New Browser Side-Channel Attack Tracks Users via SSD Timings

Key Takeaways

• A novel browser-based side-channel attack, dubbed FROST, can track user activity by monitoring Solid State Drive (SSD) access timings.
• The attack leverages the browser’s Origin Private File System (OPFS) and JavaScript to generate disk activity and infer visited websites or launched applications.
• Operating entirely within the browser sandbox, FROST does not require special permissions or native code, making it a significant privacy concern.
• Researchers demonstrated high accuracy in fingerprinting website visits (up to 88.95% F1 score on macOS) and application usage (95.83% F1 score).
• Mitigation strategies include limiting OPFS storage, reducing high-resolution timer access, and implementing more granular browser permissions for file system access.

A new breed of browser-based tracking has emerged, allowing malicious websites to monitor user activity through the subtle fluctuations in Solid State Drive (SSD) access times. This sophisticated side-channel technique transforms standard web browsing into a potent privacy vulnerability, enabling remote user surveillance without direct data theft or exploit chains.

FROST Attack Leverages SSD Timings for User Fingerprinting

Researchers have unveiled a JavaScript-driven attack that exploits the browser’s Origin Private File System (OPFS) to generate measurable disk activity. This enables the malicious entity to read timing signals without requiring native code execution or elevated privileges. The method, termed FROST (Fingerprinting Remotely using OPFS-based SSD Timing), functions by continuously measuring storage latency while a victim browses the web or interacts with other applications.

Unlike traditional attacks that aim to steal data, FROST operates as a side channel. It observes the duration of SSD read operations, then analyzes these timing patterns to infer specific user actions, such as visiting particular websites or launching desktop applications.

A critical aspect of FROST’s efficacy is its ability to operate entirely within the browser’s sandboxed environment. The researchers discovered that OPFS can be manipulated to create sufficiently large files on disk, compelling the system to perform actual SSD reads rather than relying on faster memory caches. This forced disk interaction allows attackers to collect detailed timing traces, which are then analyzed to classify user activity with remarkable precision.

On macOS systems, the research demonstrated that FROST could predict accessed websites with an F1 score of 88.95% in a closed-world test and 86.95% in an open-world scenario. Furthermore, the attack achieved an F1 score of 95.83% for application fingerprinting, indicating a high success rate in identifying which native applications, such as Safari or System Settings, a user has opened.

The research also highlighted the potential for a covert channel, a hidden pathway for data transfer, between a native application and a malicious website. On Linux, this channel achieved a true capacity of 661.63 bits, while on macOS, it reached 891.77 bits in one configuration. This demonstrates that the timing leak is not merely theoretical but capable of transmitting usable information. The danger of this attack is amplified by its low barrier to entry: a user only needs to visit an attacker-controlled website, and no additional permission prompts are required in the OPFS scenario. This makes FROST more practical than previous SSD contention attacks, which typically demanded native code execution or direct user interaction.

The implications extend beyond mere website tracking. The ability to fingerprint application usage reveals user behavior that individuals would reasonably expect to remain private from a webpage, posing a significant privacy challenge.

Mitigating the Threat

According to the researchers, addressing this vulnerability requires a multi-pronged approach. Suggested mitigation strategies include limiting the extensive usage of OPFS storage and reducing access to high-resolution timers within browsers. Additionally, making browser file-system access more permission-based could restrict the attack’s capabilities.

Browser vendors could also implement mechanisms to alert users when multiple origins rapidly consume large amounts of OPFS storage. Stronger browser restrictions and less precise timing sources would make this type of attack significantly harder to execute. The core takeaway from this discovery is that even seemingly innocuous web features can inadvertently create powerful side channels, transforming obscure technical details like SSD timing into potent tools for remote user tracking.

What You Should Do

• Update Browsers: Ensure your web browsers are always updated to the latest versions to benefit from any patches or mitigations released by vendors.
• Review Permissions: Be cautious about granting file system access permissions to websites, even if prompted, as this could inadvertently aid such attacks.
• Limit Script Execution: Consider using browser extensions that block or limit JavaScript execution on untrusted sites, although this may impact website functionality.
• Monitor Browser Activity: Be aware of unusual browser behavior or excessive disk activity when visiting certain websites.
• Advocate for Privacy: Support browser vendors and standards bodies in implementing stronger privacy controls, particularly concerning file system access and high-resolution timers.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.