A revisit of remote Spectre attacks on Cloudflare Workers
Summary
Cloudflare revisits remote Spectre attacks on Cloudflare Workers, revealing updated proofs-of-concept and production measurements showing a remote leakage of up to 12 bits per second with 99% accuracy. The post outlines mitigations (DyPrIs, V8 Sandbox, in-process isolation with MPK), discusses why the attack wasn’t detected, and explains how co-located attacker and victim isolates along with durable objects enable the attack; it also provides details on the defense improvements and a call for participation in their Bug Bounty program.