FROST Side-Channel Attack Turns SSD Activity Into A New Browser Privacy Nightmare

Solid state drives, named as such for their lack of moving parts, are an essential part of the modern PC ecosystem, but no moving parts does not mean no security vulnerabilities. In fact, the specific manner in which SSDs function (electrical pulses across NAND flash, I/O throughput, etc) can be measured in a new contention side channel attack dubbed FROST by researchers from the Graz University of Technology in Austria.

The good news is that this attack has yet to be seen in the wild, and can be halted by simply closing the offending tab. It's also only confirmed to work on Apple's current-gen macOS, with only preliminary functionality on Linux and no Windows testing yet performed.

The bad news, per the original research paper first spotted by Ars Technica, is that the new attack method is totally sound and leverages the functionality of modern browsers in a way that makes spying on other browser tabs, or even other active browsers on the same device.

By using JavaScript to interact with the browser's origin private file system (OPFS) used to run site code and measuring the SSD's I/O interactions, that information can be run through a pre-trained convolutional neural network (CNN), and the attacker can determine what apps and websites are open on the device. It's not a perfect, undetectable attack by any means: the offending OPFS file will reach a size of 1GB or more, and its detection will be limited to apps running off of the same drive.

In an email to Ars Technica, Hannes Weissteiner, one of the authors behind the research paper, confirmed that since the performance of the primitive is similar between Mac and Linux, it should be possible to train the model on any system activity that reliably generates SSD access.

The FORST proof of concept research paper (PDF) also posits potential fixes for the vulnerability, including simply limiting OPFS file sizes, at least for unknown sites. Fortunately, this security flaw only seems capable of monitoring user activity while the browser tab is open, not hijacking the entire system like the NVIDIA GPU-tied Rowhammer attack or further infecting the system with malware.

Image Credit: manseok_kim on Pixabay