February 2017 Summaries

On February 23, 2017, John Graham-Cumming from Cloudflare reported a security problem with their edge servers that was discovered by Tavis Ormandy from Google's Project Zero. The issue involved some unusual circumstances where the edge servers were running past the end of a buffer and returning memory containing private information such as HTTP cookies, authentication tokens, HTTP POST bodies, and other sensitive data. Some of this data had been cached by search engines. The problem was quickly identified and fixed after disabling three minor Cloudflare features that were using the same HTML parser chain causing the leakage. A cross-functional team from software engineering, infosec, and operations formed in San Francisco and London to fully understand the underlying cause, the effect of the memory leakage, and to work with Google and other search engines to remove any cached HTTP responses. The bug was serious because the leaked memory could contain private information and because it had been cached by search engines. The greatest period of impact was from February 13 and February 18 with around 1 in every 3,300,000 HTTP requests through Cloudflare potentially resulting in memory leakage (that’s about 0.00003% of requests). The root cause of the bug was a pointer error in the Ragel code used to parse HTML pages on the fly. The problem had been dormant for years until the internal feng shui of the buffers passed between NGINX filter modules changed with the introduction of cf-html. After identifying and fixing the issue, Cloudflare worked closely with Google and other search engines to purge any cached HTTP responses containing leaked memory. They also undertook a project to fuzz older software looking for potential other security problems.

The text discusses the performance optimization of LuaJIT code at Cloudflare. It highlights that optimizing LuaJIT code is crucial to improve overall performance, especially for core parts like inner loops. The author introduces a tool called Loom, which helps in understanding and analyzing LuaJIT's workings by providing more detailed information than the standard -jdump option. Additionally, the text discusses how the implementation of next() function has been optimized to improve performance.

Cloudflare has expanded its two-factor authentication options, allowing users to use Google Authenticator or any Time-based One Time Password (TOTP) app of their choice. This feature is crucial for account security as it prevents unauthorized access even if passwords are compromised. Two-factor authentication uses a second factor, such as a code generated by an app, in addition to the user's password. Cloudflare has implemented an open TOTP integration, enabling users to choose from various apps like Symantec, Duo Mobile, and 1Password for secure login.

In 2016, Janet Van Huysse discovered Cloudflare while searching for companies that aligned with her values. She was particularly interested in Path Forward, a nonprofit organization that helps individuals return to the workforce after taking time off to care for family members. The program offers an 18-week returnship where participants can re-enter the workforce and potentially be hired full-time by the company. Cloudflare has embraced this program, as it values experienced professionals who bring maturity and professionalism to their roles. The company recently hosted a graduation event for its Path Forward participants and plans to continue participating in the program.

Cloudflare has released a beta version of its TLS 1.3 implementation, which is based on Go's standard library, crypto/tls. The company engaged NCC Group's Cryptography Services to audit the security of the implementation at the end of 2016. The codebase for Cloudflare's TLS 1.3 can be found on its GitHub page and is a drop-in replacement for crypto/tls, with a go wrapper provided for patching the standard library as needed. Although currently targeted only for internal use, the final goal is to upstream the patches to the Go project so that all users of the Go standard library benefit from it.

The Cloudflare Grafana plugin allows users to visualize their Domain Name System (DNS) traffic, including response code breakdowns and query types. This open-source data visualization tool helps identify localized issues and understand the global distribution of traffic. Users can filter by specific data centers, record types, query types, response codes, and query names for more detailed analytics. The plugin is built on Cloudflare's new DNS analytics API, which provides high resolution data at a large scale.

Cloudflare is hosting a cryptography meetup at their San Francisco headquarters on February 28, 2017. The event will feature speakers discussing topics such as post-quantum cryptography, data encryption in Google's cloud, and Certificate Transparency. Deirdre Connolly will cover isogeny-based crypto and recent results regarding supersingular isogeny Diffie-Hellman. Maya Kaczorowski will discuss how Google encrypts data at rest and best practices for implementing encryption in storage systems. Andrew Ayer will explore Certificate Transparency, its benefits, and future developments.

Cloudflare has reported on several DDoS ransom groups, including copycats claiming to be Armada Collective and Lizard Squad. It advises against paying the ransom as it perpetuates their activities and encourages other would-be attackers. A new group targeting financial institutions sends a small demonstration attack before sending the ransom email. The main difference between this group and previous ones is that they actually send a small demonstration attack before sending the ransom email to demonstrate their capability. However, if the ransom amount is not paid before the deadline expires, the group does not launch a second attack. Cloudflare recommends having a DDoS protection plan in place ahead of time and implementing it before a security event occurs.

The North American Network Operators Group (NANOG) is a non-profit membership organization that holds conferences to discuss network-related issues. NANOG's next conference will take place in Washington, DC from February 6-8, 2017, and will be attended by nearly 900 network professionals. The conference covers topics such as tutorials on various network tasks, peering discussions, security and reputation concerns, network operations best practices, network automation, and more. NANOG is not the only forum for discussing these issues; other organizations include IETF, ICANN, ARIN, and regional NOGs. Cloudflare's network team attends various operational-focused conferences to interact with networks around the globe.

On February 1, 2017, a severe vulnerability was announced by the WordPress Security Team that allowed unauthenticated users to change content on websites using unpatched (below version 4.7.2) WordPress. The issue was discovered by Sucuri and reported to WordPress. In response, the WordPress team collaborated with WAF vendors like Cloudflare to implement protection measures before a patch became available. Two rules were rolled out to protect against exploitation of this vulnerability. These rules are automatically turned on for customers on paid plans, while free users can upgrade to a paid plan and enable the Cloudflare WordPress ruleset in the WAF for full protection.

On February 01, 2017, Filippo Valsorda and Nick Sullivan delivered a talk about Transport Layer Security (TLS) 1.3 at the 33rd Chaos Communication Congress in Hamburg, attended by over 13,000 hackers. The talk covered TLS 1.3's technical details, its speed and security improvements, history, and current status. A recording of the talk is available online, as well as a slide deck. Additionally, TLS 1.3 has been released for Chrome and Firefox users, offering faster and more secure browsing on websites with Cloudflare's TLS 1.3 beta enabled.