SSD Timing Reveals Your Secret Browsing Habits

Websites have developed a novel method to covertly track user activity by analyzing interactions with solid-state drives (SSDs). This technique, known as FROST (fingerprinting remotely using OPFS-based SSD timing), allows sites to monitor which other websites a visitor is viewing and what applications are currently open on their devices.

FROST operates by exploiting a contention side channel, which arises from the timing of I/O operations when multiple processes compete for an SSD resource. Researchers have demonstrated that this method can be executed entirely within a web browser using JavaScript that interacts with the Origin Private File System (OPFS).

By measuring latency differences in SSD read operations caused by user activity and processing these traces with a convolutional neural network, attackers can infer an individual's browsing habits and active applications. This technique requires no user interaction beyond visiting the website hosting the attack.

Despite its potential, FROST has limitations. It necessitates a very large OPFS file, potentially over a gigabyte, which could lead to detection. Additionally, the attack relies on the OPFS file being stored on the same SSD used by the visitor.

To mitigate FROST attacks, users are advised to close unnecessary tabs and monitor for large OPFS files from unknown websites. Browser developers could also limit the maximum size of such files. As of the research presentation scheduled for July at the DIMVA conference, there have been no reported instances of FROST attacks occurring in the wild. The technique has been successfully demonstrated on M2 Macs, with its underlying primitive confirmed on Linux.