Ars Technica: Websites have a new way to spy on visitors: analyzing their SSD activity

General News
1

While each file system is sandboxed, meaning it’s isolated from other websites and from the device system itself, the JavaScript can measure the I/O interactions. Then, by running those interactions through a pretrained convolutional neural network—a system that uses deep learning to analyze text, audio, and images—the attacker can deduce various apps and websites open on the device

However:

One of the best ways to prevent FROST attacks is to close tabs as soon as they’re no longer needed. More savvy users can monitor the creation and size of OPFS files allocated by unknown websites. The researchers proposed ways for browser makers to shut down the side channel. One such method is to limit the maximum size such files that are allowed. There are no indications FROST attacks have been performed in the wild.

5 Likes
2

As someone who does a lot of research in the browser, this is a no go. I will always have like 25+ tabs that persist for around a week or two whenever I’m working on something.

3 Likes
3

Laughs manically from inside a disposable VM

From the sound of this report, scripts would be foiled by hypervisor partitions, and unable to read SSD activity from space allocated to other VMs

3 Likes
4

I agree. It would have been impossible to write any research papers without having multiple tabs open.

2 Likes
5

The technique has its limitations. First, the OPFS file must be extremely large—likely a gigabyte or more.

Step one: crash the browser for 90% of people.

While I do enjoy the validation of blocking JS by default and isolating my browsing the way I do, this also seems like a research-level issue and not a threat vector…for now.

From the original paper:

Ultimately, the most effective mitigation would be to enable OPFS only
after explicit user permission, which would significantly harm the usability of
OPFS for legitimate applications and cause disruptions to user workflows.

Also seems like something that should be one day covered in browser security settings, right?

…right?