CDNs: Great for speeding up the internet, bad for location privacy

Infosec in brief Using a custom-built tool, a 15-year-old hacker exploited Cloudflare's content delivery network to approximate the locations of users of apps like Signal, Discord, and others. The attack, developed by self-described "15-year-old high school junior" Daniel, is surprisingly straightforward. By exploiting Cloudflare's CDN caching behavior, an attacker can infer a user's general location by determining which datacenter cached a resource requested by the user's device. "In the US East region, for example, the nearest datacenter to me is less than 100 miles," Daniel said. "If you live in a developed country, there's a good chance the nearest datacenter to you is less than 200 miles from you." In other words, you won't be able to pinpoint someone's exact position, but can narrow it down to within 200 miles of a Signal user that is seeking anonymity. Because Cloudflare doesn't allow direct requests to individual datacenters, Daniel exploited a bug in Cloudflare Workers' serverless scripting service to route traffic through specific datacenters. Using this method, he developed a tool called Cloudflare Teleport, which proxies requests to target datacenters and identifies where cached resources are stored. By sending a specific item – such as an image – to a target and observing which datacenter caches it, an attacker can infer the target's approximate location. Daniel also discovered that the attack can work without user interaction when apps automatically download cac...