Cloudflare Workers Spectre Attack Leaks JWT at Up to 12 Bits/Second
Researchers disclose a Spectre attack against Cloudflare Workers that leaked JSON Web Token (JWT) from a co-located Worker process, with mitigation measures in place.
Intelligence analysis by Qwen 2.5 (3B)
Cybersecurity researchers have disclosed details of a remote Spectre attack against Cloudflare Workers that leaked a JWT from a co-located Worker at up to 12 bits per second. Mitigation measures are already deployed by Cloudflare.
A Spectre attack let someone peek at a secret code snippet from another computer program running on the same server. Cloudflare fixed this by making sure different programs can't see each other's secrets.
Analysis
{"#shared-worker-leakage":"The Spectre attack against Cloudflare Workers involved a JWT leak at up to 12 bits per second. This was achieved by co-locating an attacker Worker and a victim Worker, with the JWT intentionally placed in the victim's memory.","#detection-mechanisms":"Cloudflare implemented DyPrIs (Dynamic Process Isolation) as a defense mechanism against Spectre attacks. However, researchers found that WebSocket communications could provide a remote timing source, leading to reduced detection signals and increased leakage rates.","#mitigation-strategies":"To mitigate the attack, Cloudflare improved DyPrIs, integrated V8 Sandbox, and deployed Memory Protection Keys (MPK)-based in-process isolation. These measures include restricting local timers, isolating suspicious scripts into a separate process, and using hardware-enforced protection keys."}
Key points
- Cloudflare Workers experienced a Spectre attack leaking JWT at up to 12 bits per second
- Mitigation measures were already deployed by Cloudflare including DyPrIs, V8 Sandbox, and MPK-based in-process isolation
- The attack required co-located Worker processes and intentional placement of the JWT
The mitigation strategies deployed by Cloudflare have likely prevented any real damage from occurring, and they continue to improve their security measures based on research findings.
While the attack was mitigated, it shows that even with advanced security protocols in place, there is still room for improvement. The Spectre family of attacks remains a threat.
