July 2024 Summaries

The Paris 2024 Summer Olympics began on July 26 and will run until August 11. A total of 10,714 athletes from 204 nations are participating in the event. The opening ceremony saw a significant impact on Internet traffic in France, with noticeable drops during key moments such as performances by Celine Dion and Lady Gaga, the lighting of the Olympic cauldron, and John Lennon's "Imagine" performed by Juliette Armanet. Globally, Internet traffic variations were less pronounced than in France, but significant drops were observed during the opening ceremony in countries like New Zealand, Uzbekistan, Argentina, and Mongolia. The start of the Olympics also marked a shift in interest for official Olympic websites, with the US taking the lead from France. Additionally, there has been an increase in spam emails related to the Olympics, with over a million such emails processed since January 2024.

Certificate pinning, once considered a gold standard for security, has become outdated in today's evolving technological landscape. The practice involves associating a hostname with a specific TLS certificate to prevent man-in-the-middle attacks. However, frequent changes in the PKI ecosystem have led to an increase in outages caused by certificate pinning. Modern standards and practices such as shorter certificate lifetimes, regular rotation of intermediate certificates, and increased use of certificate transparency are making the need for certificate pinning obsolete. These advancements offer automated, scalable, and robust security measures without the management overhead or risk associated with certificate pinning.

In this post, we discussed how we optimized the performance of Cloudflare's Web Application Firewall (WAF) Machine Learning (ML) models by employing various techniques such as pre-processing optimization, model inference optimization, and caching. We achieved a significant reduction in WAF ML execution time, cutting it down from 1519 microseconds to 275 microseconds on average, which is approximately 81.90% faster. This optimization has allowed us to handle more traffic with the same resources, improving our overall system performance and scalability.

Cloudflare is partnering with Meta to provide open-source AI models, including Llama 3.1 8B, for their Workers AI users. The Llama collection of models has shown high performance in various areas and supports multiple languages. With the integration of function calling, developers can use one model across different tasks without needing a specialized variant. Additionally, Cloudflare's embedded function calling feature enhances efficiency by reducing manual requests and utilizing open-source packages for orchestration. Users are encouraged to follow Meta's Acceptable Use Policy and License while exploring these new capabilities.

The 2024 Summer Olympics, also known as Paris 2024, will take place from July 26 to August 11 in France. This year's event will feature 329 events across 32 sports, including the debut of breakdancing and the return of skateboarding, sport climbing, and surfing. From January 2024 up to late-July, over half a million emails containing "Olympics" or "Paris 2024" in the subject were processed by Cloudflare's Cloud Email Security service. France leads in terms of DNS traffic to official Olympic websites, followed by the UK, the US, and Australia. Cybersecurity concerns have been raised due to an increase in Olympics-related spam and malicious emails.

The text discusses how internet traffic is influenced by large political events such as elections and conventions. It highlights a series of DDoS attacks on political-related websites in the United States since April 2024, including during the Republican National Convention held from July 15 to 18, 2024. The text also notes an increase in internet traffic following the attempted assassination of former President Trump at a campaign rally near Butler, Pennsylvania. It concludes that major political events may not always cause significant shifts in Internet traffic, but primarily lead to increases in traffic to news and media organizations.

Cloudflare's network spans over 320 cities in more than 120 countries, providing a broad range of services to millions of customers. The company has observed various Internet disruptions during the second quarter, including government-directed shutdowns in several Middle East and North Africa (MENA) countries for national examinations, cable cuts causing outages across multiple nations, maintenance issues, power outages, and unknown problems. These incidents highlight the complexities of maintaining reliable internet connectivity, which is dependent on a combination of physical, technical, and political factors.

In 2023, Cloudflare introduced a new load balancing solution supporting Local Traffic Management (LTM) for public HTTP(S), TCP, and UDP traffic. This year, they expanded support to private networks via Spectrum. Today, they unveiled enhanced integration of Cloudflare load balancing with their Cloudflare One platform, enabling end-to-end private traffic flows and eliminating the need for dedicated hardware load balancers. These features are available to enterprise customers and can be used for both public and private traffic directed at private networks.

The Internet security landscape has significantly changed over the last twelve months due to geopolitical uncertainty and active voting seasons in many countries across the world. This has led to a substantial increase in malicious traffic activity across the Internet. Cloudflare's perspective on Internet application security reveals that mitigated traffic averages 7% globally, with WAF and Bot mitigations being the source of over half of that. DDoS attacks remain the number one attack vector used against web applications, while targeted CVE attacks are also worth keeping an eye on as exploits can occur as fast as 22 minutes after a proof of concept is released. API traffic now accounts for 60% of all traffic, and organizations have up to a quarter of their API endpoints not accounted for. Client-side security has become increasingly important due to the proliferation of third-party integrations in web applications, with enterprise sites integrating an average of 47 third-party endpoints according to Page Shield data.

The UEFA Euro 2024 significantly impacts Internet traffic across participating European nations, with major drops in traffic during games broadcast on national TV channels. Spain experienced its most significant drops in Internet traffic during matches against major teams and former champions such as Italy, Germany, and France. In contrast, England's games had crucial moments towards the end, leading to the largest traffic reductions in the UK, especially during the knockout stages. The finalist countries, Spain and England, show distinct patterns of high viewer engagement during key matches.

Cloudflare has introduced support for server-side rendering of social media content from platforms like X and Instagram, offering a more secure, privacy-preserving, and performant alternative to traditional tag managers or customer data platforms. The new feature eliminates the need for third-party JavaScript or cookies on the client's browser, prevents direct communication between the browser and third-party servers, and improves user experience by reducing loading times. Users can now easily embed social media posts from X or Instagram on their websites using Cloudflare Zaraz without compromising security and speed.

The MD5 cryptographic hash function, first broken in 2004, continues to be used in network protocols despite advancements in cryptography. One such protocol is RADIUS (Remote Authentication Dial-In User Service), which remains critical for remote access authentication and has been found vulnerable to an improved attack exploiting MD5's weaknesses. This post discusses the attack, its implications, and potential mitigations, including transitioning to RADIUS over TLS or requiring the Message-Authenticator attribute in all modes of RADIUS/UDP.

The 18th edition of the Cloudflare DDoS Threat Report reveals a 20% year-over-year increase in DDoS attacks during Q2 2024, with threat actor capabilities reaching an all-time high. Sophisticated randomized HTTP DDoS attacks have increased tenfold due to the availability of Generative AI and developer copilot tools. Ransom DDoS attacks also rose, with 16% of attacked Cloudflare customers reporting threats or ransom demands in May 2024. The Information Technology & Services industry was the most targeted sector, while China ranked as the most attacked country. HTTP/2 remained the most common HTTP version used in DDoS attacks. Most DDoS attacks are small and quick, emphasizing the need for automated detection and mitigation systems.

The French legislative election runoff on July 7 saw surprising results compared to the first round on June 30, with the New Popular Front gaining the most seats, followed by French President Macron's Ensemble and the National Rally. Coalition negotiations will follow. During this period, there were ongoing online attacks against French political parties, with specific DDoS (Distributed Denial of Service) attacks targeting French political party websites. Additionally, initial election predictions at 20:00 local time led to a noticeable drop in France's Internet traffic.

The UK's 2024 general election saw a significant drop in internet traffic during afternoon and evening hours, with Northern Ireland experiencing the greatest impact (-10%). Traffic dipped across all UK countries after polling stations closed at 22:00. Labour Party outperformed the Conservative Party on election day, with Labour's DNS traffic spiking by 866%. Official government and election-related websites saw a 172% increase in DNS traffic on election morning. News sites and microblogging social media platforms experienced significant increases in usage after polling stations closed at 22:00, with news outlets' DNS traffic surging by 74%. Cyberattacks targeting political parties participating in the elections were also observed, highlighting this election year as marked by cyberattacks aimed at influencing politically related websites.

On June 27, 2024, a small number of users globally experienced unreachability or degradation of the Cloudflare's public DNS resolver service at 1.1.1.1 due to a combination of Border Gateway Protocol (BGP) hijacking and route leak. The incident was caused by AS267613 announcing 1.1.1.1/32 to peers, providers, and customers, while AS262504 leaked 1.1.1.0/24 upstream. Despite increased adoption of RPKI over the past several years, during the incident, 1.1.1.1/32 was originated by ELETRONET S.A. (AS267613) and accepted by multiple networks, including at least one Tier 1 provider who accepted 1.1.1.1/32 as a blackhole route. This caused immediate unreachability for the DNS resolver address from over 300 networks in 70 countries, although the impact on the overall percentage of users was quite low. Cloudflare has been engaging with all networks mentioned throughout this post in regard to the leak and future prevention mechanisms.

Cloudflare has launched an "easy button" feature that allows users to block all AI bots, including those from companies that do not transparently identify their web scraping activities. The popularity of generative AI has led to a surge in demand for content used to train models or run inference on, with some companies accused of impersonating legitimate visitors to scrape website data. Cloudflare's new feature will automatically update over time as it identifies new offending bots and aims to help preserve a safe internet for content creators.

France is currently holding early legislative elections with a second round scheduled for July 7, 2024. During this period, Cloudflare has successfully blocked DDoS attacks targeting three different French political parties. The year 2024 has been dubbed "the year of elections," with over 60 countries holding elections. France has experienced a series of cyberattacks during the election process, including DDoS attacks on political parties involved in the elections. Cloudflare has protected these parties from such attacks by blocking malicious traffic and ensuring their websites remain operational.