August 2023 Summaries

The blog post discusses the key highlights of Cloudflare Radar's Q2 2023 report, which covers various aspects related to the Internet such as disruptions, attacks, application security trends and more. The report includes insights on attack sophistication escalating with pro-Russian hacktivists collaborating, an increase in TP240PhoneHome exploits by 532%, a surge of crypto-targeted attacks by 600%, and the decline in HTTP requests per second (rps) mitigated. Cloudflare Radar's new capabilities allow users to explore insights on Internet quality, trending domains, routing changes, and more using various interactive tools like the "date picker" functionality launched in August 2023. The post also provides a link for further information and suggests following @CloudflareRadar (Twitter), cloudflare.social/@radar (Mastodon), or radar.cloudflare.com (Bluesky) for updates, as well as contacting the team via email for inquiries.

In January 2023, support was announced for Managed Service Providers (MSPs) and businesses using 'parent-child' account configurations in deploying Cloudflare DNS filtering through the Tenant API integration with Cloudflare Gateway. This allows organizations like Meter, a provider of Internet infrastructure, to utilize parent-child policies to enforce acceptable Internet use for their clients. MSPs can set differential and granular security policies based on specific locations within larger businesses using Cloudflare's tenant architecture. DNS filtering is the first step in providing Zero Trust services via the tenant platform with more services planned for future development.

Cloudflare introduces "starring", a new dashboard feature that allows users to mark up to 10 of their websites and applications for quicker access, aiming to improve workflow efficiency. This is particularly beneficial for those with multiple domains or subdomains they frequently monitor or configure. Users can star items from the Overview page and filter lists by starred items in various locations across the dashboard. Cloudflare invites users to provide feedback on the feature through their Community platform.

This article provides an overview of the summer internships at Cloudflare, highlighting various aspects such as mentorship, executive chats, bonding activities, and unique experiences. The interns expressed their gratitude for the supportive environment, challenging work opportunities, and meaningful relationships built during their time at the company. Some interns also shared their favorite snacks from office vending machines or a box of international treats sent to them by Cloudflare's University team. The article mentions some of the individuals who have made a significant impact on the internships through their guidance and support, such as Harshal (Systems Engineer), Revathy (Systems Engineer), Nevi (Product Manager), Conner (Systems Engineer), Malgorzata (Data Scientist), John (CTO), Doug Kramer (General Counsel), Matthew Prince (Co-founder and CEO), and Michelle Zatlyn (Co-founder and COO). Some highlights from the internship experience include working on high impact projects, receiving support not just professionally but also emotionally, appreciating the transition from academia to industry, and feeling valued as an important member of the team. The article concludes by sharing some fun facts about the interns' experiences, such as driving 30 hours from New York to Colorado, waiting for builds to finish, drinking matcha lattes, participating in numerous Cloudfriends calls and coffee chats, and missing only a single day at the office throughout the internship. The article ends by encouraging interested individuals to sign up here to be notified of new grad and internship opportunities for 2024 or check out open positions on the website and apply today for full-time roles. In summary, this article showcases how Cloudflare's summer internships provide valuable experiences that foster growth, mentorship, real impact, and lasting relationships in a supportive environment.

The report highlights key findings from the first quarter of 2023 regarding attack traffic, bot traffic, API traffic, and other insights based on data collected by Cloudflare's global network. Here is a summary of the main points covered in the report: 1. Attack Traffic Insights: - Total mitigated traffic grew from 74 billion to 83 billion requests per day (an increase of 12%). - The most common attack vector remains HTTP Anomalies, which accounted for over half of all mitigated traffic. - Most malicious activity was seen in the DoS and Web Attacks categories. - There has been an increased use of custom rules within WAF deployments (17% growth). - CVE-related attack volume shows that even old vulnerabilities are still being exploited, with one rule accounting for most mitigated traffic related to a DoS and Anomaly issue from 2015. 2. Bot Traffic Insights: - Approximately 33% of total traffic was classified as automated (generated by bots). - The majority of requests were either definitely bot or definitely human, with most scoring less than 30 or greater than 80 on the bot score scale. - Bot Management field usage within WAF Custom Rules increased to 11%, indicating more customers relying on bot signals for some action in "I'm an AI language model." ASSISTANT The report provides valuable insights into attack, API and bot traffic based on data collected by Cloudflare.

The article provides an overview of 10 blog posts published by Cloudflare in the year 2023, covering various topics related to online security and protection against attacks. It highlights how artificial intelligence (AI) can aid in mitigating threats while also adding complexity to attackers' tactics. The importance of prioritizing prevention strategies is emphasized, along with case studies from different institutions showcasing their experiences with Cloudflare's security features. The article suggests trying out some of the mentioned security features and encourages readers to be cautious, prepared, and safe in the digital realm.

In the 2023 Phishing Threats Report by Cloudflare, it was found that phishing emails are increasing at an alarming rate, with attackers constantly evolving their tactics to avoid detection. The report highlights how email authentication standards like SPF, DKIM, and DMARC have limitations in preventing brand impersonation and other types of attacks. Multiple protection layers must be enacted before, during, and after messages reach the inbox, including adopting a Zero Trust security model, augmenting cloud email with anti-phishing controls, and implementing phishing-resistant multifactor authentication. Cloudflare's report also recommends using remote browser isolation technology to protect users from accidentally entering sensitive information within form fills or credential harvesting websites. To prevent successful phishing attacks, organizations should take a proactive approach by meeting employees where they are and making the tools they already use more secure.

This blog post by Francisco Santos and Pedro Henrique Mendes discusses debugging WebAssembly (Wasm) applications using a tool called wasm-coredump. The article explains that while traditional JavaScript error reporting tools like Sentry can provide information about the state of an application, they don't offer much help when dealing with Wasm exceptions due to its isolated and efficient design. To address this issue, Francisco and Pedro introduced wasm-coredump, a tool designed specifically for debugging WebAssembly applications using Cloudflare Workers. The article explains how the core dump of a process is a snapshot that contains information about the application's state at the time it crashed or encountered an error, making it invaluable for debugging purposes. The authors then introduce the concept of "Rust on Workers," where Rust applications are compiled into WebAssembly to run on Cloudflare Workers. They provide code examples and diagrams to demonstrate how wasm-coredump can be used with Sentry to capture core dumps from Wasm exceptions, allowing developers to see a backtrace that includes the source file name, line number, variable names, types, and values of Rust functions. The article also discusses the challenges of generating large WebAssembly binaries when adding DWARF debugging information, which can make it difficult for them to fit within Cloudflare Workers' size limits. To address this issue, they introduce a tool called debuginfo-split that strips out the debugging information from Wasm binaries and saves it in separate files called "debug-{UUID}.wasm," reducing their sizes significantly. Overall, Francisco Santos and Pedro Henrique Mendes' blog post provides an insightful look into debugging WebAssembly applications using wasm-coredump and offers practical solutions for developers to improve their debugging processes when working with Wasm in Cloudflare Workers or other platforms. In terms of key points: 1. Traditional JavaScript error reporting tools like Sentry struggle with providing useful information about the state of a WebAssembly application during an exception, mainly due to its isolated and efficient design. 2. The wasm-coredump tool allows developers to capture core dumps from Wasm exceptions in their applications running on Cloudflare Workers, providing valuable debugging insights like backtraces that include source file names, line numbers, variable names, types, and values of Rust functions. 3. To use wasm-coredump with Sentry for WebAssembly exception reporting, the authors provide code examples and detailed explanations on how to configure both services correctly. 4. The article also discusses challenges related to generating large Wasm binaries when adding DWARF debugging information, which can make it difficult for them to fit within Cloudflare Workers' size limits. They introduce a tool called debuginfo-split that addresses this problem by stripping out the debugging information and saving it in separate files. 5. The authors encourage readers to provide feedback or contribute improvements via their Discord, Community forum, or GitHub repositories for wasm-coredump, debuginfo-split, and related tools. Reference(s): https://blog.cloudflare.com/debugging-wasm-exceptions/```

Cloudflare has announced new debugging workflow features for its Cloudflare Queues service, allowing users to send, list, and acknowledge messages directly from the dashboard. This makes it easier for customers using asynchronous systems to examine a queue's state and test information flow through it. Users can now preview messages without affecting their number of retries or interfering with an existing connected consumer. An HTTP API to pull batches of messages from a queue is also coming soon, utilizing the same infrastructure as message previews in the dashboard. These debugging features have already proven valuable for testing example applications built on Cloudflare Queues and are now available for all customers.

Cloudflare Stream introduces scheduled deletion on August 11, 2023, to simplify video lifecycle management and reduce storage costs. This feature allows developers to automatically delete on-demand videos and live recordings from their library at a specified time through the Cloudflare dashboard or API. Scheduled deletion can be applied to both new and existing content, enabling users to manage storage effectively and retain videos only for the desired duration. The update is now available to all Cloudflare Stream customers.

Cloudflare has introduced per-hostname TLS settings for customers, allowing them to set up individual subdomains with specific security configurations based on their needs. This includes setting minimum TLS versions and supported cipher suites. While modern protocols offer better security and performance, legacy clients and devices may not support these new standards, creating a trade-off between security and accessibility. By offering per-hostname settings, Cloudflare enables businesses to maintain optimal protection for sensitive data while keeping marketing websites and blogs accessible to all users with older devices. The feature is available starting August 9, 2023, through the API endpoint.

On August 8, 2023, Cloudflare announced the launch of Project Cybersafe Schools during the Back to School Safely: K-12 Cybersecurity Summit at the White House. This initiative aims to support eligible small K-12 public school districts in the United States with free Zero Trust cybersecurity solutions and no time limit, helping them minimize their exposure to common threats like email, phishing, and ransomware attacks. In Q2 2023 alone, Cloudflare blocked an average of 70 million cyber threats daily targeting the U.S. education sector. Between 2016 and 2022, there were 1,619 publicly reported cybersecurity-related incidents aimed at K-12 public schools in the United States. The Project Cybersafe Schools package includes cloud email security to protect against various threats such as Business Email Compromise, multichannel phishing, credential harvesting, and DNS filtering for preventing access to unwanted or harmful online content. Eligible school districts must be K-12 public schools in the United States with up to 2,500 students; other educational institutions may also qualify for Cloudflare's educational services at a discounted rate.

The blog post discusses the top 10 most exploited CVEs (Common Vulnerabilities and Exposures) of 2022 according to Cloudflare's data, with Log4J vulnerability being the first on their list. It highlights that due to its high impact, all plans on Cloudflare are provided WAF Managed Rules for free to protect against such threats. Other CVEs mentioned in this post include Atlassian Confluence Code Injection (CVE-2022-26134), Microsoft Exchange SSRF and RCE vulnerabilities, F5 BIG-IP Command Injection (CVE-2022-1388), VMware Workspace ONE Access and Identity Manager Server-side Template Injection Remote Code Execution Vulnerability (CVE-2022-22954), Confluence Server Webwork OGNL injection (CVE-2021-26084). The article emphasizes the importance of keeping software updated and utilizing WAF Managed Rules for protection against these vulnerabilities. It also mentions that Enterprise customers have access to additional AI-powered detection features in their WAF implementation.

Cloudflare has announced general availability of its Zero Trust Integration with Datadog's Cloud SIEM product. This deeper integration provides customers with a Cloudflare Content Pack within Cloud SIEM, including out-of-the-box dashboard and detection rules for ingesting Zero Trust logs into Datadog. The partnership offers enhanced security insights over the Zero Trust landscape, automating response and remediation through workflow blueprints. Customers can set up Logpush jobs to their Datadog destination using the Cloudflare dashboard or API, install the Cloudflare Tile in Datadog, and utilize out-of-the-box content for security teams. New detection rules address CASB findings and impossible travel scenarios. The integration aims to provide a more comprehensive view of products and security posture with unique detection rules, currently available for exploration by joint Cloudflare and Datadog customers.

Cloudflare recently experienced a series of incidents affecting their Workers KV (Key-Value) service, which is used to store configuration and data for applications running on Cloudflare's serverless platform. The root cause was an incorrectly deployed code change that caused keys in affected locations to be persisted with invalid configurations across requests, leaving the Worker "frozen" until a rollback was performed 10 minutes later. Additionally, the introduction of a new progressive release process for Workers KV prolonged the incident due to a bug in deployment logic, which dropped some traffic until it was rolled back. Cloudflare estimates that the affected traffic accounted for 0.2-0.5% of KV's global traffic and impacted customers with error rates approaching 20%. To improve reliability and mitigate risks associated with Workers KV, Cloudflare plans to implement several improvements: enhancing observability tooling for unhandled exceptions, improving safety around environmental variable mutations in a Worker, expanding test coverage, refining release processes, adding better logging, adjusting alerting thresholds, and addressing maturity issues with progressive deployment tooling. Cloudflare acknowledges that these incidents have not met their customers' expectations for the KV service and are working to address both the specific issues that led to this cycle of incidents as well as broader reliability concerns across Cloudflare services reliant on or relying on Workers KV.

On August 2nd, 2023 at 2:00 PM, Joaquin Gimenez and Shaun Persad announced that during Developer Week they revealed new database integrations on Workers for seamless connection with popular databases. The integration process involves selecting a provider, authorizing through OAuth2 flow, and storing the correct configuration as encrypted environment variables to the user's worker. Today, they have partnered with Upstash to expand their catalog of integrations by offering three new options: Upstash Redis, Upstash Kafka, and Upstash QStash. This collaboration provides customers with a broader range of capabilities on Workers to meet specific requirements. The setup process for adding the Upstash Redis integration is demonstrated in this text, which includes granting permissions, connecting via OAuth2 flow, selecting a database, and generating credentials. An implementation example follows that showcases how users can utilize these integrations with Cloudflare's Workers by customizing responses based on country-specific data retrieved from Upstash Redis instances. The text concludes with information about performance improvements for write-heavy use cases and the availability of all three new database integration options (Upstash Redis, Kafka, and QStash) to all users.