Websites are using this new FROST-y technique to spy on users by spying on their SSD activity

• Researchers at Graz University of Technology present FROST, a side-channel attack on the browser
• The method can reveal visited websites and open desktop applications, but requires the creation of large files.
• There are limitations, but the study highlights how modern browser features expand the attack surface for surveillance.

Security researchers have come up with a new way to spy on Internet users and they call it FROST. Recently, more than half a dozen researchers from the Graz University of Technology (Austria) published a new report called “FROST: Fingerprinting Remotelyusing OPFS-based SSD Timing” in which they claim that there is a way to spy on user activities directly through the browser.

This is a remote side channel technique that exploits a standard browser feature called Origin Private File System (OPFS). Generally, a side-channel attack is a way to steal secrets by measuring physical side effects, such as how long an action takes and how much energy it uses. In this case, researchers measured access speeds to solid state drives (SSDs), allowing them to track which websites a victim visited and which desktop applications they opened.