New FROST Attack Lets Websites Track What Sites and Apps You Open via SSD Timing
A new attack method, dubbed FROST, allows websites to track which sites and apps a user opens by analyzing the timing of SSD reads. Developed by researchers at Graz University of Technology, FROST leverages the Origin Private File System (OPFS) feature in modern browsers to bypass permission prompts and monitor disk activity without requiring native code or user interaction. While the accuracy is high, particularly for pre-installed apps, current defenses are limited, and no CVE has been assigned, leaving users with few immediate mitigation options.
The FROST attack utilizes a novel approach to user tracking by exploiting the timing of SSD reads. The technique, developed by researchers at Graz University of Technology, relies on the Origin Private File System (OPFS), a browser feature introduced in 2023 to allow web apps to access files on disk without traditional permission prompts. The attack works by creating a large file within the OPFS sandbox, causing the SSD to be accessed repeatedly. By measuring the time it takes for these reads, the attacker can identify the sites and applications the user is accessing, even while the browser tab remains open. This bypasses standard security measures that would typically require user interaction or native code execution.