Over the years, websites have become increasingly adept at tracking user behavior. Now, a new technique called FROST is being used to snoop on visitors by analyzing interactions with their solid-state drives (SSD).
The method relies on measuring timing data from I/O operations of the SSD, allowing sites to infer what other applications and websites are open on a visitor’s device. This requires no interaction from users beyond opening a specific site.
“Web browsers have evolved into complex platforms capable of running sophisticated applications,” note the paper authors. “While these features enhance capabilities and allow novel use cases, they also increase the browser’s attack surface.”
This technique differs from previous side-channel attacks on SSDs as it runs entirely within the browser using JavaScript that interacts with OPFS (origin private file system).
The implications for user privacy are significant. As web applications continue to expand their functionality, it becomes crucial to understand and mitigate such vulnerabilities.
