Decades-Old File Notification Flaws Expose Users Across Windows, macOS, Linux and Android

Security researchers from Graz University of Technology have identified flaws affecting file notification systems built into Android, Linux, macOS and Windows, some dating back over two decades. These subsystems, including Linux's inotify, Android's FileObserver, Windows' ReadDirectoryChangesW and macOS's FSEvents, are designed to alert applications when files are opened, changed or deleted. While they do not expose file contents directly, the timing and pattern of these notifications can act as a side channel that reveals what other users on a shared system are doing.

The researchers demonstrated that this leaked information could enable several types of attacks, including inferring keystrokes based on timing (even over remote SSH sessions), identifying which websites a user has visited, and tricking users through interface manipulation to steal credentials. Notably, the flaws allow unprivileged users to gain this insight even without direct read access to the files in question. One striking example showed that simply monitoring a readable directory such as /dev/input could allow an attacker to reconstruct keystrokes with accuracy as high as 100 percent.

Microsoft has reportedly stated that this behaviour is by design, suggesting a fix may not be straightforward or imminent across all platforms. The researchers have published further technical details of their findings, named 'File Notification Attacks,' highlighting how widespread and long-lived this class of vulnerability is.