January 2021 Summaries

On January 29, 2021, Cloudflare was named a "Best Place to Work for LBGTQ Equality" by the Human Rights Campaign (HRC) after receiving a perfect score of 100 percent on the HRC's 2021 Corporate Equality Index. The index is a benchmarking tool that assesses corporate policies, practices, and benefits for LBGTQIA+ employees. This recognition marks Cloudflare's first appearance on the list. In 2017, Proudflare was established as an Employee Resource Group to support LBGTQIA+ employees and allies. The CEI ranking takes into account workforce protections, inclusive benefits, internal training guidelines, and efforts to recruit from the wider LBGTQIA+ community. Cloudflare plans to maintain this score and continue enhancing its inclusivity.

Daniela Rodrigues shares her experience of joining Cloudflare's EMEA Recruiting Team as a Recruiting Coordinator during the pandemic. Despite the challenges of remote interviewing and onboarding, she found the process smooth and engaging. She was impressed by the support from her future teammates and the seamless remote onboarding experience. Since joining Cloudflare, Daniela has grown both professionally and personally, taking ownership of projects such as the successful first edition of Cloudflare Careers Day in November 2020. She is now excited to help grow the Lisbon office by recruiting talented individuals who share a passion for building a better internet.

Data Privacy Day 2021 highlights the importance of an always-on, secure, and private internet due to the increased dependence on the Internet during the COVID-19 pandemic. The year 2020 saw significant developments in data protection legislation globally, with a trend towards data localization in various jurisdictions. In 2021, Cloudflare will focus on helping customers meet their data protection obligations, enhancing privacy measures for personal data processing worldwide, and developing privacy-enhancing technologies. Key areas of focus include addressing international data transfers, dealing with data localization challenges, and doubling down on privacy-enhancing technologies such as Encrypted Client Hello (ECH), OPAQUE, Oblivious DNS-over-HTTPS (ODoH), and post-quantum cryptography.

A COVID-19 vaccine-themed phishing campaign was discovered by Area 1 Security in December, exploiting concerns about vaccine distribution. The attack leverages misinformation to steal Personally Identifiable Information (PII) from targets for identity theft and fraudulent activities. The phishing message impersonates the Centers for Disease Control and Prevention (CDC), soliciting sensitive information under the guise of ensuring vaccine availability. The campaign uses advanced techniques such as Display Name Spoofing, SMTP HELO command spoofing, and exploits newly registered domains to evade phishing detection.

Cloudflare has developed its own Provisioning-as-a-Service (PraaS) platform, automating the installation of new servers and reducing manual operational tasks by 90%. The company chose Apache Airflow as an open-source workflow management platform to organize automatic steps. Each SOP step is implemented as a task in the DAG, with most tasks being API calls to Salt, which automates the management and configuration of any infrastructure or application. PraaS has various features such as failure handling, logging, notifications, Jinja templating, macros, and managing dependencies between tasks. The platform also supports branching and multi-DAGs for complex workflows. Cloudflare's ultimate goal is a fully autonomous system that monitors new server installations in edge data centers and automatically triggers expansions without human intervention.

In 2021, Cloudflare plans to expand its summer intern program after successfully adapting it to a remote format in 2020. Despite concerns about the effectiveness of virtual mentorship and collaboration, the company doubled its intern class size last year and implemented various strategies to foster engagement and networking among interns. These included weekly Zoom lunches, bi-weekly newsletters, executive "fireside chats," a buddy program, and an intern presentation series. The 2020 remote internship received positive feedback from participants, with 100% reporting that their experience met or exceeded expectations. For the upcoming summer, Cloudflare plans to nearly double its intern class size once again and offer even more engaging programs and projects.

Cloudflare has announced a new feature called "Waiting Room" aimed at helping organizations manage overwhelming demand for COVID-19 vaccinations. The feature will first be available through Project Fair Shot, and later added to Business and Enterprise plans. It works by limiting inbound requests to an application and placing them into a virtual queue, protecting the origin servers from being overwhelmed while ensuring equity among users. Cloudflare's Waiting Room is built on its edge network and Workers product, requiring no code changes or application modifications. The setup process is simple, with only five fields to fill out, and full customization capabilities are available for more advanced users.

In the final quarter of 2020, there was a significant increase in large-scale DDoS attacks, with an uptick in those over 500 Mbps and 50 K packets per second. Protocol-based attacks also saw a 3-10x increase compared to the previous quarter. Additionally, nearly 9% of all observed attacks lasted more than 24 hours. The number of network layer DDoS attacks decreased in Q4 compared to Q3, with December being the busiest month for attackers. Large DDoS attacks increased, indicating that attackers are becoming bolder and using tools that allow them to launch larger attacks. Attack duration varied, with 73% lasting under an hour and almost 9% lasting over 24 hours. The most popular attack method was SYN floods, followed by ACK, RST, and UDP-based DDoS attacks. NetBIOS and ISAKMP-based DDoS attacks saw a significant increase compared to the previous quarter. Cloudflare's data centers in Mauritius, Romania, and Brunei recorded the highest percentages of attack traffic relative to non-attack traffic. Ransom-based DDoS (RDDoS) attacks continued to plague organizations, with a recommendation not to pay ransoms as it encourages bad actors and finances illegal activities.

Cloudflare, an internet infrastructure company, launched "Project Fair Shot" on January 22, 2021, offering its new Waiting Room service for free to governments, hospitals, pharmacies, and other organizations responsible for distributing COVID-19 vaccines. The Waiting Room service helps prevent registration websites from crashing under high demand by organizing a queue in an orderly fashion. This initiative is aimed at ensuring equitable and efficient distribution of the vaccine worldwide. The service will remain free until at least July 1, 2021 or longer if there is still more demand for appointments than supply.

The Transport Layer Security (TLS) protocol, used to secure most internet connections, may need an update due to the imminent threat of quantum computers. A recent experiment by Cloudflare and Google integrated two post-quantum key exchanges into TLS stacks and Chrome Canary clients to evaluate their performance and feasibility. However, replacing both key exchange and signature with post-quantum primitives seems infeasible due to the larger size of public keys, signatures, and key exchange material compared to traditional Diffie-Hellman, RSA, or elliptic curves. A proposed solution is KEMTLS, which replaces the handshake signature by a post-quantum KEM key exchange while achieving the same goals as TLS 1.3 (authentication, confidentiality, and integrity). Cloudflare has implemented the full KEMTLS handshake in Golang's TLS 1.3 suite to show that TLS can be completely post-quantum safe.

On January 14, 2021, Uganda's government ordered the suspension of internet gateways, effectively cutting off internet access from the population to the rest of the world ahead of the country's general election. The unusual traffic patterns were noticed by Cloudflare Radar, which continually monitors its network and exposes insights based on aggregated data. Uganda's Internet eXchange point also confirmed the traffic drop. On January 18, internet access was re-established, but social media remained blocked. The shutdown lasted for nearly five days.

Cloudflare has developed a simulation system called SOAR (Simulation for Observability, reliAbility, and secuRity) to manage the complexity of its edge network as it continues to grow. The company serves over 25 million Internet properties and processes an average of 20 million requests per second. SOAR is designed to simulate customer traffic and applications in a data center environment that runs the same software stack as Cloudflare's production data centers, but without any real traffic. This allows engineers to test network features such as bring-your-own-IP (BYOIP) products and catch problems early or avoid them altogether. The system is built with Golang from scratch on Linux servers and has been integrated into Cloudflare's release pipeline.

Cloudflare has been named the Innovation Leader in Frost & Sullivan's Frost Radar™: Global Holistic Web Protection Market Report for its approach to shipping product, which involves releasing early, staying close to customers for feedback, and iterating quickly to deliver incremental value. The company received recognition based on an analysis of 10 providers’ competitive strengths and opportunities as assessed by Frost & Sullivan. In 2020, Cloudflare focused on improving its Web Application Firewall (WAF), Bot Management, and Distributed Denial-of-Service product lines. The company plans to continue releasing early and often in 2021 while listening to feedback from customers and delivering incremental value along the way.

The Domain Name System (DNS) is a crucial component for accessing websites by matching names to resources. However, its attributes may not align with properties valued in distributed Web (dWeb) systems. Cloudflare Research has been exploring alternative ways to resolve queries and has announced a new resolver for the Distributed Web where IPFS content indexed by Ethereum Name Service (ENS) can be accessed. The InterPlanetary FileSystem (IPFS) is a peer-to-peer network for storing content on a distributed file system, while Ethereum is an account-based blockchain with smart contract capabilities. To access IPFS content, users can use DNSLink or ENS, which provides human-readable identifiers and turns them into blockchain addresses. Cloudflare's Distributed Web Resolver aims to make these services more accessible by providing a gateway dedicated to the distributed web, using Cloudflare Workers for increased reliability and security.

Throughout 2020, the COVID-19 pandemic significantly impacted Internet usage patterns globally. In April, following lockdowns, internet use dropped in central London and other commercial areas while increasing in residential zones. By March, overall internet traffic surged by 40% compared to the start of the year, stabilizing at this level for the rest of 2020. E-commerce saw a boost during the pandemic, peaking on Black Friday and Christmas Eve. Hacking activity also persisted throughout the year. Cloudflare's Year In Review page provides interactive maps and charts to explore these changes in internet usage.

During Cloudflare's Privacy Week, experts discussed data sovereignty in Europe, focusing on the need for a common path between European and American authorities based on shared fundamental values such as human rights, democracy, and rule of law. The discussions also touched upon the importance of multistakeholder approaches to address privacy concerns and maintain the internet as a free and open space. Additionally, experts emphasized the need for like-minded democracies to create a standard for acceptable government access to data and national security practices.

Cloudflare Workers has opened a Discord channel for developers to connect with the team and discuss the platform. The community has grown significantly over the past three years, with users creating various applications using Workers. Discord was chosen as it allows users to share thoughts anonymously while maintaining fast communication. Mark Smith, Director of Infrastructure at Discord, praises Workers for their power and flexibility in building great things for users.

In late 2020, a major Fortune Global 500 company was targeted by a Ransom DDoS (RDDoS) attack by a group claiming to be the Lazarus Group. The company was protected by Cloudflare's Magic Transit service which mitigated the threat. This incident is part of wider ransom campaigns that have been unfolding throughout the year, targeting thousands of organizations around the world. Extortionists are threatening organizations with crippling DDoS attacks if they do not pay a ransom. Throughout 2020, Cloudflare onboarded and protected many organizations with Magic Transit, its DDoS protection service for critical network infrastructure, the WAF service for HTTP applications, and the Spectrum service for TCP/UDP based applications -- ensuring their business’s availability and continuity. The company's experience highlights the importance of having an automated always-on DDoS protection service, working with vendors to build and understand a threat model, and creating a contingency plan and educating employees on what to do if they receive a ransom email.

On December 25th, 2020, a suicide bomb exploded outside an AT&T network building in Nashville, TN, causing significant damage to the building's power supply and generators. This led to telephone and internet service outages for local residents that lasted two days. According to traffic flow data from Cloudflare, services operated on battery power for over five hours after the explosion before experiencing a dramatic drop at 1748 UTC. Service began recovering on December 27th at 1822 UTC, with normal traffic flows resuming and no further disruptions reported.