A newly detailed technique called FROST allows websites to monitor SSD activity through browser JavaScript, creating a new privacy vulnerability. The method reads telltale patterns in hard drive behavior without requiring special permissions.
Security researchers have detailed FROST, a technique that enables websites to track hard drive activity from within a web browser using standard JavaScript code. The vulnerability exploits timing differences in SSD operations to infer information about what users are storing and accessing on their devices.
The attack works by measuring microscopic delays in how solid-state drives respond to read requests. When an SSD accesses frequently-used files, response times differ measurably from accessing rarely-touched data. JavaScript running in a website can detect these timing variations with sufficient precision to build a profile of a user's storage patterns.
This profiling capability poses significant privacy risks. An adversary could potentially identify what applications a user has installed, what documents exist on their system, or what files they regularly access—all without explicit user consent or system-level permissions.
FROST represents a new class of side-channel attacks that target hardware behavior rather than software vulnerabilities. Unlike traditional browser exploits, this technique doesn't require users to download files or install malicious software. It operates silently while someone browses normally.
Browser vendors and security researchers are investigating mitigation strategies. Potential defenses include introducing artificial noise into SSD timing measurements, reducing the precision of JavaScript timing functions, or implementing browser-level protections that limit access to hardware performance data.
The vulnerability affects modern SSDs across different manufacturers and operating systems. Users cannot easily patch this issue at the application level, making it a systemic concern requiring coordination between browser developers, operating system vendors, and SSD manufacturers.
While no active exploits have been reported in the wild, the public disclosure of FROST means developers now have detailed instructions for implementation. Organizations handling sensitive data should monitor for updates from their browser and system providers.
A browser extension with 30,000 installs available on Chrome and Firefox stores transmits users' Twitch OAuth session tokens to a commercial bot service, exposing sensitive authentication credentials.
OpenAI's web-crawling bots were aware of a significant caching vulnerability in RubyGems before public disclosure, raising questions about vulnerability discovery and responsible disclosure practices.
Attackers compromised HBO Max's official Reddit account to distribute malicious ads using ClickFix exploits. The campaign targeted Windows and macOS users with information-stealing malware.
OpenAI has hundreds of contract workers reviewing real ChatGPT conversations and rating them to improve the model. The practice is enabled by default, requiring users to manually opt out.