4-based cipher suites as a mitigation strategy. However, attacks on RC4 were demonstrated in 2013, making this choice problematic. Since then, modern browsers have started supporting TLS v1.2, but open-source web servers and OpenSSL do not allow for fine-grained control over cipher suite usage based on protocol version. To address this issue, a patch has been released for OpenSSL that disables RC4-based cipher suites for connections using TLS v1.1 and above while leaving them enabled for TLS v1.0 users. This ensures protection against both the BEAST attack and attacks on RC4.

On January 27, 2014, the Department of Justice and the Director of National Intelligence announced a change in rules allowing companies to disclose the number of National Security Orders received, including National Security Letters (NSLs), in bands of 250. CloudFlare has published its initial Transparency Report on National Security Orders, revealing that it has received between 0-249 NSLs and FISA orders. The company believes the rule change is a step in the right direction but argues that NSLs violate due process principles and will challenge any NSLs they receive in court.

In August 2013, Cloudflare rolled out a new global Web Application Firewall (WAF) that runs common sets of firewall rules and also has a custom rule language for unique customer protection. Since then, numerous global and customer-specific rules have been deployed to protect websites from various attacks. Customers can report an attack, after which Cloudflare's support engineers write one-of-a-kind rules to block the specific threat. The rules are then pushed to their git repository and deployed worldwide within 30 seconds. This rapid response helps prevent overloading of customer web servers and mitigates potential threats.

The recent US Court of Appeals decision in Verizon v. FCC has raised concerns about the potential impact on network neutrality and the future of a free and open internet. While some argue that the ruling will spur innovation, others fear it may stifle new entrants and limit access to smaller players. CloudFlare, a strong supporter of an open internet, believes in fair markets and effective regulation to achieve this goal. The company is committed to documenting any potential harms resulting from the decision and advocating on behalf of startups and non-giants to preserve network neutrality principles.

In this blog post, Marty Strong, a Technical Support Engineer at CloudFlare, shares his experience working with a customer facing severe website performance degradation. The issue was resolved by setting up Page Rules to cache content and disabling an overly resource-intensive caching program on the server. After solving the problem, additional features were enabled in the customer's CloudFlare account for optimal website performance. Marty also mentions his background as a developer and former CloudFlare customer before joining the support team. The post concludes with an invitation to apply for Technical Support Engineer positions at CloudFlare's offices in London and San Francisco.

The text discusses NTP-based DDoS attacks, which have become popular recently and caused trouble for some gaming web sites and service providers. These attacks work by exploiting the Network Time Protocol (NTP), a simple UDP-based protocol that can be persuaded to return a large reply to a small request. The amplification factor of NTP is 206x, making it ideal as a DDoS tool. To mitigate these attacks, web site owners should make configuration changes to firewalls and NTP servers. Additionally, implementing BCP-38 would eliminate source IP spoofed attacks of all kinds (DNS, NTP, SNMP, ...).

On January 8th, 2014, Cloudflare opened its 24th data center in Valparaiso, Chile, marking their second location south of the equator and first in Latin America. Previously, all traffic from over 600 million inhabitants in Latin America was routed through Miami, causing significant latency for users in Chile and Argentina. The new data center aims to provide a faster and safer internet experience for Latin American users. Cloudflare plans to expand its network further throughout the region and globally.

On March 2013, a team from CloudFlare established a partnership with 1&1 Internet, one of the leading hosting companies in the world. This collaboration allows 1&1 customers to enjoy faster and more secure websites through integration with CloudFlare's services. The relationship has been beneficial for both parties, as well as their shared customers. One of the key benefits of this partnership is access to CloudFlare's Railgun technology, which optimizes website performance by caching static portions of dynamic content. This feature was previously only available in higher-tier plans but is now accessible to 1&1 customers at no additional cost due to their status as an Optimized Partner. The partnership between CloudFlare and 1&1 has opened the door for other hosting providers to become Optimized Partners, allowing them to offer Railgun technology to their clients. This collaboration benefits both the hosting companies and their customers by providing faster, safer, and more reliable hosted websites.

The article discusses the concept of backdoors in cryptographic algorithms or implementations that allow individuals to bypass security mechanisms. Backdoors can be intentionally inserted into software, hardware, or algorithm designs and have been used for mass surveillance by government agencies. An example is Dual_EC_DRBG, a pseudo-random bit generator ratified by the National Institute of Standards and Technology (NIST) in 2007, which allegedly has a backdoor inserted by the NSA. The article explains how random number generators can be manipulated to create predictable outputs, making systems vulnerable to attacks. It emphasizes the importance of having unpredictable sources of randomness in secure systems and highlights CloudFlare's efforts to ensure true randomness in their cryptographic systems.