In the modern digital landscape, a vast amount of our online activity happens not in distant, centralized data centers, but on servers located much closer to us. This approach, known as edge computing, allows websites and applications to respond almost instantly by processing data nearby. To make this speed possible, companies like Cloudflare run thousands of different customer programs on the same physical computer at the same time. They do this by sharing a single large software environment, rather than giving each customer their own isolated computer. This design is incredibly efficient, but it creates a unique vulnerability. If one program can peek into the memory of another, it could steal sensitive information like passwords or secret keys. For years, security experts have worried about a specific type of trick called a Spectre attack, where a program uses tiny, invisible delays in how a computer processes information to guess what data another program is holding.

Researchers from Cloudflare and the University of Edinburgh recently demonstrated that this theoretical risk is a very real, practical danger. They showed that even with the strict security rules Cloudflare had put in place to stop such tricks, a malicious program could still listen to the timing of events across the internet to steal secrets. The team proved that by using a clever combination of techniques, an attacker could measure time with enough precision to bypass the system's defenses. They successfully extracted a secret digital token from a victim program running on the same machine, doing so hundreds of times faster than any previous attempt. This discovery forced the company to overhaul its security architecture, moving from software-based warnings to hardware-enforced barriers to protect its users.

The story begins with how these edge computers are built. To handle millions of requests every second, Cloudflare runs many different customer scripts inside a single process, which is a large container holding all the active programs. This is different from older systems where each program ran in its own separate box. While this shared approach makes everything run faster, it means that if one script finds a way to read the memory of its neighbor, it can see everything that neighbor is doing. To prevent this, Cloudflare had introduced several safety measures. They froze the clocks that programs could read, stopping them from measuring time precisely. They also removed the ability for programs to share memory or run multiple threads at once. Additionally, they installed a watchdog system called Dynamic Process Isolation, which monitors how a script behaves. If a script starts acting suspiciously, like trying to measure time too often, the system kicks it out of the shared process and puts it in its own isolated box.

The researchers set out to test if these defenses were truly enough. They started by tackling the problem of time. Since the system froze the clocks during normal work, the attackers needed a way to measure time from the outside. They discovered they could use a feature called WebSockets, which allows a program to keep a long-lasting connection open with a server. By sending messages back and forth over this connection, they could create a remote timer that worked even while the main program was busy. They tested this in the real production environment, not just in a lab, and found that they could measure time with a resolution of about one millisecond. While this might sound slow, it was enough to start the attack.

The next challenge was making the signal loud enough to hear over the noise of the busy internet. A single secret bit of information might only cause a delay of a few nanoseconds, which is far too small to measure with their remote timer. The team used a technique called amplification. Imagine trying to hear a whisper in a noisy room; you might ask the person to whisper the same thing over and over, or you might use a device that makes the sound echo. The researchers built a gadget that repeated the tiny delay thousands of times, stacking the effect until the total delay grew to a few milliseconds. This made the difference between a "yes" and a "no" answer large enough to be detected by their remote timer, even with the jitter and noise of a real-world network.

With a reliable timer and a way to amplify the signal, the team turned to the actual theft of data. They needed a way to trick the computer into revealing a secret without the computer realizing it was happening. They used a method called speculative execution, where the computer guesses what it should do next and starts working on it before it is sure it is right. If the guess is wrong, the computer usually throws away the work. However, the researchers found a way to make the computer leave a trace of that work in its cache, a small, fast memory area. By carefully arranging their code, they could force the computer to guess that it should read a specific piece of secret data. Even though the computer later realized it was wrong and stopped, the act of reading the data left a mark in the cache that took longer to access later. By measuring how long it took to access that spot, they could tell if the secret data had been read.

The researchers combined these elements into a full attack chain. First, they used a special feature of Cloudflare's system called Durable Objects to keep their malicious script running for hours without being stopped, bypassing the usual time limits. This allowed them to stay in the same shared process as their victim. Then, they used their remote timer and amplification gadgets to leak the memory address of the victim's data. Once they knew where the data was, they used a second gadget to read the actual secret, which in their test was a digital token used for authentication. They repeated this process bit by bit, reconstructing the entire secret.

The results were striking. In the real production environment, the team was able to steal data at a rate of up to 12 bits per second. This is a massive improvement over previous attempts, which managed only about 120 bits per hour. The attack was accurate, correctly identifying the secret bits more than 99 percent of the time. Crucially, the attack succeeded in evading the watchdog system. The researchers found that the way they used the remote timer and the long-running connection confused the detection system. The system looked at how often the script accessed certain internal counters to decide if it was malicious, but the timing of their attack made those counters look normal. Because the script never finished its job while it was running, the system never got a chance to isolate it before the data was stolen.

This discovery highlighted a fundamental flaw in relying solely on software to stop hardware-level tricks. The security measures Cloudflare had in place, such as freezing clocks and monitoring behavior, were not enough to stop a determined attacker with the right tools. In response to this demonstration, Cloudflare implemented a series of new defenses. They introduced a sandbox that limits how programs can access memory, effectively putting a fence around the data so that even if a program tries to look outside its own area, it cannot reach the neighbor's secrets. They also improved their detection methods to look for the specific patterns of the attack rather than just general behavior. Finally, and perhaps most importantly, they deployed a hardware-based isolation system. This system uses the computer's own physical capabilities to lock each customer's data in a separate room, ensuring that even if one program tries to break in, the hardware itself will block the attempt.

The work serves as a powerful reminder that in the world of high-speed computing, efficiency and security are often in tension. By pushing the boundaries of how fast and flexible these systems can be, new vulnerabilities inevitably appear. The researchers did not just find a bug; they showed that the entire strategy of protecting shared systems with software checks was insufficient against modern, sophisticated attacks. The solution required a shift to hardware-enforced boundaries, proving that sometimes the only way to keep secrets safe is to build walls that the software cannot climb over. This study confirms that while edge computing offers incredible speed and convenience, it demands a higher level of physical security to protect the vast amounts of sensitive data that flow through it every second.