Researchers at the Technical University of Graz (Austria) found mistake Implementation of operating system notification features for file operations – They affect Android, Linux, macOS and Windows platforms. Due to these errors, there is a threat of leakage of confidential information.
Image source: Boitumelo/unsplash.com
This issue affects Linux inotify (since 2005), Google Android FileObserver (since 2008), Microsoft Windows ReadDirectoryChangesW (since 2000), and Apple macOS FSEvents (since 2007). They notify the operating system that files have been opened, modified, written to, or deleted. These features do not reveal the contents of files, but information about their events can serve as a secondary channel to help a hypothetical attacker draw conclusions about the actions of other computer users. With information about file events, you can conduct attacks based on analyzing the time intervals between keystrokes – this allows you to intercept user input not only locally, but also over SSH; you can also conduct attacks to identify visited sites and perform interface spoofing attacks to steal credentials.
The problem is that unprivileged users have access to the file activity notification subsystem; furthermore, in Linux and Windows, information about files is available even without read permissions. The attack scenario assumes that an attacker has access to an account that contains files that multiple users have permission to read – the list of files that all users can read is very extensive. “On Linux, monitoring a readable directory reveals information about events involving files within it, including those without read permission: Monitoring “/dev/input” allows you to receive notifications about each keystroke. We used this notification in a local attack to analyze the intervals between keystrokes, with an accuracy of 93.1-100% for 7 users, and 93.1-100% for a remote attack via SSH. 进行准确度为100%，而通过SSH 准确度为100%，而通过SSH 进行准确度为100%，而通过SSH 进行准确度为100%，而通过SSH 进行准确度为100%，而准确度为100%，而通过SSH 进行准确度为100%，而准确度为100%，而准确度为100%，而准确度为100%”。said the study’s authors. An attack was simulated by spoofing the authentication request interface in a KDE Plasma 6 environment; the accuracy of identifying the sites with the 100 most accessed resources was 87.9%. (CVE-2025-68788) was partially patched in December 2025 in kernel versions 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64 and 6.18.3
Image source: KeepCoding/unsplash.com
“Android’s FileObserver mechanism bypasses FUSE, which is designed to isolate individual application storage. Therefore, an application without special permissions can track (for example) a closed WhatsApp folder and accurately determine when photos, videos and files were sent, received or deleted based on file names and timestamps.”experts pointed out. Between August and October 2025, they reported their findings to Linux, Android, Windows, and macOS developers. The Android developers presumably didn’t do anything about it. The least amount of information was gained when using Apple macOS – we couldn’t find a way to find the limit on reading closed directories. However, the FSEvents subsystem allows you to track various file changes reflected in the .plist file. These changes include audio input and output switches, power setting changes, Bluetooth device and printer information updates, DNS changes when connecting network cables, and volume attach and detach events.
“On Windows, monitor the root directory “C:\” Allows you to get the full path to any file accessed on your system – regardless of which user performs the action, and regardless of access permissions. This is enough to instantly track the websites other users visit in Firefox – with an accuracy of 97.8%. ““, warn the researchers. However, Microsoft responded that this is an undocumented feature provided by the architecture. Experts recommend extending the mechanism for checking access rights to monitor the user’s own files: in Windows, monitoring of the entire disk is prohibited; in Windows and macOS – implementing a system that differentiates access rights at the core level.
If you find an error, select it with your mouse and press CTRL+ENTER.
