Tracking our SSL configuration

Over time we’ve updated the SSL configuration we use for serving HTTPS as the security landscape has changed. In the past we’ve documented those changes in blog posts; to make things simpler to track, and so that people can stay up to date on the configuration we’ve chosen, I’ve created a Github repository called sslconfig. More Info »

SiteCheck Extended – Making It Easier to Scan Your Websites

Sucuri SiteCheck is our free website malware scanner that crawls any website to detect signs of Malware injections, SEO Spam, Blacklisting, Defacement and other similar indicators of a compromised website. It is widely used by Webmasters to verify if their sites have not been compromised or blacklisted. And now we’re extending it to other platfroms, More Info »

Joomla Plugin Constructor Backdoor

We recently wrote about backdoors in pirated commercial WordPress plugins. This time it will be a short post about an interesting backdoor we found in a Joomla plugin. It was so well organized that at first we didn’t realize there was a backdoor even though we knew something was wrong. Here’s what the code of More Info »

Upcoming Meetups at CloudFlare

At CloudFlare, we love connecting with our communities, and so we are excited to announce two meetups to be hosted here at the CloudFlare headquarters in San Francisco next month. All Things Crypto – 5/8/2014 On Thursday, May 8, Nick Sullivan from the security engineering team at CloudFlare will host a meetup with several cryptography More Info »

HeartBleed in the Wild

As most of you probably already know, ten days ago security Researchers disclosed a very serious vulnerability in the OpenSSL library, which is used to power HTTPS on most websites nowadays. The bug allowed an attacker to extract information that was supposed to be private, including SSL private keys, login data or any other information More Info »

The Heartbleed Aftermath: all CloudFlare certificates revoked and reissued

Eleven days ago the Heartbleed vulnerability was publicly announced. Last Friday, we issued the CloudFlare Challenge: Heartbleed and simultaneously started the process of revoking and reissuing all the SSL certificates that CloudFlare manages for our customers. That process is now complete. We have revoked and reissued every single certificate we manage and all the certificates More Info »

The Results of the CloudFlare Challenge

Earlier today we announced the Heartbleed Challenge. We set up a nginx server with a vulnerable version of OpenSSL and challenged the community to steal its private key. The world was up to the task: two people independently retrieved private keys using the Heartbleed exploit. The first valid submission was received at 16:22:01PST by Software More Info »