Websites Can Now Spy on You Through Your Hard Drive
Key takeaways
- Now sites have a new way to spy on their visitors: by measuring subtle interactions with their solid-state drives.
- The technique, laid out in a research paper, exploits a side channel, a form of leak resulting from physical manifestations such as electromagnetic emanations, data caches, or the time required to complete a task.
- The attack that FROST uses is known as a contention side channel, which measures the interaction of various processes all using (or competing for) a given resource.
Why this matters: a development in AI with implications for how people work, create, and decide.
Photograph: Maria Saifutdinova Comment Loader Save Story Save this story Comment Loader Save Story Save this story Over the decades, there has been no shortage of sites using clever techniques to covertly track visitors’ browsing histories, device fingerprints, and keystrokes and mouse movements in real time. Even Meta and Yandex were recently caught joining in the privacy-invasive free-for-all.
Now sites have a new way to spy on their visitors: by measuring subtle interactions with their solid-state drives. The technique, named FROST (fingerprinting remotely using OPFS-based SSD timing), allows sites to monitor other sites a visitor is viewing and what apps are open on their devices.
The technique, laid out in a research paper, exploits a side channel, a form of leak resulting from physical manifestations such as electromagnetic emanations, data caches, or the time required to complete a task. By measuring the manifestations, attackers can decrypt encrypted traffic and infer other confidential data.