I laugh at your spying attempts from my HD-equipped laptop, ...
I got $HOME in a huge HDD because it was cheaper. I guess we belong to the cool kids club now?
Websites have a new way to spy on visitors: analyzing their SSD activity
11–20 of 97 posts
Re: Websites have a new way to spy on visitors: analyzing their SSD activity
#12Wait, wait, wait: browsers allow websites to store junk on my drive? They take up gigabytes of memory and still write to disk on top of this? Without even asking whether the site can use local storage? Years and years back when laptops still had HDDs, I had a script to put the Firefox profile &c on a ramdisk and sync it on reboots so that it didn't spin up the drive constantly. I guess I should have kept doing it. It…
That surprised me as well. I thought the whole point of cookies, local storage, session storage, and indexed DB were to avoid what origin private file system is doing. You mean I could have just saved stuff as a file this whole time instead of serializing it to a string? Why didn't we just do this from the start?
It's still sandboxed and deleted when the user clears private data for the website.
The main advantage it has over things like cookies, local storage, etc. is that it provides a byte-oriented, random access API and as a result, you can use third-party libraries like SQLite that expect a file API. Which is more important now that we have tools like Emscripten and WebAssembly that let you use existing C libraries on the web. At the same time it has security guarantees such that webpages cannot write arbitrary files that will be viewed and executed by the user.
Also, in theory you could use this side-channel attack on localStorage and sessionStorage. Its only requirement is that it needs an API that writes to disk where you can measure the latency of a synchronous call, since the fingerprinting is just measuring the interference pattern between disk accesses the attacking website does vs. disk accesses that other websites do.
Re: Websites have a new way to spy on visitors: analyzing their SSD activity
#13Wait, wait, wait: browsers allow websites to store junk on my drive? They take up gigabytes of memory and still write to disk on top of this? Without even asking whether the site can use local storage? Years and years back when laptops still had HDDs, I had a script to put the Firefox profile &c on a ramdisk and sync it on reboots so that it didn't spin up the drive constantly. I guess I should have kept doing it. It…
Is this surprising? Websites have long been silently writing to disk, for cache, cookies, and blobs. OPFS just provides a file-system-like API for ultimately the same functionality
Re: Websites have a new way to spy on visitors: analyzing their SSD activity
#14I’m skeptical of these side channel attacks that rely on training a neural network on specific controlled scenarios on controlled hardware. I believe that with enough time and effort and the perfect circumstances where the user is only visiting their website and doing one other thing that the network was trained on it can match.
It does not seem useful as a general purpose side channel vector.
Re: Websites have a new way to spy on visitors: analyzing their SSD activity
#15I’m skeptical of these side channel attacks that rely on training a neural network on specific controlled scenarios on controlled hardware. I believe that with enough time and effort and the perfect circumstances where the user is only visiting their website and doing one other thing that the network was trained on it can match. It does not seem useful as a general purpose side channel vector.
It depends what you mean by "general purpose." First, these things generalize more often than you'd expect. Second, even in the absence of generalization they're still useful for, e.g., fingerprinting activities to manufacture a unique ID where non previously existed.
Re: Websites have a new way to spy on visitors: analyzing their SSD activity
#16I’m skeptical of these side channel attacks that rely on training a neural network on specific controlled scenarios on controlled hardware. I believe that with enough time and effort and the perfect circumstances where the user is only visiting their website and doing one other thing that the network was trained on it can match. It does not seem useful as a general purpose side channel vector.
That's basically just a research, theoretical attack vector. It doesn't mean it's viable for general purpose old school mass privacy invasion
Re: Websites have a new way to spy on visitors: analyzing their SSD activity
#17It's really not surprising that letting websites run arbitrary code on your machine, even in a sandbox, would lead to things like this.
Re: Websites have a new way to spy on visitors: analyzing their SSD activity
#18Still don't really understand how it works - I put the reddit logo into your local storage and it only took 20ms to take it out again instead of 50ms so therefore you have reddit open in another tab?
I assume it's something like this: Attacking website periodically makes random reads from a large file in localStorage. Other tabs and websites open have Javascript running that periodically performs operations that will result in SSD traffic. For example, GMail has a certain polling interval to check for new mail, and each request is going to result in a cache write that makes the SSD busy and delays other conflicti…
That's interesting. Thanks for the explanation. If I read this right this isn't as effective against spinning HD-based systems and there is a dependence on the user maintaining more than one tab as they browse?
If that's the case then my system which is still HD-based is not threatened and since I tend to close tabs and windows and just spin up a new private window for each site while clearing cookies, etc on exit then maybe this is a non-issue for me. Or maybe just block javascript too.
Re: Websites have a new way to spy on visitors: analyzing their SSD activity
#19It's really not surprising that letting websites run arbitrary code on your machine, even in a sandbox, would lead to things like this.
There's no such thing as a sandbox "on your machine" when you really think about it. The code still runs on the same hardware and there are tons of ways to fiddle with said hardware that could be exploited (like rowhammer). The only "real" sandbox is fully dedicated hardware down to bare metal with zero connections to sensitive systems.
Re: Websites have a new way to spy on visitors: analyzing their SSD activity
#20It's really not surprising that letting websites run arbitrary code on your machine, even in a sandbox, would lead to things like this.
And now that Google's web environment integrity is getting repackaged into captchas, it seems we won't even be able to try to block such things in the future...