# Cloudflare's Signal & Discord Leak Vulnerability | Simplified Privacy

Source: https://simplifiedprivacy.com/cloudflare-and-signal/leak-user-location.html
Kiwi News: https://news.kiwistand.com/stories/Cloudflares-Signal-and-Discord-Leak-Vulnerability-or-Simplified-Privacy?index=0x67900c264e5ae13d7a1a61d0dc990d069fb144829faf6dbc282fa3c32402c31d5461fc61
Submitted by simplifiedprivacy.eth on 2025-01-21 UTC, 2 upvotes, 0 comments

## Summary

A 15-year-old hacker showed that Cloudflare's caching can be abused to identify which Cloudflare server a Signal or Discord user downloads images from, which can reveal an approximate city or VPN exit location. The attack only requires sending the victim an image, and the hacker used Cloudflare WARP to access cached data and Burp to control what was sent to Signal's CDN servers. Cloudflare made the attack harder after the disclosure but had not fully patched it at the time of writing. Any VPN can block this specific attack, according to the text, which also raises concerns about the centralization of large providers.

## Article

Signal messenger & Discord are vulnerable

Anyone can triangulate your city location?!!

Do you use Signal or Discord?

Then a random attacker can abuse Cloudflare to find out which Cloudflare server you’re pinging images from. Even on Signal, the attacker can triangulate your city location (or VPN exit).

Images

To do the Signal attack, they need to only send you an image. Then see which Cloudflare server you download the image from. This shows the danger of Cloudflare’s centralization, which I’ve bitched about 1000 times to deaf ears.

15 year old kid

In response to this 15-year old hacker making a fool of them, Cloudflare did make this attack more difficult, but they’ve yet to patch it fully. So it can be done at the time I’m writing this.

Caching

The kid figured out that it can be done by abusing caching. Caching is when files (such as images) as stored on all of these local datacenters because they are frequently accessed.

To quote the kid,

"A few months ago, I had a lightbulb moment: if Cloudflare stores cached data so close to users, could this be exploited for deanonymization attacks on sites we don't control?"

Further,

"When your device sends a request for a resource that can be cached, Cloudflare retrieves the resource from its local datacenter storage, if available. Otherwise, it fetches the resource from the origin server, caches it locally, and then returns it. "

So then he,

First used Cloudflare WARP (Cloudflare’s VPN client), to get access to this data when normally the requests are not allowed.

Second, used Burp to gather data on which signal CDN servers were being used, and control what’s sent to Signal.

Third, send the image to the victim. And then get the location of which Cloudflare server they download or view it from.

Takeaway

While this specific attack can be stopped by any VPN, who knows what huge amount of information these centralized Big Tech providers save, store, and use on fingerprints, history, or Cloudflare trust scores. Once again, please consider our VPN, designed to isolate your activity for web apps, with Cloudflare specifically in mind: Learn More

Source Links

[1 - Kid’s Github] [2 - Kid’s Twitter] [3 - 404 Media]

If you really want to learn and take your privacy to the next level, Learn about HydraVeil, Access our VPN, and subscribe to our new content via: Podcast, Email List, Nostr, Bastyon, RSS, or join the Signal Group