Researchers demonstrate file-notification side channels on four operating systems

Researchers at Graz University of Technology have demonstrated that file-notification mechanisms in Windows, Linux, Android and macOS can expose information about activity involving files that applications or other users cannot directly read. In proof-of-concept attacks across the four platforms, the team observed file names and filesystem events, traced some browser-related folders, inferred the timing of keystrokes, monitored activity in WhatsApp directories and placed a counterfeit password prompt over a genuine Linux authentication window. The experiments generally did not reveal the contents of protected files; instead, they exploited a side channel through metadata about changes. The findings show that restricting access to files and folders does not necessarily restrict who can learn that protected operations are occurring.

The study examined file-notification systems, which monitor whether files are created, deleted, opened, closed or modified and automatically deliver notifications when those events occur. Applications and operating-system components can use these notifications to react to changes. The Graz team found that applications or other users on the same system could also monitor the notifications without administrator rights. A readable parent directory was sufficient in the demonstrated cases to receive notifications for activity involving files in protected locations. Because the notifications exposed names, timing and the sequence of changes, they could reveal aspects of user, application and system behavior even when the underlying contents remained inaccessible.

On Windows, the researchers connected their monitoring technique to the root C:\ directory, which was readable even when child directories and files were not. By observing notifications associated with the root directory, they were able to track file-system events throughout its subfolders and recover associated file names. The attack did not need direct read access to those subfolders or their contents. Instead, the directory hierarchy supplied a path through which change notifications revealed activity at deeper levels. The demonstration establishes that a readable ancestor directory can expose metadata concerning protected descendants in this tested configuration. It does not establish that every Windows application or folder arrangement permits the same degree of observation.

The Windows case study also showed how file notifications could expose browsing-related activity. The researchers noted that Firefox creates a separate folder for each visited website that requires local storage, with the website name included in the folder name. An observer of directory notifications could therefore detect the creation of site-specific folders and infer where a user had been on the internet in near real time. This method did not require reading the browsing database or the contents of locally stored site data; the relevant information came from directory names and notification timing. The result was demonstrated for the browser and operating-system configuration used in the study, rather than being presented as a universal exposure across all browsers.

On Linux, the team used inotify to monitor changes associated with a protected file containing keystrokes. Linux initially prevented direct monitoring of the file, but the researchers could observe events because the file was located inside a readable folder. Notifications for that folder exposed the timing of changes even though the keystroke record itself could not be read directly. Although the method did not show which individual keys had been pressed, it revealed the intervals between successive keystrokes. The researchers related this signal to inter-keystroke timing analysis, an approach that has been used for more than two decades to infer information from the time between inputs. Their demonstration therefore converted file-system change timing into a side channel rather than using a conventional keylogger or direct keyboard-input access.

The researchers also demonstrated a password-prompt spoofing attack against KDE Plasma, a desktop environment on Linux. They monitored the executable file associated with polkit, an interface that performs authorization checks. When the notifications indicated that an access attempt had opened a password window, the test attackers superimposed a fake password-entry window over the genuine prompt. A user entering credentials into that counterfeit window could therefore disclose them to the attacker. The experiment worked even with the secure Wayland display-server protocol in use. What made the attack more than a generic overlapping-window demonstration was its notification-based trigger: file activity associated with the authorization interface was used to identify the moment when the real password prompt appeared.

On Android, the team tested a protection mechanism intended to keep applications from accessing one another’s folders. An application without special permissions was able to work around that isolation by observing file notifications associated with another application’s directory. In the researchers’ test, this allowed them to monitor whether images, videos and other files arrived in, were sent from or were deleted from folders associated with WhatsApp. The observing application could read the relevant file names, but not the contents of the files. Those names might disclose information about the material being exchanged or the behavior of the phone’s user. The case study demonstrates the limitation of the tested folder-isolation arrangement: protected application files could remain unreadable while externally observable event information remained available through notifications.

The macOS experiments used FSEvents, the operating system’s application programming interface for file-system change notifications. The researchers found that user, application and system behavior could still be tracked through this mechanism. The source reports that macOS exposed the least information through globally readable files in the team’s assessment, and the macOS case should not be interpreted as equivalent in scale to the Windows demonstration, which used a readable root directory to follow events throughout many subfolders. The supported conclusion is narrower: the FSEvents mechanism still provided meaningful information about activity despite macOS’s treatment of globally readable files. As in the other cases, the demonstrated leakage concerned observable changes and associated metadata rather than direct access to file contents.

Across the platforms, the proof-of-concept attacks produced different consequences from the same general separation between reading a file and observing events involving it. On Windows, the researchers demonstrated recursive filesystem monitoring and inference of browsing activity from site-named folders. On Linux, they showed keystroke-timing leakage through inotify and prompt spoofing in KDE Plasma. On Android, an ordinary test application monitored WhatsApp directory activity. On macOS, FSEvents notifications continued to reveal meaningful behavior. These were separate case studies with platform-specific mechanisms, application behavior, directory permissions and interfaces. The work does not show that all applications or configurations are equally exposed, that every attack can operate without the conditions used in the demonstrations, or that the methods are being used in the wild.

The team said it alerted the relevant teams at Linux, KDE, Android, Microsoft and Apple early in the process, allowing them to respond before the paper was published. In collaboration with the Linux security team, patches had already been distributed for some of the vulnerabilities. The findings were presented in the paper “File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS,” together with material on a dedicated project website. The research is a cross-platform security study and a series of practical proof-of-concept attacks rather than a claim that protected file contents can universally be read without authorization. Its central result is that file names, change sequences and timing remained observable through notification mechanisms in the tested systems, and in the KDE case those signals could support interception of a password entry.

Subject of Research: Cross-platform side-channel vulnerabilities in operating-system file-notification systems

Article Title: File-notification systems leave Windows, Linux, Android and macOS vulnerable

Article References: File-notification systems leave Windows, Linux, Android and macOS vulnerable. Original publication (Bibliographic details unavailable.)

Image Credits: AI Generated

DOI: Not provided

Keywords: file notifications, side-channel attacks, cybersecurity, Windows, Linux, Android, macOS, inotify, FSEvents, password spoofing, File-notification, systems