When people think about a cyberattack, they usually picture stolen passwords, malware, ransomware or someone exploiting a vulnerability to break into a system.
Side-channel attacks work differently. Instead of directly stealing a secret, an attacker studies the traces a computer produces while carrying out normal operations. Tiny differences in processing time, electricity consumption, electromagnetic signals, sounds or hardware activity can reveal clues about what is happening inside the machine.
Think of a locked safe. A thief may not know its combination or be able to break the lock, but if turning the dial produces different clicks or pauses, listening closely could reveal information about the combination. The safe is not deliberately revealing anything. Its physical behavior is simply giving away clues.
Computers can do much the same thing.
A problem that is decades old
Side-channel attacks are not a new phenomenon.
In 1985, Dutch researcher Wim van Eck demonstrated that electromagnetic emissions from video display units could be captured and decoded, potentially revealing what was being displayed. The screen was not intentionally broadcasting its contents, but its normal operation produced signals that could be observed externally.
The technique became particularly important in cryptography during the 1990s. In 1996, researcher Paul Kocher showed that measuring tiny differences in the time taken by cryptographic operations could reveal information about private keys. In 1999, Kocher, Joshua Jaffe and Benjamin Jun demonstrated that measuring power consumption could similarly expose information from cryptographic devices.
Researchers later showed that sound could become another source of leakage. Experiments demonstrated that acoustic emissions from laptops performing cryptographic operations could be analyzed to recover a 4,096-bit RSA key under controlled conditions.
These discoveries changed the way security engineers evaluated systems. A cryptographic algorithm could be mathematically secure while its implementation still leaked information through timing, power, sound or electromagnetic radiation.
When processor performance became a security problem
The rise of modern CPUs created another class of side channels.
Processors use speculative execution to predict which instructions a program will need and execute them ahead of time, improving performance. In 2018, researchers disclosed Meltdown and Spectre, demonstrating that traces left by speculative execution could allow malicious code to infer information that should have remained protected.
The attacks challenged an important assumption in computing: that programs running on the same machine can be reliably isolated from one another. They also demonstrated that security problems could originate from performance features built deep inside the processor rather than from conventional software bugs.
Researchers have continued finding similar problems in newer hardware.
In 2022, Hertzbleed showed that dynamic voltage and frequency scaling, a feature used to manage processor power and performance, could become a timing side channel. Because processor frequency can vary with the computation being performed, an attacker could potentially infer information remotely without directly measuring power consumption. The researchers demonstrated implications for cryptographic key extraction on modern Intel and AMD processors.
In 2023, Downfall exposed another weakness in certain Intel processors through the Gather instruction, while Zenbleed affected AMD's Zen 2 architecture and could expose information from another execution context under particular conditions.
The pattern is becoming difficult to ignore: features designed to make computers faster or more efficient can also create unexpected paths for information leakage.
Side channels are spreading beyond CPUs
Researchers are now finding these channels in other parts of the computing stack.
GPU.zip demonstrated how hardware-based graphics compression could create a side channel capable of exposing visual information processed by graphics processors. The research showed that the problem could extend beyond the CPU and into the way GPUs handle graphical data.
In 2024, GoFetch exposed another hardware-level problem in Apple processors. The attack targeted a feature called a data memory-dependent prefetcher, which predicts future memory requirements to improve performance. Researchers demonstrated that this behavior could undermine protections in cryptographic software and help extract secret keys.
These attacks illustrate why simply securing software is not always enough. Hardware underneath the software can produce information that applications never intended to expose.
The SSD can become a side channel too
The latest research pushes the idea even further.
In 2026, researchers at Graz University of Technology introduced FROST, short for "Fingerprinting Remotely using OPFS-based SSD Timing." The attack targets the browser's Origin Private File System, or OPFS, a feature that allows websites to store and access files within their own sandboxed storage area.
FROST does not give a malicious website direct access to another application's files.
Instead, it measures delays caused when multiple programs compete for the same SSD.
The concept is similar to traffic on a shared road. A driver does not need to see another vehicle to know that it is there. If traffic suddenly makes the journey slower, the delay itself provides information.
FROST applies the same principle to storage. A malicious webpage can repeatedly perform storage operations through OPFS and measure tiny changes in how long they take. Those changes can reveal patterns in other activity occurring on the same computer.
The researchers found that the technique could be used to fingerprint websites and applications. In their evaluation, FROST achieved an F1 score of 88.95% for website fingerprinting and 95.83% for application fingerprinting on tested systems. It can also operate remotely through JavaScript without requiring native code execution.
That does not mean websites can simply read a user's files or see everything happening on a computer. FROST is an inference attack. It identifies activity from the timing patterns produced by shared hardware resources.
A specialised threat, but an important warning
Side-channel attacks are not currently the everyday attack method most users are likely to encounter. Cybercriminals generally have easier options, including phishing, credential theft, malware, ransomware and exploiting vulnerable software.
But their importance extends beyond how frequently criminals use them.
Side-channel research repeatedly reveals that security boundaries can be weaker than they appear. A processor, GPU, browser or storage device may never intentionally disclose sensitive information, yet its normal operation can leave behind measurable clues.
From electromagnetic emissions and cryptographic timing to speculative execution, processor frequency, GPU compression and SSD activity, the side channel keeps changing as computing technology evolves.
Computers do not always need to be hacked for them to leak secrets.
Sometimes, all an attacker needs is to listen to what the machine reveals while it is doing its job.
