The FROST attack fingerprints the websites and apps you use from plain JavaScript in a tab - by measuring SSD contention from the browser. We cover how it works, how realistic the attack is, and who actually needs to care.
Additionally, we show a few other remote side channels to show what is possible in theory for motivated attackers.
Earlier this year, we published "FROST: Fingerprinting Remotely using OPFS-Based SSD Timing". The paper made the news, likely because "a website can spy on you if you click a link" makes a good headline. Reactions were split: Some people wanted to disable JavaScript completely, claiming that allowing websites to execute scripts on client devices was a mistake in the first place. Others waved the attack off as a toy example that only works in a lab, never feasible in the real world.
For us, the truth lies somewhere in the middle.
FROST is a real attack. From plain JavaScript, we measure SSD contention from the browser and use it to fingerprint the websites you visit and the apps you open, without requiring any additional interaction beyond clicking a malicious link.
It's also fragile: Classification depends on training data, and prior work has shown that trained models cannot easily be generalized to different SSD models.
This talk presents the attack, and gives some intuition about the underlying insights. Does the average user need to be scared? Who actually needs to care? Why do browsers allow this in the first place? And what are side-channel attacks anyways?
Additionally, we give an overview of other remote side-channel attacks, showing what's possible in theory to a motivated attacker.