Websites have a new way to spy on visitors: analyzing their SSD activity

In an alarming development for online privacy, researchers have unveiled a novel method that allows websites to clandestinely track users by analyzing their solid-state drive (SSD) activity. This technique, known as FROST (Fingerprinting Remotely using OPFS-based SSD Timing), reveals a disturbing capability: websites can identify which other sites a user is visiting and what applications are running on their devices. The findings, detailed in a recent research paper, indicate that FROST exploits a side channel, a type of data leak caused by physical phenomena such as electromagnetic emissions or timing discrepancies. By scrutinizing the subtle interactions occurring between processes vying for SSD resources, attackers can decrypt encrypted information and uncover sensitive data. FROST operates by measuring the timing of specific input-output operations on the SSD. This allows for the detection of websites open in other tabs, even across different browsers, as well as applications in use on the visitor's device. What’s particularly troubling is that this technique requires no action from the user beyond merely visiting the site that initiates the attack. The researchers noted that modern web browsers have advanced significantly from their origins as simple document readers. Today, they support complex applications developed by major companies like Google and Microsoft, which has inadvertently expanded their vulnerability to attacks. The authors pointed out that while these enhancements offer new capabilities, they also increase the potential attack surface for cyber threats. Unlike earlier methods that leveraged contention side channels, FROST operates entirely within the browser's environment. It utilizes JavaScript to interact with the Origin Private File System (OPFS), a designated storage area for a specific website, allowing the execution of necessary code without requiring user interaction. This raises considerable concerns about user privacy and the risks associated with web browsing in an increasingly interconnected digital landscape.