6 ms·
Websites have a new way to spy on visitors: analyzing their SSD activity
- userbinator 5mo agoIt's really not surprising that letting websites run arbitrary code on your machine, even in a sandbox, would lead to things like this.
- sigmoid10 5mo agoThere's no such thing as a sandbox "on your machine" when you really think about it. The code still runs on the same hardware and there are tons of ways to fiddle with said hardware that could be exploited (like rowhammer). The only "real" sandbox is fully dedicated hardware down to bare metal with zero connections to sensitive systems.
- matheusmoreira 5mo agoAnd now that Google's web environment integrity is getting repackaged into captchas, it seems we won't even be able to try to block such things in the future...
- jjgreen 5mo agoI laugh at your spying attempts from my HD-equipped laptop, ...
- falsaberN1 5mo agoI got $HOME in a huge HDD because it was cheaper. I guess we belong to the cool kids club now?
- progval 5mo agoThe paper (https://hannesweissteiner.com/pdfs/frost.pdf https://hannesweissteiner.com/pdfs/frost.pdf) cites two earlier papers (from 2014 and 2017) that did the same for HDDs.
- gblargg 5mo agoOr mine where the entire browser profile is on a ramdisk.
- lima 5mo agoHigher IO latencies in HDs might actually make this attack easier - more contention means more bits of data.
- tosti 5mo agoI laugh at your spying attempts from my cURL e-mail service that I use instead of a web browser.
- tovve 5mo agoStill don't really understand how it works - I put the reddit logo into your local storage and it only took 20ms to take it out again instead of 50ms so therefore you have reddit open in another tab?
- nostrademons 5mo agoI assume it's something like this: Attacking website periodically makes random reads from a large file in localStorage. Other tabs and websites open have Javascript running that periodically performs operations that will result in SSD traffic. For example, GMail has a certain polling interval to check for new mail, and each request is going to result in a cache write that makes the SSD busy and delays other conflicting IO operations. Reddit checks for new chat messages. Large memory-heavy websites get paged out of RAM. The pattern of IO operations that a website makes creates a fingerprint of interference with the IO ops that the attacking website is doing, showing up as differing amounts of latency as the SSD is periodically busy. This fingerprint can then be reconstructed to a specific website by training a CNN on it, basically using a neural net to classify a certain pattern of delays to the IO ops that other websites are doing. In theory it makes sense, but it seems very noisy. Anything that makes absolutely zero requests or IO operations in the background (like say HN, or most old-school text sites) wouldn't show up, and would be indistinguishable from any other zero-request site. And having other sources of IOps on the same computer - say you're running an Ethereum client that's perpetually updating the blockchain, or you're downloading a bunch of torrents, or you've got DropBox and it's syncing your directory - would introduce noise that throws off the classifier.
- puppycodes 5mo agoThats a good explination. It does seem extremely noisy and not at all practical for fingerprinting a user compared to other methods. If you have javascript enabled assume you can be fingerprinted.
- doodlebugging 5mo agoThat's interesting. Thanks for the explanation. If I read this right this isn't as effective against spinning HD-based systems and there is a dependence on the user maintaining more than one tab as they browse? If that's the case then my system which is still HD-based is not threatened and since I tend to close tabs and windows and just spin up a new private window for each site while clearing cookies, etc on exit then maybe this is a non-issue for me. Or maybe just block javascript too.
- mrbluecoat 5mo agoFor a more technical read: https://news.ycombinator.com/item?id=48345822 https://news.ycombinator.com/item?id=48345822
- blfr 5mo agoWait, wait, wait: browsers allow websites to store junk on my drive? They take up gigabytes of memory and still write to disk on top of this? Without even asking whether the site can use local storage? Years and years back when laptops still had HDDs, I had a script to put the Firefox profile &c on a ramdisk and sync it on reboots so that it didn't spin up the drive constantly. I guess I should have kept doing it. It's a sad day when Arch users are right (again) https://wiki.archlinux.org/title/Firefox/Profile_on_RAM https://wiki.archlinux.org/title/Firefox/Profile_on_RAM
- AlienRobot 5mo agoThat surprised me as well. I thought the whole point of cookies, local storage, session storage, and indexed DB were to avoid what origin private file system is doing. You mean I could have just saved stuff as a file this whole time instead of serializing it to a string? Why didn't we just do this from the start?
- nostrademons 5mo agoIt's still sandboxed and deleted when the user clears private data for the website. The main advantage it has over things like cookies, local storage, etc. is that it provides a byte-oriented, random access API and as a result, you can use third-party libraries like SQLite that expect a file API. Which is more important now that we have tools like Emscripten and WebAssembly that let you use existing C libraries on the web. At the same time it has security guarantees such that webpages cannot write arbitrary files that will be viewed and executed by the user. Also, in theory you could use this side-channel attack on localStorage and sessionStorage. Its only requirement is that it needs an API that writes to disk where you can measure the latency of a synchronous call, since the fingerprinting is just measuring the interference pattern between disk accesses the attacking website does vs. disk accesses that other websites do.
- sheept 5mo agoIs this surprising? Websites have long been silently writing to disk, for cache, cookies, and blobs. OPFS just provides a file-system-like API for ultimately the same functionality
- opengrass 5mo ago{first.last}@tugraz.at
- Aurornis 5mo agoI’m skeptical of these side channel attacks that rely on training a neural network on specific controlled scenarios on controlled hardware. I believe that with enough time and effort and the perfect circumstances where the user is only visiting their website and doing one other thing that the network was trained on it can match. It does not seem useful as a general purpose side channel vector.
- hansvm 5mo agoIt depends what you mean by "general purpose." First, these things generalize more often than you'd expect. Second, even in the absence of generalization they're still useful for, e.g., fingerprinting activities to manufacture a unique ID where non previously existed.
- Aurornis 5mo agoThe paper isn’t describing a unique ID fingerprint. It’s looking for specific activity patterns to match against training data of running specific commands on specific hardware.
- ramenat2am 5mo agoThat's basically just a research, theoretical attack vector. It doesn't mean it's viable for general purpose old school mass privacy invasion
- 1970-01-01 5mo agoPublish or perish. It worked once, in a controlled lab, mostly (80-90% guess). Good enough for more millions in funding.. Not really joking here. https://hannesweissteiner.com/ https://hannesweissteiner.com/ https://hannesweissteiner.com/publications/frost/ https://hannesweissteiner.com/publications/frost/
- ptek 5mo agoAhhh Arstechnica, I wonder if the technical article is by Dan Goodin. (It is) I enjoyed his C Programming books for dummies series.
- francoi8 5mo agoIt should be fairly easy to mitigate no? Simply add random access times. Localstorage doesn't need to be that fast. More generally I find it very annoying how much browsers allow by default (javascript, localstorage, gpu access etc.) - there's only a very limited amount of websites I want to be able to run gpu accelerated shaders.
- ars 5mo ago> Simply add random access times. That doesn't work. Because the random times are uniformly distributed it's possible to remove it from the data by additional sampling. You do make it harder because you need a lot more data, but it's still possible to extract the signal, because the noise is uniform.
- progval 5mo agoThe random times don't have to be uniformly distributed. Though it's enough for attackers to know the distribution to de-noisify it.
- eterm 5mo agoThe interesting mitigation would be snapping I/O to a course clock. You could then set it to hold the result until the next tick. E.g. An I/O tick of 20ms, and it would only return on 20ms boundaries, then almost every SSD would look the same. It would slow down the API a bit, but privacy has tradeoffs.
- danbruc 5mo agoProbably still does not work. Assume a request takes X ms and let us look at what you will observe depending on where within a tick period it arrives. If it arrives anywhere from 0 ms to (20 - X) ms after a tick, it will complete before the next tick, so the measured duration will be between X ms and 20 ms. If it arrives later in the tick period, it will miss the next tick and have to wait an additional tick period, so the measured duration will be between 20 ms and (20 + X) ms. If you make N repetitions, you would normally see a spike of density 1 at X. With the 20 ms tick wait, you will see a uniform distribution of density 1/20 between X and (20 + X). You would have to perform each request and then return the result exactly 20 ms after it was received in order to mask the request duration. But that just creates a new target, your timers and queues to delay the response. Or making the load so high, that requests take more than 20 ms.
- exabrial 5mo agocorrection, websites have a way to spy on visitors: Javascript.
- mr-pink 5mo agosounds like nonsense. i guess this works on some test environment but not in real life. you would never know that I am running tetris, for example
- dwedge 5mo ago> Even Meta and Yandex were recently caught joining in the privacy-invasive free-for-all. Damn, even Meta have joined the dark side?
- meindnoch 5mo agoSic transit gloria mundi :'(
- dbg31415 5mo agoMaybe don’t let Google decide what its browser can and can’t do on my computer… Why do browsers need to do this? Feels like an edge case need, at best, that was likely just a cover for some power Google wanted to exploit.
- gblargg 5mo agoI'm surprised their 1GB file wasn't cached entirely in RAM during the attack, eliminating the SSD from any timing. Do people keep their machines that heavily loaded that a file being constantly read from doesn't stay in the cache?
- basilikum 5mo agoI think what would be more interesting is using this as a side channel for communication between different sandboxed contexts.
- zeafoamrun 5mo agoThat's it, I'm turning off JavaScript for everything non essential from here on out.
- everdrive 5mo agoBeen doing that for years and do not regret it.
- botw44 5mo agoI was interested in this so i created a proof of concept: https://github.com/brammittendorff/opfs-ssd-timing https://github.com/brammittendorff/opfs-ssd-timing
- sillyboi 5mo agoWhy don't SSDs trust websites anymore? Because every time they open up, the site gives them the F̶R̶O̶S̶T̶ cold shoulder.
- veunes 5mo ago[dead]
- bzmrgonz 5mo agoI wonder if mozilla's container tabs blocks this type of tracking?
- pixel_popping 5mo agoWhy would it be a new way? Tracking via timing have always existed, you can also know browsing history of someone with some DNS trick, nothing really new, article is misleading with "new way", it's literally possible since a decade.
- matltc 5mo agoWhy is everything like this? One must do backflips to thwart these attempts at surveillance. I am getting pretty tired of it and about to go full Stallman
- coldacid 5mo agoRemember when the web was (almost) all static content and all browsers had to do was show it to you? When applications were native? We really need to go back.
- user____name 5mo agoIt’s ActiveX all over again.