September 2020 Summaries

In June 2019, Cloudflare's resolver team noticed a spike in DNS requests for the 65479 Resource Record due to data exposed through their new Radar service. They found these to be part of Apple’s iOS14 beta release where they were testing out a new SVCB/HTTPS record type. Cloudflare rolled out support across its customer base, allowing automatic support for new protocols like this. The new proposal, currently discussed by the Internet Engineering Task Force (IETF), defines a family of DNS resource record types ("SVCB") that can be used to negotiate parameters for a variety of application protocols. The generic DNS record "SVCB" can be instantiated into records specific to different protocols. One such instance is the "HTTPS" record, which can be used not only to signal to the client that it can connect in over a secure connection (skipping the initial unsecured request), but also to advertise the different HTTP versions supported by the website.

Cloudflare has launched a new service called Cloudflare Radar, which provides insights into Internet usage patterns and trends based on the company's aggregated data. The service tracks daily fluctuations in Internet use, as well as long-term growth trends. It also monitors cyberattacks and their changing techniques. Three key components of the service are Radar Internet Insights, Radar Domain Insights, and Radar IP Insights. These provide information on overall Internet traffic, popular domains, and individual IP addresses, respectively. The company plans to add more data points and features in the coming weeks and months.

On September 30th at 12:00 PM, Connor Peshek introduced the twentieth edition of "The Serverlist," a resource for serverless space enthusiasts. It includes latest news, tutorials for developers, discussions with fellow serverless developers, and information about upcoming meetups and conferences. To receive this content directly in your mailbox, sign up using the provided link while ensuring your privacy is maintained.

Cloudflare has announced a new privacy-first analytics service that is open to everyone, even if they are not already a Cloudflare customer. The analytics tool prioritizes user privacy and does not require tracking individual users over time for the purposes of serving analytics. It uses the concept of a visit, which is defined simply as a successful page view that has an HTTP referer that doesn't match the hostname of the request. This allows web creators to understand how their website is performing without sacrificing their visitors' privacy. The analytics tool provides essential metrics about a website such as page views and visits, and also offers flexibility with the ability to add arbitrary filters and slice-and-dice data as desired. For existing Cloudflare customers on Pro, Biz, and Enterprise plans, just go to your Analytics tab! Starting today, you'll see a banner to opt-in to the new analytics experience.

On September 29, 2020, Cloudflare announced a partnership with the Google Chrome team to integrate Web Vitals measurements into its Browser Insights tool. Web Vitals are a set of metrics designed to help web developers and website owners measure and understand load time, responsiveness, and visual stability. By incorporating these metrics into Browser Insights, users can now easily collect data from the entire web for free. The Core Web Vitals include Largest Contentful Paint, First Input Delay, and Cumulative Layout Shift, which provide a comprehensive understanding of website performance. Cloudflare's Browser Insights offers real-time data updates, supports multiple browsers, and is available at no cost to users.

Cloudflare has introduced Adaptive Bit Rate (ABR) to improve the quality and responsiveness of its analytics products. ABR allows for multiple resolutions of data, enabling faster ad hoc queries on reduced resolution tables while maintaining consistent response times and a better user experience. The technique is used with ClickHouse, a columnar store that stores and processes analytics data, covering seven orders of magnitude from 100% to 0.0001% of the original events. ABR also facilitates aggregations by making compact estimates of every dimension and supports other complex forms of aggregations such as "topK" and "count-distinct". The technology improves resilience and scalability, allowing for queries even under high tail latency or system failures. In the coming months, Cloudflare plans to release new dashboards and analytics products based on ABR.

Cloudflare has introduced Durable Objects, a new technology designed to provide a truly serverless approach to storage and state management. This feature enables developers to manage state with strong consistency and coordinate in real-time between multiple clients entirely on the edge without needing an origin server. Durable Objects are unique instances of a class that can have persistent state stored on disk, providing consistent, low-latency, distributed storage while eliminating the need for centralized servers. This technology is currently in closed beta and aims to make real-time collaboration more accessible across the web.

Cloudflare is celebrating its 10th birthday with a week-long series of Fireside Chats featuring prominent speakers from the tech industry and beyond. The event, which will be live on Cloudflare TV, includes discussions with Apple co-founder Steve Wozniak, Zoom CEO Eric Yuan, OpenTable CEO Debby Soo, Stripe co-founder John Collison, former Google CEO Eric Schmidt, and many more. The talks cover a wide range of topics related to the past, present, and future of the internet. No registration is required to watch the live sessions or their rebroadcasts in different time zones.

Cloudflare has launched Cron Triggers for its Workers, allowing users to schedule their workers on timed intervals instead of purely relying on incoming HTTP requests. This feature was highly requested and is available at no additional cost on both the free tier and the paid tier called Workers Bundled. Cron Triggers are useful for tasks like pulling data from APIs or running regular integration tests on a schedule. The triggers count towards the request cap but there will be no extra fees. Cloudflare's distributed system allows them to offer this feature at no additional cost by efficiently routing traffic during underutilized hours, passing the cost savings down to users.

Cloudflare has introduced Cron Triggers for its serverless compute platform, Cloudflare Workers. This feature enables developers to schedule jobs at fixed intervals, similar to the Unix cron pattern. The Cron Triggers are executed from the edge and can be used for running periodic tasks like maintenance or calling third-party APIs for updated data. A new event type has been added to support this feature, with plans for more non-HTTP event handlers in the future. The Cron Triggers feature is now live and available for developers to try out.

Cloudflare has introduced Durable Objects, a new technology designed to make it possible for applications to run entirely at the edge of the network with no centralized "origin" server. This feature provides a truly serverless approach to storage and state, offering consistent, low-latency, distributed storage while eliminating the need for external services that reintroduce operational concerns. Durable Objects are designed to be used in conjunction with Cloudflare Workers, which allows developers to run code at the edge of the network, improving performance and reducing costs compared to running code in a single datacenter. The closed beta of Durable Objects is currently underway, with interested users encouraged to request an invite.

Cloudflare, an internet security and content delivery network company, is celebrating its 10th anniversary since launching on September 27, 2010. The company has grown from a handful of employees to one of the largest networks in the world, serving millions of customers. Its mission to help build a better Internet seems more important than ever as the internet becomes increasingly integral to daily life. In its first year after going public, Cloudflare saw record expansion of new customers and growth among existing ones. The company has consistently rolled out the latest technologies ahead of others in the industry, making them available to everyone from individual developers to large corporations. This approach has helped democratize internet services and features that were once only accessible to a select few. The year 2020 has been challenging due to the COVID-19 pandemic, but Cloudflare adapted quickly by offering free access to its Cloudflare for Teams product to help businesses transition to remote work. The company also launched new products and services during this time, including a series of updates to its edge computing platform called Workers. Looking ahead, Cloudflare plans to continue fighting for the internet's integrity by engaging in conversations around upcoming regulations and working to ensure that future startups and entrepreneurs can benefit from the opportunities provided by the internet. The company remains committed to its mission of building a better internet for everyone.

Cloudflare is celebrating its 10th anniversary with a week of product announcements, known as "Birthday Week". The company has a history of launching new technologies and features during this time. In previous years, they have introduced support for IPv6, Universal SSL, serverless platform Cloudflare Workers, domain registrar service Cloudflare Registrar, and more. For its 10th anniversary, the company is set to announce enhancements to its serverless platform, observability tools, security services, and performance improvements.

Raymond Maisano, Head of Australia and New Zealand (ANZ) at Cloudflare, reflects on his first year with the company amidst the COVID-19 pandemic. He highlights how the pandemic has accelerated the need for greater security posture due to increased remote work and cyber threats. Maisano emphasizes the importance of building strong defenses against these threats and discusses Cloudflare's mission to help organizations face increased security challenges. He shares success stories with clients like Canva and Citizens of the Great Barrier Reef, as well as strategic partnerships in the region. Looking forward, Maisano expresses optimism for building a better, safer, and more resilient Internet.

At Cloudflare, the performance of their edge has been constantly improved, with recent optimizations made to their Firewall Rules product. The company's engine, Wirefilter, is used for filtering traffic hitting a site and takes boolean expressions written by customers to match incoming requests against them. Performance measurement as a service was implemented to measure performance in a highly distributed environment like Cloudflare’s edge. This benchmarking framework allows engineers to easily request runs and view results. The focus of the performance work includes optimizing their engine, speeding up the speed test, and improving the `contains` operator for substring searching.

A new phishing campaign is targeting businesses across various industries, using the European Union's General Data Protection Regulation (GDPR) compliance as a lure to harvest email login credentials. The attacker creates a sense of urgency by claiming that recipients' email security is not GDPR-compliant and requires immediate action. The campaign predominantly targets public-facing emails, with some instances targeting executives and upper management in the sales department. The phishing messages are sent from Virtual Private Server (VPS) IP addresses to maintain anonymity and can be easily switched if identified as phishing infrastructure. The malicious payload is a link to a credential harvester hosted on compromised WordPress sites, which then sends stolen credentials to the attacker. To prevent falling victim to such attacks, companies should ensure employees are knowledgeable about data security and privacy regulations, understand the risks of clicking unsolicited links, and utilize dedicated security solutions for email verification.

Cloudflare has developed a new open-source framework to help UDP services protect themselves from attacks. The framework incorporates Cloudflare's experience in running UDP-based services like Spectrum and the 1.1.1.1 resolver. It identifies floods and limits them while leaving legitimate traffic untouched, using probabilistic algorithms such as a CountMin sketch or the SpaceSaving algorithm to find heavy hitters with constant memory requirements. The framework also uses hierarchical heavy hitters to organize packets based on their attributes and applies rate limiting to prevent any heavy hitters from passing through. It is implemented as a Go library, rakelimit, which can be enabled on any UDP socket and is easy to configure.

Cloudflare has partnered with the Internet Archive to enhance its Always Online service, which serves as insurance for customers' websites when their origin goes down. The new functionality allows seamless delivery of responses from the Internet Archive when a website's origin is unreachable. By enabling Always Online in the Cloudflare dashboard, users can share their hostname with the Wayback Machine so that it can archive their website. When a website's origin is down, Cloudflare retrieves the most recently archived version of the site from the Internet Archive to serve to visitors. This partnership helps improve the resilience and redundancy of the internet while also expanding the Internet Archive's record of web pages.

On July 3, Cloudflare's global DDoS protection system, Gatebot, detected and mitigated a UDP-based DDoS attack that peaked at 654 Gbps. The attack was part of a ten-day multi-vector campaign targeting a Magic Transit customer and is believed to have been generated by Moobot, a Mirai-based botnet. Over 5,000 DDoS attacks were mitigated against this one customer during the campaign, mainly UDP floods, SYN floods, ACK floods, and GRE floods. The largest attack was a UDP flood that targeted only one IP address but hit multiple ports. It originated from 18,705 unique IP addresses, each believed to be a Moobot-infected IoT device. The attack traffic was observed in Cloudflare's data centers in 100 countries around the world, with approximately 89% of the attack traffic originating from just 10 countries. Moobot is a self-propagating Mirai-based malware that infects IoT devices using remotely exploitable vulnerabilities or weak default passwords. Once a device is infected by Moobot, control of the device is transferred to the operator of the command and control (C2) server, who can issue commands remotely such as attacking a target and locating additional vulnerable IoT devices to infect (self-propagation). The attack was not successful due to Cloudflare's global network capacity being over 42 Tbps and growing, along with the use of Anycast for inter-data center load balancing and Unimog for intra-data center load balancing. Additionally, various forms of traffic engineering were utilized to deal with sudden changes in traffic loads across their network. Cloudflare's three software-defined DDoS protection systems - Gatebot, dosd (denial of service daemon), and flowtrackd (flow tracking daemon) - collect traffic samples in order to detect DDoS attacks and generate mitigation rules with dynamically crafted attack signatures. In the case of this attack, more than 65 Terabytes of attack traffic were generated by the botnet, but as part of Cloudflare's unmetered DDoS protection guarantee, Cloudflare mitigated and absorbed the attack traffic without billing the customer.

Secondary DNS is a crucial component in maintaining the stability and reliability of the Domain Name System (DNS). It functions as a synchronized backup for primary DNS servers when they are unable to respond to queries, ensuring that users can still access websites even during server downtime. The process involves unidirectional transfer of DNS zones from the primary to secondary DNS server(s), with zone updates triggering an increase in the Start of Authority (SOA) serial number. The SOA record is a key element in Secondary DNS, containing important information such as the serial number, refresh rate, retry interval, expiration time, and minimum TTL. These values help primary and secondary servers synchronize zones effectively. To ensure efficient zone transfers between primary and secondary DNS servers, standard protocols like Authoritative Zone Transfer (AXFR) and Incremental Zone Transfer (IXFR) are used. AXFR is done over a TCP connection to transfer all zone contents in one connection, while IXFR only sends the records that have changed since the secondary server's current version of the zone. At Cloudflare, Secondary DNS has been implemented using microservice architecture and Kubernetes for better scalability and security. The migration from Marathon-based services to Kubernetes introduced challenges such as creating a distributed and reliable system while protecting individual data centers from denial-of-service attacks. To address these issues, Cloudflare proxied its egress traffic through Shadowsocks and utilized Spectrum for reverse proxy TCP/UDP traffic, filtering out malicious traffic, and ensuring optimal routing. In addition to the technical challenges faced during the migration process, there were also performance considerations. Cloudflare's Secondary DNS pipeline includes various stages such as primary server updates, zone transfers, zone building, and propagation to the edge. The end-to-end latency for these processes is less than 5 seconds on average, ensuring fast and reliable access to websites even during primary server downtime.

In March, governments worldwide issued stay-at-home orders, leading to a massive shift towards teleworking. To support this sudden change, Cloudflare launched free products and services along with onboarding sessions for clients to secure and improve their remote work environments. Many organizations initially relied on VPNs but faced performance issues as the number of remote workers increased. Cloudflare Access emerged as a solution, allowing companies to migrate internally-hosted applications quickly and efficiently. The adoption of this technology has helped businesses maintain productivity during the pandemic and could potentially become a permanent way of working for many organizations.

Cloudflare has introduced a new Watermarks API that allows users to add watermarks to their videos programmatically. The API supports various use cases, from simple requests like adding a watermark image to more complex ones such as adjusting the watermark's opacity and positioning. This feature is now available at no additional cost through the Watermarks API. Cloudflare Stream provides out-of-the-box video infrastructure for developers, handling encoding, storage, delivery, and presentation of videos. The Watermark API works by creating a watermark profile with specific properties and then applying it to a video during uploading. Future updates may include support for animated watermarks and integration into the Stream Dashboard for easier management.

Cloudflare has announced a major update to its open-source project, cdnjs. The platform now uses serverless infrastructure through Cloudflare Workers and its distributed key-value store Workers KV for delivering popular JavaScript libraries and resources. This change makes page load times faster by reducing latency and improving reliability. The new architecture also includes upgrades to the website and API, making them more scalable and efficient. Despite these changes, cdnjs remains open-source and transparent, with a commitment to keep the community updated on future developments.

Cyber criminals are exploiting the confusion surrounding the US Small Business Administration's (SBA) loan application procedures amidst the pandemic by impersonating the SBA in Coronavirus-themed phishing messages. These attacks involve a clever social engineering tactic that can fly under almost any radar, with malicious actors opting for a silent attack vector relying on targets believing the email is indeed from the SBA. The latest wave of attacks does not contain any malicious payloads but only a benign attachment named SBA - Disaster Loan Assistance Form.pdf. To thwart these sneaky SBA-themed phish, Area 1 Security uses multiple advanced techniques that leverage insight gained from early identification of attacker campaign infrastructure, enabling superior detection of emails from spoofed domains and accounts.

Unimog is an eBPF-based Layer 4 Load Balancer developed by Cloudflare for their edge data centers. It uses XDP (eXpress Data Path) to process incoming network traffic at the lowest level of the Linux kernel, allowing it to operate with minimal overhead and high performance. The Unimog control plane generates forwarding tables that are used by its data plane to distribute connections across servers in a consistent manner. Unimog also supports daisy-chaining for maintaining established TCP connections when forwarding table updates occur.

Flareact is a new open-source React framework built for Cloudflare Workers that allows developers to render their React apps at the edge rather than on the server, offering a hybrid approach of static-site generation and incremental regeneration. It supports file-based page routing, dynamic page paths, and edge-side data fetching APIs. Flareact is modeled after Next.js and offers similar functionality for getting applications to end-users quickly and efficiently. The framework aims to provide a seamless developer experience with features such as API Routes, local development support using wrangler dev command, and the ability to extend and customize the root document of the app.

Cloudflare has introduced a new feature that enables companies to enforce geography-based compliance rules with just two clicks in its Cloudflare Access service. This feature allows administrators to build rules requiring employees to connect from certain countries or blocking them from connecting from other countries, ensuring data stays within specific regions as required by industry regulations. The country requirement rule is available in all plans of Cloudflare for Teams.