cyber.hendryadrian.com
Threat Research · thehackernews.com

Researchers Demonstrate Remote Spectre Attack Recovering JWT from Cloudflare Workers

· Original article ↗

Summary

Researchers demonstrated a remote Spectre attack that recovered a deliberately planted JWT from a co-located Cloudflare Worker at up to 12 bits/s and 99.16% accuracy. Cloudflare says mitigations are deployed and it found no signs of exploitation.

Key points

  • In a controlled production experiment, researchers recovered a deliberately planted JWT from a victim Worker in the same process; the paper said no customer data was accessed.
  • The attack reached up to 12 bits per second at 99.16% accuracy, compared with 2 bits per minute in a 2021 demonstration.
  • WebSocket communications provided remote timing, while Durable Objects kept an isolate running for five to more than 20 hours before DyPrIs isolation took place.
  • WebSocket-heavy I/O increased iTLB activity and weakened the branch-misprediction signal used by DyPrIs, allowing it to fall below the detection threshold.
  • The researchers said higher system load reduced leakage rates but did not make slower attacks infeasible.
  • Cloudflare said it mitigated the issue with improved DyPrIs, the V8 Sandbox, and MPK-based in-process isolation, and reported no indicators of active exploitation over the previous three years.
  • The researchers argued that robust detection should operate during execution and use a signal that I/O activity cannot suppress.

Article Details

Attack Vectors
  • A remote Spectre side-channel attack used WebSocket communications as a timing source to infer a JWT intentionally placed in a co-located victim Worker’s memory.
  • The attacker Worker and victim Worker ran in separate V8 isolates within the same operating-system process; Durable Objects could keep an isolate alive for five to more than 20 hours before DyPrIs isolation took place.
  • WebSocket-heavy I/O increased iTLB activity and reduced the branch-misprediction signal used by DyPrIs below its detection threshold. The researchers reported leakage of up to 12 bits per second at 99.16% accuracy.
Defensive Notes
  • Cloudflare said it mitigated the issue in production by improving DyPrIs, integrating the V8 Sandbox, and deploying MPK-based in-process isolation; it reported no signs of active exploitation over the preceding three years.
  • The V8 Sandbox limits transient access to 64-bit pointers. MPK-based isolation places Worker heaps behind hardware-enforced protection keys and combines them with the V8 Sandbox and a rotating memory layout.
  • The researchers recommended detection during execution using a signal that cannot be suppressed by I/O activity. They reported that higher system load reduced the leakage rate, but slower attacks remained feasible.

Vendors

CloudflareResearchers disclosed a remote Spectre attack against Cloudflare Workers that leaked a JWT from a co-located Worker in production at up to 12 bits per second, far faster than the 2021 attack.

Products

Cloudflare WorkersResearchers disclosed a remote Spectre attack against Cloudflare Workers that leaked a JWT from a co-located Worker in production at up to 12 bits per second, far faster than the 2021 attack.Durable ObjectsThe researchers used WebSocket timing and Durable Objects to extend the attack window.V8 SandboxCloudflare said the issue has been mitigated with improved DyPrIs, the V8 Sandbox, and MPK-based in-process isolation, and reported no signs of active exploitation.

Related Articles