File Notification Attacks: Side-Channel Leaks on Linux, Android, Windows, and macOS
Translated by a model; the original is in Russian.
File-notification systems exist so applications learn when files change: opened, written, deleted. A team from the Institute of Information Security at Graz University of Technology has shown that this is enough for a serious leak. With only read access to a directory, an attacker can watch the events and reconstruct what a user does. The work has been accepted at the ACM CCS conference in November 2026.
The generic issues are similar across all four systems, but three of them carry especially severe, platform-specific flaws.
Linux: inter-keystroke timing
An inotify watch on an unreadable file fails, but if the parent directory is readable the watcher receives events for every file inside it. Watching /dev/input reveals each keypress. Which key was pressed is not exposed, yet the gaps between presses leak information on their own — a line of attack more than two decades old. The same trick works between two users on one SSH server via /dev/pts.
Linux: authentication-UI redress
By watching accesses to /usr/bin/pkexec, a process learns the moment a password dialog is about to appear and quickly draws a fake window over it. In KDE Plasma on Wayland the focus-stealing prevention, as KDE's own security team admits, was never meant as a security mechanism.
Android: private communication
The FileObserver class bypasses the FUSE layer that isolates apps' private folders. An app with no permissions cannot list files in WhatsApp's folder, but it can subscribe to events there and receive file names. The name reveals the media type and whether it was sent or received; the events build a precise timeline of a conversation, including deletions.
Windows: watching which sites you visit
A watch on the root directory C:\ makes the system report events across the whole drive together with full paths — regardless of permissions, even across users. Microsoft called this an "undocumented feature." Firefox creates a directory named after each website, allowing an attacker to track visits to the top-1000 sites with about 98% accuracy.
The fixes
In December 2025 the Linux flaw was partially mitigated (CVE-2025-68788): events are no longer generated for the character devices in /dev/. Windows gained an optional registry policy that is disabled by default — meaning the attacks work out of the box. Android and macOS have no fix; macOS, however, exposes the least. The attacks require a local cross-user foothold or a compromised package, and the authors know of no exploitation in the wild.
Source: Lobsters
Comments
Sign in, to comment.