Websites have a new way to spy on visitors: analyzing their SSD activity
Recorded: May 31, 2026, 7 p.m.
| Original | Summarized |
Websites have a new way to spy on visitors: Analyzing their SSD activity - Ars Technica Skip to content Ars Technica home Sections Forum Subscribe Search AI Biz & IT Cars Culture Gaming Health Policy Science Security Space Tech Feature Reviews AI Biz & IT Cars Culture Gaming Health Policy Science Security Space Tech Forum Subscribe Story text Size Small Width Standard Links Standard * Subscribers only Pin to story Theme HyperLight Day & Night Dark System Search Sign In ADVANCES IN SNOOPING Websites have a new way to spy on visitors: Analyzing their SSD activity Telltale SSD activity can be measured in the browser using simple JavaScript. Dan Goodin May 27, 2026 4:56 pm | 140 Credit:
Credit:
Text Story text Size Small Width Standard Links Standard * Subscribers only Minimize to nav Over the decades, there has been no shortage of sites using clever techniques to covertly track visitors’ browsing histories, device fingerprints, and keystrokes and mouse movements in real time. Even Meta and Yandex were recently caught joining in the privacy-invasive free-for-all. While each file system is sandboxed, meaning it’s isolated from other websites and from the device system itself, the JavaScript can measure the I/O interactions. Then, by running those interactions through a pretrained convolutional neural network—a system that uses deep learning to analyze text, audio, and images—the attacker can deduce various apps and websites open on the device. Dan Goodin Dan Goodin Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Dan is based in San Francisco. Follow him at here on Mastodon and here on Bluesky. Contact him on Signal at DanArs.82. 140 Comments Comments Forum view Loading comments... Prev story Next story Most Read 1. 2. 3. 4. 5. Customize Ars Technica has been separating the signal from More Contact Manage Preferences |
Websites are developing a novel method to monitor visitors by analyzing the activity occurring on their solid-state drives. This technique, termed FROST, stands as a way to remotely fingerprint visitor activity by measuring subtle interactions with the SSD. The method exploits a side channel, specifically a contention side channel, which arises from the physical manifestations, such as the time required to complete an input-output operation, when various processes compete for access to a shared resource, like an SSD. By measuring these differences in input-output operation timings resulting from user activity, attackers can infer sensitive information, including which websites are open across different browser tabs and which applications are running on the host device. The research posits that the evolution of web browsers into complex platforms capable of running sophisticated applications, such as integrated development environments or office suites, increases the browser’s attack surface. This environment allows the technique to be implemented directly within the browser using JavaScript that interacts with the OPFS, or origin private file system, a storage space reserved for code execution related to specific tasks. Although file systems are generally sandboxed, the JavaScript can measure the resulting input-output interactions. To translate these physical measurements into usable data, the researchers employ a pre-trained convolutional neural network, a deep learning system, to analyze the traces of SSD contention. The network classifies these traces to fingerprint the user's activity on the host system. The process involves the attacker continuously measuring SSD contention by performing random reads from a large OPFS file, leveraging the latency differences caused by user activity. The resulting timing traces are then fed into the convolutional neural network, which is trained to classify new traces, thereby creating a fingerprint of the user’s activity. The system requires no direct interaction from the visitor beyond simply opening the site hosting the attack. The limitations and practical considerations of the FROST technique must be addressed. The method requires the OPFS file to be extremely large, likely gigabytes in size, which poses a risk of detection by numerous users. Furthermore, the OPFS file must reside on the same SSD the visitor is using; consequently, the technique may not detect applications running on separate SSD drives. One effective mitigation strategy suggested by the researchers is for users to close browser tabs immediately when they are no longer needed, and for developers to limit the maximum size of OPFS files allocated by unknown websites. The researchers have demonstrated the underlying primitive works on Linux, though the full attack was performed on an M2 Mac. The authors anticipate similar performance metrics between macOS and Linux due to the similarity in the underlying performance of the primitive, and they suggest that in principle, a model could be trained on any system activity reliably generating SSD accesses. The research is ongoing, with further testing planned. |