Login
You're viewing the mastodonapp.uk public feed.
  • Hannes Weissteinerhweissi@infosec.exchange
    May 20, 2026, 3:01 PM

    Announcing my latest first-author paper, accepted to #DIMVA2026:
    ❄️ FROST: Fingerprinting Remotely using OPFS-based SSD Timing.

    While SSD contention-based side channels have been demonstrated from native code before, we bring them to the browser.

    We use the Origin-Private File System (OPFS), which allows any website to use up to 10GB (Firefox), or 60% of total disk space (other browsers), from JavaScript, without any user interaction or special permissions.
    We use a file larger than system RAM to measure SSD latencies, bypassing the page cache to guarantee disk access.
    From the resulting traces, we can infer website visits (even across browsers!) and application startups.

    While we did most of our evaluations on macOS, the underlying mechanisms are platform-agnostic.
    This is a feature, not a bug!

    Read the paper here: hannesweissteiner.com/publicat

    Thanks to Tobias Weiser, @wayna, @vmcall, Fabian Rauscher, Jonas Juffinger and @lavados for the collaboration!

    💬 1🔄 9⭐ 3

Replies

  • shellsharksshellsharks@shellsharks.social
    May 20, 2026, 4:10 PM

    @hweissi Cool! Thanks for sharing. I added FROST (and a few others I was not aware of from your already-published works here vulnerability.garden). 🪴🤗

    Quick somewhat-related question though. I’ve noticed in this research, and *so* many other similar published white papers, that the authors do not include a Published Date. Why is this? At best I’ll get a year-published for citation purposes, but I’d personally love to know the month+day as well.

    Anyways, thanks again!!

    💬 1🔄 0⭐ 0
  • Hannes Weissteinerhweissi@infosec.exchange
    May 20, 2026, 4:55 PM

    @shellsharks I guess the "official" published date would be the 1st of july when the conference takes place. In our field, academia revolves a lot around yearly conferences. So, specific days don't really matter that much, and "DIMVA 2026" is everything you need to know for "publication date".

    For what it's worth, while not officially published yet, the paper became public just now, when i uploaded it on my website and posted about it here.

    💬 1🔄 0⭐ 0
  • Hannes Weissteinerhweissi@infosec.exchange
    May 20, 2026, 4:58 PM

    @shellsharks Also, I checked out the site, and saw that you included CRACKPIPE. That was my master's thesis, which was the base for CounterSEVeillance (which you already have in your list). It's not an issue for me, just letting you know that there's a fairly large overlap between the two.

    It's a nice collection of attacks!

    💬 0🔄 0⭐ 1
  • 💬 0🔄 0⭐ 0