April 2015 Summaries

Distributed Denial of Service (DDoS) attacks have become more diversified in recent years, with attackers using malicious JavaScript to trick unsuspecting web users into participating in these attacks. Unlike NTP or DNS reflection attacks, the potential volume for a JavaScript-based DDoS is nearly unlimited as any computer with a browser can be enrolled in the attack. This article discusses how attackers have been using malicious sites, server hijacking, and man-in-the-middle attacks to launch DDoS attacks. It also describes ways to protect your site from being used in these attacks by using HTTPS and an upcoming web technology called Subresource Integrity (SRI).

On April 29, 2015, Cloudflare introduced Multi-User functionality for its Enterprise customers. This feature allows multiple team members to manage a single Cloudflare account with different levels of access based on their roles. The Super Administrator has the highest level of control and can add or remove users, change permissions, and edit all settings. Other roles include DNS Administrators, Analytics Administrators, and more. This feature also supports two-factor authentication (2FA) for added security. Multi-User is currently available to Cloudflare Enterprise customers.

CloudFlare has announced a major redesign of its customer user interface (UI). The company realized that the previous UI was not scalable and could not accommodate all the new features added over time, especially for customers managing thousands of domains. The new UI is designed to be more intuitive, flexible, and responsive, allowing users to manage CloudFlare from any device. It organizes features into logical categories under a dock of apps, with both pre-installed and third-party apps available. The redesign aims to improve the user experience and accommodate future growth and development of CloudFlare's platform.

On April 25, 2015, the Magento Security Team introduced a new ModSecurity rule to address an essential RCE (remote code execution) vulnerability in the Magento e-commerce platform. Users of the WAF (Web Application Firewall) should enable protection by clicking the ON button next to the "CloudFlare Magento" Group in the WAF Settings. Both Magento version 1.9.1.0 CE and 1.14.1.0 EE are affected by this vulnerability, and while CloudFlare WAF can help mitigate such issues, it is crucial for Magento users to apply the patch for SUPEE-5344 immediately.

A recent phishing campaign detected by Cloudflare appears to be using a new WordPress 0day vulnerability. The attack involves sending out emails with links that lead to compromised WordPress sites hosted by Bluehost, which then attempt to collect users' credentials. This is not the first time such an attack has occurred, and it highlights the importance of protecting vulnerable CMS sites to prevent potential victims from being exploited. Cloudflare has worked with Bluehost to identify and neutralize the remaining affected sites in this campaign. Users can stay safe by following tips such as never clicking on links in unsolicited emails, being vigilant about spelling and URLs, and enabling two-factor authentication where possible.

Ryan Lackey and Marc Rogers will be speaking at the RSA Conference in San Francisco about an open-source network security device called PORTAL. The device is designed to make travel safer for individuals with phones, tablets, laptops, and other network-connected devices by using open-source software and services on inexpensive commodity travel routers. CloudFlare supports projects like this because they value the foundation of security tools and research that has been built over time through academic interest and personal curiosity. The company contributes to the open source community by providing bug fixes, new functionalities, and their own PKI toolkit, CFSSL. They also encourage employees to participate in the security community through various activities such as research, creating new tools, and participating in conferences or working groups.

Cloudflare has expanded its network in Oceania by launching data centers in Auckland and Melbourne to improve performance and redundancy for users in the region. Previously, all traffic from Australia and New Zealand was routed through a single data center in Sydney. The new data centers allow for localized content delivery and improved latency for Internet users in both countries. Additionally, they provide redundancy in case of failure at any individual data center. This expansion also opens up new peering opportunities, which are crucial to the performance and overall health of Cloudflare's network.

On April 15, 2015, new information emerged about the MS15-034 vulnerability affecting Windows web servers. A proof of concept (PoC) code has been released that can cause a server to hang when it receives an HTTP Range header containing large byte offsets. To address this issue, CloudFlare implemented a Web Application Firewall (WAF) rule blocking such requests. Customers on a paid plan with WAF enabled are automatically protected against this problem. It is strongly advised to update IIS and Windows servers as soon as possible; in the meantime, any attempts to exploit this Denial of Service/Remote Code Execution vulnerability through CloudFlare will be blocked.

On April 13, 2015, CloudFlare announced its new status as a Google Cloud Platform Technology Partner. This collaboration allows Google Cloud Platform customers to benefit from the protection and power of CloudFlare's community while enjoying the flexibility and scalability offered by Google's infrastructure. The partnership makes it easier for mutual customers to use CloudFlare services, offering benefits such as faster content delivery, heightened optimization and security, increased web performance speed, global edge network caching, and protection against DDoS and SQL injection attacks. For more information on the partnership, visit https://www.cloudflare.com/google.

The ASCII table has a peculiarity where uppercase letters have an ASCII code 0x20 less than their lowercase counterparts. This fact can be used in certain situations to convert ASCII text to uppercase using bitwise AND operation, which is particularly useful when dealing with protocols that use USASCII characters for their commands such as SMTP, POP3, DNS names and HTTP headers. In C programming language, this trick can be employed to make very fast case-insensitive comparisons in situations where high performance is required, like handling millions of DNS packets per second.

Albert Strasheim from Cloudflare shares their experience in building out a new Data Platform to handle rapidly increasing log volume due to traffic growth exceeding 400% annually. They started with a log processing pipeline built using Perl scripts, C++ programs and PostgreSQL for data storage. As the company grew, they needed a more scalable solution and discovered CitusDB, which scales out PostgreSQL for real-time workloads. The new pipeline includes an HTTP access log event that proceeds through various stages before being inserted into the CitusDB database with further rollups to 1-hour and 1-day granularity. They chose Go as their programming language due to its simplicity, performance, and extensive ecosystem of third-party libraries. Kafka was selected for its ability to provide a queue with persistence, real-time data processing, and compatibility with other languages. The CitusDB architecture enables horizontal scaling, high availability, and compatibility with PostgreSQL extensions like HyperLogLog and Hstore. Overall, the new Data Platform has improved performance and scalability while allowing for efficient storage of large amounts of historical analytics data.

CloudFlare has announced the launch of its 32nd data center in Buenos Aires, Argentina, marking its fifth deployment in Latin America following Santiago, São Paulo, Medellin, and Lima. The company aims to provide faster delivery of internet applications for users in Argentina as well as those who create them. This move will bring CloudFlare closer to nearly all of Latin America's 300 million internet users.