FROST Side-Channel Attack Spies on Mac Browsing via SSD Latency

Researchers at Graz University of Technology have developed a new side-channel attack technique called FROST that exploits the Origin Private File System (OPFS) browser API to spy on users' browsing activity. The method measures SSD latency spikes caused by other disk I/O operations, allowing it to fingerprint which websites and applications are running without requiring any special permissions or user interaction beyond visiting a malicious webpage.

Graz University researchers use OPFS API to track M2 Mac Mini activity with high accuracy

The attack targets modern macOS systems, specifically testing successfully on an M2 Mac Mini. By leveraging OPFS capabilities that allow web pages to create files larger than available RAM, FROST forces the operating system to read data from the SSD. This creates measurable latency patterns in storage access that reveal information about other active processes.

FROST achieves approximately 89% accuracy in identifying visited websites and roughly 96% accuracy in detecting running applications on the test Mac Mini. The technique uses a convolutional neural network to analyze timing patterns generated by these SSD I/O operations. Researchers demonstrated the attack works across different web browsers, making it broadly applicable regardless of which browser software users employ.

The research highlights a significant security vulnerability in how browsers interact with storage systems through OPFS. Since the attack requires no user permissions or interaction beyond visiting a compromised webpage, it represents a serious privacy threat for macOS users. The technique exploits fundamental aspects of SSD architecture and operating system file management that are difficult to patch at the browser level.

Browser-level fixes appear unlikely in the near term due to conflicting security classifications among major technology companies. Google does not classify fingerprinting as a security issue, Apple considers it out of scope, and Mozilla has acknowledged the problem without implementing solutions. This regulatory and policy landscape complicates efforts to develop effective countermeasures against FROST-style attacks.

Researchers at Graz University of Technology demonstrated that FROST can identify visited websites with approximately 89% accuracy and running applications with roughly 96% accuracy on an M2 Mac Mini using SSD latency measurements through the OPFS browser API. The attack requires no permissions or user interaction beyond visiting a malicious webpage, representing a significant privacy vulnerability in current macOS systems.