Researchers demonstrate faster remote Spectre attack against Cloudflare Workers

The Hacker News reports that cybersecurity researchers from Cloudflare and the University of Edinburgh have successfully demonstrated a significantly faster remote Spectre attack against Cloudflare Workers, capable of leaking sensitive information at an accelerated rate compared to previous findings.

The researchers developed an end-to-end experiment using an attacker Worker and a victim Worker within the same production environment. This setup allowed them to leak a JSON Web Token (JWT) from the victim's memory at a rate of up to 12 bits per second, a substantial increase from earlier demonstrations. The attack exploits the shared operating-system process model used by Cloudflare Workers, where code from multiple tenants runs in separate V8 isolates. While the researchers confirmed no customer data was accessed, they noted that the production implementation of Cloudflare's Dynamic Process Isolation (DyPrIs) was insufficient.

Cloudflare has since mitigated the vulnerability by enhancing DyPrIs, integrating the V8 Sandbox, and deploying Memory Protection Keys (MPK)-based in-process isolation. They stated there were no indicators of active exploitation in the past three years. The attack leverages WebSocket communications as a remote timing source and Durable Objects to maintain Worker isolate longevity, bypassing initial isolation measures.

Source: The Hacker News