February 2016 Summaries

A buffer overflow error in GNU libc DNS stub resolver code was announced as CVE-2015-7547. This vulnerability affects any platform with recent GNU libc, including servers and personal computers. The only effective mitigation is patching the system. Limiting UDP response size to 2048 bytes or less does not work and may force legitimate queries to retry over TCP. Running a local caching DNS resolver can improve internet performance and prevent past and possibly future security vulnerabilities, but it's not sufficient to defuse this attack. An off-path attack scenario is also possible through a caching DNS resolver. The key factor to a real world non-MitM cache resolver attack is controlling the messages between the resolver and the client indirectly.

Cloudflare has launched its own ICANN accredited registrar to provide high-security domain registration services for its enterprise customers. The company's move comes after it realized that existing registrars did not meet its security standards, and the only way to ensure maximum protection was to become a registrar itself. Cloudflare Registrar implements strict change control processes, including two-factor authentication, multi-user offline confirmation for all DNS changes, consistent use of registrar lock, and registry lock. It also supports DNSSEC by default, adding an additional layer of security against on-path attacks. The service is currently available to enterprise customers who care about the highest level of domain registrar security.

Cloudflare is hosting the Null Security meetup in Singapore on February 24th from 6:45pm to 8:45pm at The Working Capitol. This event is for hackers and security enthusiasts, with topics including DDoS attacks, security news bytes, and DNS hijacking. Registration is required, and interested attendees can sign up through the provided link. Cloudflare is also actively hiring in Singapore.

Cipher block chaining (CBC) has been widely used in cryptography but has proven difficult to use safely. Recent trends in the adoption of secure ciphers by web clients have helped reduce the web's reliance on this technology. One solution to the issues with CBC is AEAD (Authenticated Encryption with Associated Data), which combines a stream cipher and an authentication step along the way rather than computing the MAC at the end. CloudFlare implements two such cipher modes, AES-GCM and ChaCha20-Poly1305. Adoption of AEAD cipher modes in clients is growing, with most modern browsers and operating systems supporting at least one AEAD cipher suite in their TLS software.

Microsoft products Internet Explorer and Edge were having trouble maintaining HTTPS sessions with a customer's website due to issues with the handling of TLS session tickets by the SChannel security package, which provides TLS functionality for many Microsoft applications. The problem was fixed after Cloudflare reported it to Microsoft, who then released software updates for affected platforms.

In December 2015, Cloudflare released HTTP/2 support for all customers. Since then, the number of browsers supporting HTTP/2 has more than doubled, with Chrome and Firefox versions showing significant increases in market share. The percentage of traffic served via HTTP/2 on www.cloudflare.com has also increased from 23.62% to 52.93%. Additionally, Cloudflare enabled over 58,000 websites with "True Support" for HTTP/2, more than quadrupling the number of such sites.