New FROST Attack Reveals SSD Activity, Compromising User Privacy

Researchers at Graz University of Technology have unveiled a side-channel attack named FROST, which allows malicious websites to monitor users' SSD activity and identify open websites and applications with up to 89% accuracy. This attack exploits the Origin Private File System (OPFS) through JavaScript, requiring no special permissions or user interaction beyond visiting an infected site. The method measures SSD access latency to infer user activity, functioning across different browsers. Major tech companies, including Google and Apple, have been informed, but responses vary, with Google not classifying it as a vulnerability. The attack primarily affects users on Mac systems, with limited testing on Linux and no testing on Windows. The significant file size requirement for the attack poses a practical barrier, as users would likely notice large storage consumption. Recommendations include limiting OPFS file sizes or requiring user consent for file creation.

Key Points: • FROST attack can identify visited websites with 89% accuracy using SSD timing. • The attack operates entirely within the browser using JavaScript and OPFS. • Current defenses are lacking, with major browsers not implementing fixes yet.