New FROST Attack Lets Websites Track What Sites and Apps You Open via SSD Timing

Summary: Researchers at Graz University of Technology built FROST, a browser-based attack that uses JavaScript and SSD timing to identify which sites and apps a user opens, running inside the browser sandbox via the Origin Private File System (OPFS) with no native code, extension, or permission prompt. In macOS tests it identified the top 50 websites with an F1 score of 88.95% closed-world and 86.95% open-world against 300 unseen sites, reached 95.83% on ten pre-installed macOS apps, and moved data through a covert channel at 661.63 bit/s on Linux and 719.27 bit/s on macOS.
Key Takeaway: Google's Chromium team does not treat fingerprinting as a security vulnerability, Apple called it out of scope, and Mozilla has shipped nothing, so there is no CVE and no browser fix for a technique that lets any page you leave open infer what you do on your own machine.

Read the original at The Hacker News ↗