{"id":181791,"date":"2026-05-29T02:48:54","date_gmt":"2026-05-29T00:48:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opredelenie-poseshhaemyh-sajtov-cherez-analiz-aktivnosti-ssd-iz-web-brauzera"},"modified":"2026-05-29T02:48:54","modified_gmt":"2026-05-29T00:48:55","slug":"opredelenie-poseshhaemyh-sajtov-cherez-analiz-aktivnosti-ssd-iz-web-brauzera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/opredelenie-poseshhaemyh-sajtov-cherez-analiz-aktivnosti-ssd-iz-web-brauzera","title":{"rendered":"Determining visited websites through the analysis of SSD activity from the web browser","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A team of researchers from Graz University of Technology (Austria) has developed a side-channel attack technique called FROST (Fingerprinting Remotely using OPFS-based SSD Timing), which allows the analysis of SSD activity from JavaScript code executed in a browser to identify websites visited by users with an accuracy of 88.95%, as well as applications running on the system with an accuracy of 95.83%. This method can also be used to establish a covert communication channel between a locally running application and JavaScript code executed in the browser. The data exchange performance in Linux was 661 bit\/s, while in macOS it was 892 bit\/s.<\/p>\n
The attack is based on the specific nature of how access times to the SSD drive change during the opening of a website or the launching of a web application, which is unique to that site or application. By using typical access time signatures for pre-measured websites and applications, one can distinguish their characteristic activity against a backdrop of other input\/output operations. In the context of the executed attack, delays in input\/output operations are matched with the signatures of websites and applications. \nA convolutional neural network was employed to identify patterns against the noise from external input\/output.<\/p>\n
For the method to work in the browser, the OPFS (Origin-Private FileSystem) API is utilized, which allows creating files in the local file system (files are created in an isolated part of the file system associated with the site). Access time to the SSD drive is analyzed by measuring delays in identical data operations. To bypass the influence of the page cache on file operations during the attack, it is necessary to create files of very large sizes that exceed the size of available RAM. <\/p>\n
As a countermeasure against the attack, browser manufacturers are advised to require separate user confirmation for accessing the OPFS API or to limit the maximum file size to a value not exceeding the size of the RAM. Currently, Chrome and Safari allow creating files through the OPFS API that occupy up to 60% of the available disk space.<\/p>\n