Sunday 27 September 2026
Afternoon EditionRSS

ZOTPAPER

News without the noise

ZOTPAPER
SecurityDeveloping

Decades-old file notification flaws leak sensitive data across major operating systems

Researchers find side-channel attacks possible through inotify, FileObserver, ReadDirectoryChangesW, and FSEvents

edit
By LineZotpaper
Published
Updated
Read Time3 min
Sources2 outlets
Security researchers at Austria's Graz University of Technology have uncovered vulnerabilities in the file notification subsystems of Linux, Android, Windows, and macOS that leak potentially compromising system information. The flaws, some dating back to 2000, allow unprivileged users to monitor file events and infer activities such as keystrokes, website visits, and credential use. While Linux received a partial patch in December 2025, the researchers say no mitigation has been made for Android, and Apple's macOS and Microsoft's Windows remain exposed to varying degrees.

The findings, detailed in a paper titled "File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS," affect inotify on Linux (since 2005), FileObserver on Android (since 2008), ReadDirectoryChangesW on Windows (since 2000), and FSEvents on macOS (since 2007). These subsystems inform applications when files change, but do not reveal file contents. However, the researchers demonstrated that file event information can be exploited as a side channel.

"We found decades-old bugs on [these operating systems], all rooted in the file-notification subsystems that every modern OS ships to inform applications when files change," said Sudheendra Raghav Neela, a doctoral student at TU Graz, in an email to The Register.

Attack scenarios typically require local access to an account with files readable by multiple users. The researchers note that the list of globally readable files is extensive. On Linux, watching "/dev/input" gives a notification on every keystroke, enabling a local inter-keystroke timing attack with 93.1–100 percent accuracy across seven users, and a remote (SSH) version at 100 percent. They also carried out an authentication-prompt redress attack on KDE Plasma 6 under Wayland and website fingerprinting on the top 100 sites at 87.9 percent.

On Android, FileObserver can bypass the FUSE layer meant to isolate per-app storage, allowing a permissionless app to watch private folders (e.g., WhatsApp) and see filenames and timestamps of photos, videos, and documents.

On Windows, watching the root directory C:\ reports the full path of every file touched anywhere on the system, across all users, regardless of permissions. The researchers showed this can track which websites on Firefox another user visits in real time at a 97.8 percent accuracy.

macOS provided the least information because no bypasses were found for reading private directories. Still, FSEvents allowed monitoring of various file changes in .plist files, including audio input/output changes, power settings, Bluetooth device updates, network cable-initiated DNS changes, and volume mount/unmount events.

The Linux vulnerability (CVE-2025-68788) was partially fixed in December 2025 in kernels 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 6.18.3. The patch prevents generation of "access" and "modify" events on special files in /dev/. The researchers say they responsibly disclosed findings to security teams between August and October 2025, but no mitigation has been made for Android devices. Apple and Microsoft have not publicly responded.

§

Analysis

Why This Matters

  • These vulnerabilities allow local attackers to monitor user activity (keystrokes, website visits, file operations) on shared or compromised systems, undermining privacy even without elevated privileges.
  • The flaws are decades old and widespread across all major operating systems, meaning the attack surface is immense for multi-user environments, corporate machines, and possibly cloud instances.
  • Partial patches exist only for Linux; Android, Windows, and macOS users remain unprotected, increasing the urgency for comprehensive fixes.

Background

File notification systems are core OS features that applications use to watch for file changes (e.g., a text editor updating a document). Because these systems were designed for functionality rather than security, they inadvertently expose file event metadata. The TU Graz research group, known for previous side-channel attacks, systematically tested the implementations across four OS families and found common design weaknesses: unprivileged access to the notification subsystem and lack of permission checks on the monitored file paths.

Key Perspectives

Security researchers (TU Graz): Emphasize that these are not theoretical — they demonstrated practical attacks with high accuracy (e.g., 100% keystroke accuracy via SSH, 97.8% website tracking on Windows). They argue that the fundamental design needs rethinking, not just point patches. Operating system vendors: Linux maintainers have acknowledged the issue with a partial fix. Apple, Microsoft, and Google have not publicly commented or issued patches for their affected subsystems as of the paper's publication. Critics/Skeptics: May note that most attacks require local access to a multi-user system, limiting the immediate threat to shared computers, remote desktop environments, or already compromised machines. However, the research shows that even sandboxed apps on Android can exploit FileObserver without special permissions.

What to Watch

  • Apple's response: Will macOS receive a patch for FSEvents or will Apple argue the limited information leakage is acceptable?
  • Android patch timeline: Google has not yet addressed the FileObserver bypass of FUSE, which is particularly concerning for sandboxed apps.
  • Further research: Whether similar flaws exist in other notification systems (e.g., Windows Update events, systemd journal) and whether the work will spur changes to how file events are exposed to unprivileged users.

Sources

newspaper

Zotpaper

Articles published under the Zotpaper byline are synthesized from multiple source publications by our AI editor and reviewed by our editorial process. Each story combines reporting from credible outlets to give readers a balanced, comprehensive view.

Editorial ProcessSubscribe