October 2020 Summaries

On October 31, 2020 at 12:00 PM, Connor Peshek introduced the twenty-first edition of The Serverlist. This publication provides updates on serverless technology, offers developer tutorials, fosters discussions among serverless developers, and highlights upcoming meetups and conferences. To receive The Serverlist directly in your email, sign up using the provided link while ensuring your privacy is respected.

Cloudflare recently released an update to its Cloudflare Resolver, adding "Extended DNS Errors" (EDE) alongside response codes under certain circumstances. This feature aims to assist users in tracing DNS resolution errors and understanding the underlying issues. The EDE provides additional information about the error without altering existing response codes, ensuring backward compatibility. Extended DNS Errors is supported by Google's DoH JSON API and has been implemented in Cloudflare's 1.1.1.1 service.

Cloudflare has released a tool called Bot Analytics to help visualize automated traffic on websites. The platform is part of their Bot Management service, which detects and blocks unwanted bots while allowing good ones. Bot Analytics provides insights into the types of bots reaching a website, including verified good bots and varying degrees of bot/human likelihood. It also allows users to set thresholds for suspicious traffic and filter or exclude request attributes such as IP addresses, user agents, and ASNs. The tool is available to all Enterprise customers and can help identify potential bot attacks on websites.

The author describes their experience working on implementing /proc/self/mem file in gVisor, a Linux container runtime sandbox. They explain how stack unwinding code is often run in unusual contexts and requires access to debug symbols for proper functioning. However, inside gVisor's sandbox, the entire /proc/self/mem file was missing due to its careful reimplementation of Linux kernel interfaces. The author delves into the details of how /proc/[pid]/mem works in the Linux kernel and how it can be implemented in Sentry's VFS. They also discuss access checks, reading from the file, and how it works in gVisor. Finally, they successfully implement a useful stack trace for their project.

Cloudflare has launched support for gRPC, an open source RPC framework running over HTTP/2. The company faced several challenges while implementing the support, including lack of full HTTP trailer header support in their edge proxy and the need to use HTTP/2 to connect to origins. To overcome these issues, they decided to convert gRPC messages to HTTP/1.1 without a trailer inside their network and then back to HTTP/2 before sending the request off to origin. They also built support for HTTP/2 connections to origin servers in-house. The resulting feature allows users to secure and accelerate their gRPC service using Cloudflare.

On October 21, 2020, draft 32 of the family of documents that describe QUIC and HTTP/3 were put into IETF Last Call, marking an important milestone for the group. QUIC is a new Internet transport protocol for secure, reliable, and multiplexed communications, while HTTP/3 builds on top of QUIC to fix performance problems such as Head-of-Line blocking. This enables web pages to load faster, especially over troublesome networks. The IETF Last Call period aims to solicit feedback from the wider IETF community for review before potentially requesting the documents be published as RFCs on the Standards Track. QUIC and HTTP/3 are extensible, allowing for new opportunities and innovation in the future.

In July 2020, Selina Cho joined Cloudflare as a Product Management Intern on the DDoS team. Despite the challenges of remote working during COVID-19, she successfully integrated into the company and contributed to enhancing Network Analytics for customers. She collaborated with various teams to improve visibility features in the dashboard and extended it to Enterprise customers. Selina's experience highlights the importance of communication, collaboration, and customer feedback in product management, as well as the adaptability of organizations like Cloudflare during a pandemic.

Cloudflare, through its Athenian Project and Cloudflare for Campaigns, provides free protection from cyber attacks to numerous state and local elections' websites as well as those of federal campaigns. The company is closely monitoring attacks on the broader elections and campaign websites and has a team standing by 24x7 to help customers and governments protect them at no cost from any cyberattacks they may see. So far, cyberattacks have not been impacting the websites of campaigns and election officials being monitored and protected by Cloudflare. The company is continuously updating its internal monitoring systems publicly through Cloudflare Radar. It has participants in more than half of US states and hundreds of federal campaigns across the political spectrum.

On November 3, 2020, the United States held its Presidential election amidst concerns over cybersecurity protections and processes implemented in the preceding four years. Area 1 Security highlighted the risks posed by threat actors to election administrators and their email security controls. One key risk identified was the failure for any organization to properly register their domains, which could allow anyone to assume the identity of elections officials and send phishing emails or alter critical voter information. To mitigate these risks, domain owners were advised to check expiration dates and secure their domains for maximum ownership time available, as well as follow recommendations for securing email outlined in a prior report.

Bot traffic makes up almost 40% of total internet traffic and is a significant concern for businesses and organizations. Cloudflare offers comprehensive Bot Management tools to help mitigate this issue, analyzing global bot trends due to the vast amount of traffic that flows through its network each day. The company groups traffic into four categories: verified bots, definitely automated, likely automated, and likely human. By assigning a "bot score" to each request, Cloudflare helps customers manage and control various types of automated traffic effectively. In the first half of 2020, web traffic increased by around 35% due to the ongoing coronavirus pandemic, with some bots taking advantage of this surge in activity. North America, Europe, and Asia were the primary sources of both overall and automated traffic. The United States alone accounted for the majority of requests, over half of which come from automated sources. Understanding bot behavior is crucial for businesses to protect their networks and maintain a positive user experience. Cloudflare's Bot Management tools provide valuable insights into global bot trends and help organizations manage and mitigate the impact of bots on their websites and applications.

Bot traffic is common on public-facing web properties, with scraper bots targeting eCommerce and online portals. While some scraper bots can be beneficial, such as those used by search engines or price comparison sites, many are malicious and aim to steal pricing data for competitors' use. Bot Management providers often need to divert traffic to a dedicated data center for analysis, which may add latency and degrade user experience. Companies should look for technology partners with an expansive network that can scan traffic in real-time as it passes through any data center on their network. A challenge faced by Bot Management solutions is the high number of false positives, leading to legitimate customers being challenged or blocked altogether. Cloudflare's Bot Management solution helped a property portal overcome these challenges and improve user experience while protecting its IP from scraper bots.

On October 17th, 2020, Cloudflare announced its plans for a new product called Cloudflare Intrusion Detection System (IDS). This system monitors networks and alerts users when an attack is suspected. It integrates deeply with Cloudflare One, providing a comprehensive view of the entire global network and inspecting all traffic for malicious behavior. The IDS analyzes the network simultaneously and alerts users to events that may have been missed by static rules. This system complements Cloudflare's Magic Firewall and offers a single view of what is happening within the network, helping identify breaches. It also improves over time with intelligence gathered from attacks in other regions or industries. The IDS operates through traffic shaping and inspection, learning normal behavior patterns to detect anomalies. It benefits from herd immunity by learning from attacks against Cloudflare and its customers' networks. Users can offload the CPU-intensive work of running an IDS to Cloudflare's network, which is built for scalability. Deployment is simple, requiring only one click, and users receive alerts with insights into the type of attack and where it occurred. The system allows remediation through a single rule push to the global Cloudflare network.

Cloudflare has announced the launch of Magic Firewall™, a network-level firewall delivered through their platform to secure enterprises. The firewall covers remote users, branch offices, data centers, and cloud infrastructure. It is deeply integrated with Cloudflare One™, providing a comprehensive overview of network activity. Magic Firewall replaces physical appliances that have limitations with the global network of Cloudflare. Unlike traditional firewalls, Magic Firewall runs in the Cloudflare network, which scales up or down based on customer needs. It integrates with other Cloudflare products and services, allowing for a single view of the entire network. The first version of Magic Firewall will allow customers to apply static OSI Layer 3 & 4 mitigations completely self-service, at Cloudflare scale.

Cloudflare has introduced Cloudflare One™, a unified approach to solving problems in enterprise networking and security. The platform allows organizations to protect and manage their data centers, offices, and devices through a single control plane. With its global network of over 200 cities and 100 countries, Cloudflare offers distributed enterprises the ability to process traffic close to users' locations, regardless of where they are in the world. The platform also provides extensive visibility into network activity and threat intelligence insights, as well as Argo Smart Routing for improved performance. As organizations adopt Cloudflare One, the company plans to continue expanding its network and products to deliver an even faster, more secure, and reliable experience across all of its services.

Cloudflare has introduced a beta version of its Browser Isolation service, which aims to improve web browsing safety by running browser sessions in sandboxed environments within Cloudflare data centers. This approach is designed to keep threats away from the user's device while maintaining the convenience and flexibility of a web browser. The service sends only draw commands to render the webpage, making it compatible with any HTML5 compliant browser. By hosting managed browsers only milliseconds away on their network, Cloudflare aims to provide a native browser experience remotely without compatibility issues introduced by scrubbing HTML, CSS, and JavaScript.

On October 15th, 2020, Brian Parks announced the release of Cloudflare One™, a comprehensive network-as-a-service solution designed to improve security and performance while reducing cost and complexity for businesses of all sizes. The platform is built to handle large corporate networks but also aims to serve smaller companies by providing access to better internet services. The week of the announcement was marked as Zero Trust Week at Cloudflare, with a focus on their mantra of "Zero Trust for Everyone." This security framework assumes that all networks, devices, and internet destinations are inherently compromised and should not be trusted. Cloudflare One facilitates this by securing how users connect to corporate applications and the internet at large. The text outlines a step-by-step guide on how small businesses can secure their devices, applications, and networks using Cloudflare One's Zero Trust model of security. The platform offers features such as DNS filtering, Zero Trust access, and a management dashboard for up to 50 users at no cost. Additionally, the text mentions upcoming releases that will extend protection and connectivity to teams operating smaller networks with Cloudflare's Magic Transit™ product. The overall goal of Cloudflare One is to provide businesses with better internet services while improving security and reducing costs.

Cloudflare has announced two new features for its Cloudflare Gateway secure web gateway solution. The first feature is an integration with the Cloudflare WARP desktop client, which uses WireGuard to provide a more efficient and flexible VPN protocol than legacy options. The second feature is L7 filtering, which allows administrators to inspect traffic for threats that hide below the surface of DNS queries. These features are designed to help organizations protect their distributed workforces in light of increased security threats during the pandemic. Cloudflare Gateway now supports HTTP traffic filtering based on various criteria such as URLs, paths, query strings, HTTP methods, response codes, file types and names, MIME types, and URL security or content categories. The company plans to extend support for IP, port, and protocol filtering with a cloud L4 firewall later this year.

Cloudflare has announced the general availability of its Cloudflare WARP for desktop users, providing a more secure and private internet experience regardless of how one connects. The company also revealed that it is bringing everything its users have come to expect from WARP to security teams with new functionality in its Cloudflare Gateway product. This enables customers to use the Cloudflare WARP application to connect corporate desktops to Cloudflare Gateway for advanced web filtering, offering a simple way for enterprises to protect their users wherever they are without requiring backhaul of network traffic to a centralized security boundary.

On October 14, 2020, Cloudflare announced the launch of Cloudflare One Intel, a platform designed to streamline network and security operations by converting data gathered on their network into actionable insights. The new features aim to improve incident response by bringing together insights from network activity, global Internet intelligence, and automated remediation in a single platform. Two key features within Cloudflare Gateway include DNS tunneling detection and domain insights. These features help detect and block emerging security threats more efficiently, providing transparency for security teams investigating the threats that impact their organization.

Cloudflare has introduced a new architecture for its Argo Tunnel, which provides a secure way to connect your origin servers to Cloudflare without exposing them to the internet. The new architecture separates persistent objects (DNS records and cloudflared) from ephemeral objects (connections), allowing users to create named tunnels that outlive connections. This improvement enhances stability, simplifies management, and reduces the need for leaving certificates and service tokens on servers. Users can now upgrade to the latest version of cloudflared to start using these features.

Amazon's Prime Day is a prime target for cyber criminals, who ramp up their phishing schemes to steal login credentials and credit card details. With the pandemic causing more people to rely on online shopping, attackers are using advanced tactics to create convincing messages that mimic real Amazon emails. These phishing campaigns often involve spoofing Amazon's branding and using newly registered domains to send malicious content. To protect users from falling victim to these attacks, companies need to implement advanced email security solutions that can detect new tactics in real-time.

Cloudflare has introduced a new feature that extends its Zero Trust security model to cover SaaS applications, allowing users to protect any SaaS application that can integrate with a SAML identity provider using Cloudflare Access. This feature is designed to standardize and aggregate identity in Cloudflare's network, providing administrators with the ability to build rules determining user access requirements. The integration of this feature into existing Cloudflare for Teams accounts is straightforward and available to all customers, including those on the free plan.

Cloudflare has announced a new Teams plan and the launch of its Cloudflare for Teams Free plan, which protects up to 50 users at no cost. The company's mission is to help build a better internet by keeping team members secure from unknown threats and applications safe from attack. With the new free plan, organizations can access robust Zero Trust security features for both internal and SaaS applications, as well as DNS content and security filtering for multiple network locations.

Cloudflare has introduced Cloudflare One, a vision to tackle the challenges of corporate security and networking in modern enterprises. The platform combines secure networking products with consistent global security controls. Key components include Cloudflare WARP and Gateway for filtering outbound internet traffic, Magic Transit and Firewall for office networks, Magic WAN for routing control, and Cloudflare Access for Zero Trust access control. These features aim to simplify network management, enhance security, and improve performance by leveraging Cloudflare's global network infrastructure.

Cloudflare One is a comprehensive network-as-a-service solution designed to be secure, fast, reliable, and define the future of the corporate network. It replaces a patchwork of appliances and WAN technologies with a single network that provides cloud-based security, performance, and control through one user interface. The platform integrates identity management and endpoint security providers, including Okta, Ping Identity, OneLogin, CrowdStrike, VMware Carbon Black, SentinelOne, and Tanium. Cloudflare One is a global solution that leverages the company's massive global presence to secure, route, and filter traffic over an optimized backbone using real-time Internet intelligence to protect against the latest threats and route traffic around bad Internet weather and outages.

Edge networks present a significant opportunity for AI performance and applicability. Deploying edge AI services can be hard because AI is both computational and memory bandwidth intensive. Latent AI's mission is to enable ambient computing, regardless of any resource constraints. They develop developer tools that greatly reduce the computing resources needed to process AI on the edge while being completely hardware-agnostic. Their compression uses quantization algorithms to convert parameters for the AI model from 32-bit floating-point toward 16-bit or 8-bit models, with minimal loss of accuracy. The key benefit of moving to lower bit-precision is the higher power efficiency with less storage needed. Optimized AI services can process data closest to the source and perform inferences at the distributed edge.

A new phishing campaign has been discovered that leverages the recent hype surrounding President Trump's decision to halt U.S. funding for the World Health Organization (WHO). The campaign uses a typical Political Action Committee (PAC) email, eliciting support for presidential incumbent Donald Trump in the upcoming 2020 election. This phishing campaign aims to compromise politically-related entities rather than just the typical targets of opportunity that are commonly associated with this banking trojan. The attacker disguises their Emotet delivery mechanism as messaging about timely and highly publicized, hot-button issues in politics.

This guest post by Cristhian Motoche from Stack Builders explores how Haskell can be used to target WebAssembly, which is a portable binary instruction format that executes fast in a memory-safe sandboxed environment. The author demonstrates the use of Asterius, a well-documented tool for compiling Haskell to WebAssembly, and deploys it on Cloudflare Workers, a serverless platform that allows running code on the edge of Cloudflare infrastructure. The post also covers how to create a simple Cabal project using Asterius's ahc-cabal CLI and compile it to WebAssembly with ahc-dist.

Today, Cloudflare announced the availability of DDoS attack alerts at no extra cost for all customers on paid plans. This feature is part of their mission to make the internet safer and more accessible by democratizing enterprise-grade protection. The real-time alerts will be delivered through email or PagerDuty, depending on the plan type. There are two types of DDoS alerts: HTTP DDoS alerts and L3/4 DDoS alerts. To receive these alerts, users must create a notification policy in their Cloudflare account dashboard. The alert includes information such as attack type, target, and mitigation details. Feedback from users is encouraged to help improve the DDoS protection solution.

Cloudflare celebrated its 10th birthday with a series of announcements during "Birthday Week." On Day 1, Durable Objects and Cron Triggers were announced for the Workers platform, enhancing use cases. Day 2 saw the introduction of a new Web Analytics product that prioritizes user privacy while providing accurate analytics. Additionally, Google's Chrome team's Web Vitals metric was integrated into Cloudflare's Browser Insights product to improve website performance. On Day 3, Cloudflare Radar was launched, offering insights into global internet traffic patterns. The company also announced support for HTTPS/HTTP3 records to improve security and performance. Day 4 focused on APIs with the introduction of beta support for gRPC and API Shield for enhanced security. Finally, on Day 5, Automatic Platform Optimization was launched, starting with WordPress, to cache HTML content more intelligently. Throughout the week, various industry leaders participated in discussions about the past, present, and future of the internet.

Image Resizing has added support for the new AVIF image format, which offers significantly better compression than older formats such as WebP and JPEG. This can save bandwidth and improve overall web performance. The AVIF format is a combination of the HEIF ISO standard and the royalty-free AV1 codec by Mozilla, Xiph, Google, Cisco, and others. It supports 10- and 12-bit color at full resolution, and high dynamic range (HDR). Adoption of AVIF is expected to be faster than previous image formats due to its superior compression capabilities and backing from major tech companies.

Cloudflare has launched an Automatic Platform Optimization (APO) service for WordPress users, aiming to improve the loading speed of websites by serving nearly all content from its network. The APO service reduces Time to First Byte (TTFB), First Contentful Paint, and Speed Index for desktop users at the 90th percentile. It is now available for anyone using WordPress and costs $5/month for Free plan customers or is included in Professional, Business, and Enterprise plans. The APO service helps eliminate common issues like shared hosting congestion, slow database lookups, or misbehaving plugins.

DNS Flag Day is an initiative by several DNS vendors and operators to increase compliance with DNS standards, making DNS more secure, reliable, and robust. The goal for this year's flag day is to improve DNS messaging reliability by focusing on problems around IP fragmentation of DNS packets. This involves ensuring cleartext DNS messages sent over UDP are not too large and that larger DNS messages can be sent reliably over TCP. Cloudflare fully supports the initiative, as it aims to make DNS more reliable and robust, and ensures a common set of features for the DNS community to evolve on.

The text explains how Cloudflare implemented Automatic Platform Optimization for WordPress, which combines regular Cloudflare cache with Workers KV. This service is an evolution of the zero-config edge caching of HTML blog post and works both with and without the Cloudflare for WordPress plugin integration. It provides a zero config edge HTML caching solution and improves the performance of Google font loading for all pages. The concept can be applied to any website and content management system (CMS).

Cloudflare has introduced a new feature called "API Shield" to secure APIs through the use of strong client certificate-based identity and strict schema-based validation. The capabilities are available for free in all plans, making it simple to protect APIs from widespread attacks designed to perform unauthorized actions or exfiltrate data. API Shield uses a positive security model that allows only known behavior and identities while rejecting everything else, reducing the noise of credential stuffing attacks and other automated scanning tools. The feature also includes schema validation for JSON payloads, with gRPC/protocol buffer support on the roadmap.

On October 1st, 2020, Network Time Security (NTS) officially became RFC 8915, marking its inclusion in the collection of protocols that make the Internet work. NTS is designed to secure a ubiquitous Internet protocol and has been implemented by time service providers like Cloudflare. The adoption of NTS is vital for ensuring accurate authentication of NTP servers and protecting against attacks that imitate them. With the support of NTS in operating systems and TLS 1.3, internet security can be significantly improved.

Cloudflare has introduced beta support for proxying gRPC, a next-generation protocol designed to build APIs at scale. With gRPC on Cloudflare, users gain access to the platform's security, reliability, and performance features. The integration allows customers to add security features such as WAF and Bot Management, increase performance with Argo Smart Routing, and improve reliability by adding a Load Balancer. Additionally, gRPC integrates with API Shield for enforcing client authentication and schema validation at the edge.