Websites are using this new FROST-y technique to spy on users by monitoring their SSD activity

• Researchers at Graz University of Technology have revealed FROST, a browser side-channel attack
• The method can reveal visited websites and open desktop applications, but requires creating large files.
• Limitations exist, but the study highlights how modern browser features expand the attack surface for surveillance.

Security researchers have developed a new way to spy on Internet users, and they call it FROST. Recently, more than half a dozen researchers from the Graz University of Technology (Austria) published a new report titled “FROST: Fingerprinting Remotely using OPFS-based SSD Timing” in which they claim that there is a way to spy on user activities directly through the browser.

This is a remote side-channel technique that leverages a standard browser feature called Origin Private File System (OPFS). Typically, a side-channel attack is a way to steal secrets by measuring physical side effects, such as the duration of an action and the amount of energy it consumes. In this case, researchers measured SSD access speeds, which allowed them to track which websites the victim visited and which desktop applications they opened.