The FROST attack: how SSD access delays expose users’ activity
Source Kaspersky Security Blog
Description
The FROST technique: using an SSD in a roundabout way to leak private information.
Impact
The FROST attack can leak information about user activity, including which applications are launched and which websites are visited, by remotely monitoring SSD access delays via a malicious webpage. This information leak can compromise user privacy and enable profiling without installing malware. However, the attack does not directly expose sensitive data or credentials. Its practical impact is limited by the need for sustained monitoring, large OPFS file usage, and the likelihood of detection by endpoint detection and response (EDR) or extended detection and response (XDR) solutions. It is primarily a privacy risk relevant to high-value targeted surveillance.
Defensive guidance
Since the attack relies on the origin private file system (OPFS) feature in browsers, users and administrators should monitor for anomalous high OPFS storage usage by websites, which may indicate exploitation attempts. Endpoint detection and response (EDR) and extended detection and response (XDR) solutions are likely to flag the aggressive SSD usage patterns required by this attack. Users should avoid visiting untrusted or suspicious websites. Browser vendors and SSD manufacturers may need to consider mitigations in future updates to limit timing side channels via OPFS or SSD access patterns.
Summary
FROST (Fingerprinting Remotely using OPFS-based SSD Timing) is a side-channel attack discovered by Austrian researchers that uses SSD access delays to fingerprint user activity. It exploits the origin private file system (OPFS), a legitimate browser feature that stores data on the SSD, to measure microscopic delays caused by contention on the SSD bandwidth. By continuously bombarding the SSD with data requests from a malicious webpage, attackers can detect distinct latency patterns corresponding to specific websites and locally running applications. Using AI to analyze these patterns, the attack achieves up to 96% accuracy in identifying app launches and 89% accuracy for website visits, even in different browsers. The attack does not require breaking browser sandboxing or installing malware but depends on forcing large OPFS file usage, which is likely to trigger detection by endpoint security tools. Due to the complexity and resource demands, FROST is mainly a concern for highly targeted espionage rather than widespread attacks.