What FROST and SDK-Based Scraping Reveal About Modern Privacy
FROST and SDK-based scraping are emerging attack methods that quietly exploit hardware behavior and “consent-sourced” network access to track users across sites and apps and to turn personal devices into hidden web-scraping infrastructure. FROST is a browser-based SSD timing attack that uses JavaScript and the Origin Private File System to infer which websites and native apps you open on the same drive, achieving up to 88.95% accuracy for cross-site tracking on macOS. In parallel, some free apps embed a commercial SDK that converts phones and smart TVs into residential proxy nodes, routing large volumes of web-scraping traffic to feed data-hungry AI tools. These techniques do not steal passwords directly; instead, they exploit gaps in app privacy models and network assumptions, showing that traditional settings and permissions are no longer enough to protect users’ online behavior and home connections.
Inside the FROST Attack: Cross-Site Tracking via SSD Timing
The FROST attack runs entirely in the browser and needs no extensions, permissions, or native code. A malicious page uses the Origin Private File System to create a file larger than system memory, forcing reads to touch the SSD instead of staying in cache. It then measures countless 4 kB reads with performance.now(), sharpening timer precision via cross-origin isolation. When you open other websites or desktop apps that use the same disk, their activity slows these reads in distinctive patterns. A trained neural network turns these timing traces into fingerprints. According to researchers at Graz University of Technology, “FROST identified the site being visited with an F1 score of 88.95%” for the top 50 websites on macOS and reached 95.83% for ten pre-installed apps, enabling powerful cross-site tracking without cookies or logins.
How Free Apps Turn Smart TVs Into Web-Scraping Proxies
A separate threat comes from app privacy leaks caused by embedded SDKs designed for large-scale web scraping. Researchers who reverse-engineered Bright Data’s iOS SDK found that when an app opens, the SDK quietly connects to Bright Data’s servers, which send scraping jobs with minimal authentication. The device then fetches web pages on behalf of paying customers, using the user’s home IP and bandwidth. Because many smart TVs are always plugged in, have fast, effectively unmetered connections, and are rarely monitored, they are prime targets for such proxy use. The same SDK model can relay up to 200 GB of traffic each month and may bypass VPNs on some platforms, weakening web scraping detection. Bright Data markets this network as a consent-sourced pool of more than 150 million residential IPs, but the opt-in wording in some apps understates the scale of activity.
Why Privacy Settings Fall Short Against These Techniques
Both FROST and SDK-based scraping highlight structural gaps in current privacy thinking. Browser controls focus on cookies, trackers, and permissions, yet FROST works within approved storage APIs and standard JavaScript, exploiting SSD timing side channels that browser vendors do not currently treat as security bugs. App permissions and smart TV privacy menus, meanwhile, say little about turning a device into a long-lived proxy that ships third-party traffic through a home IP address. Because Bright Data’s SDK uses consent-sourced residential IPs, its traffic can look like normal user browsing and may evade VPN-based web scraping detection or corporate monitoring tools. The result is a form of cross-site tracking and bandwidth exploitation that sidesteps familiar prompts and dashboards. These attacks show that privacy settings alone are no longer enough; meaningful protection now demands attention to how devices and networks behave under the hood.
Practical Steps to Reduce Your Exposure
Users cannot fully block these methods today, but they can shrink their risk. For FROST-style attacks, limit long-lived tabs from unfamiliar sites and, where feasible, disable JavaScript on untrusted pages or use browser profiles and containers to isolate sensitive browsing. On desktops, separating apps and data across different drives can reduce what SSD timing attacks can observe. For smart TV security and apps on phones or tablets, scrutinize free apps that request network access without a clear feature-based reason, and avoid those linked publicly to residential proxy providers. Regularly review installed apps, revoke permissions, and uninstall anything unused. Monitor home bandwidth usage via your router or ISP portal to spot unexplained spikes that could signal proxy activity. Finally, consider network-level protections, such as DNS filters and separate guest networks, to keep risky devices from sharing the same segment as work or personal machines.
