File Notification APIs Expose User Actions
An operating system might steadfastly refuse to surrender a foreign file’s contents, yet it frequently still broadcasts precisely when operations occur upon it. A dedicated research team from Graz University of Technology has demonstrated that standard file event notification mechanisms across Android, Linux, macOS, and Windows actively facilitate the surveillance of other users and applications. This frightening reality persists even without possessing direct read access to the underlying file contents.
This systemic vulnerability afflicts the core mechanisms that applications inherently rely upon to monitor file openings, write operations, modifications, and deletions. In Linux environments, inotify executes this task; Android utilizes its FileObserver wrapper; Windows employs the ReadDirectoryChangesW API; and macOS leverages FSEvents. While these sophisticated side channels do not directly hemorrhage the actual data, the chronological sequence of events, specific file names, and the exact timing of operations collectively empower an attacker to meticulously reconstruct user behavior. You can review the comprehensive academic findings regarding how file notification mechanisms leak user behavior published by the researchers.
Surveillance Mechanics Across Disparate Platforms
Within the Linux architecture, an unprivileged user can actively monitor any readable directory, receiving detailed events originating from the files nested within, regardless of whether they possess direct access to those individual files. By observing the /dev/input directory, the research team successfully recorded precise keystroke timings. During rigorous testing, both local and cross-user attack vectors achieved a flawless F1-score of 100%. Astoundingly, for 66% of the recorded keystrokes, the timing was determined with a minuscule deviation of less than one millisecond. A virtually identical surveillance methodology functioned flawlessly between discrete users sharing a solitary SSH server.
On the Android platform, the FileObserver component proved startlingly capable of bypassing the FUSE layer, which traditionally isolates discrete application storage repositories. A rudimentary test application, completely devoid of supplementary permissions, successfully monitored the restricted WhatsApp media directory. It seamlessly intercepted both precise file names and their corresponding operational events. Analyzing these forensic footprints allows an attacker to deduce exactly when a user transmitted, received, or deleted a photograph, video, voice memo, or document. Crucially, while this method obscures the actual contents of the correspondence and media, it vividly paints a chronological picture of communication activity.
Windows yielded a significantly more direct and alarming surveillance channel. An unprivileged user can initiate observation directly upon the root of the C:\ drive. Consequently, they receive the absolute file paths affected by the active processes of completely disparate user accounts. Because the Mozilla Firefox browser generates specific directories intimately associated with visited websites, the experimental surveillance of the top 1,000 domains achieved a staggering F1-score of 97.8%. For the Microsoft Edge browser, the detection metric stood at 48.5%.
Vendor Responses and Lingering Vulnerabilities
Microsoft formally classified this specific behavior of ReadDirectoryChangesW as an undocumented, yet intended, function integrated into the system’s foundational architecture. Nevertheless, earlier in April 2025, the corporation prudently introduced a supplementary permission verification mechanism preceding the issuance of file modification notifications. This vital defensive layer is now bundled within standard Windows updates. However, it remains deactivated by default due to perceived risks of backward incompatibility with legacy applications. Administrators can review Microsoft’s documentation detailing the access check enhancements to prevent unauthorized disclosure of file paths to understand deployment procedures.
Conversely, macOS exposes a noticeably diminished volume of actionable data. The research team failed to discover a method utilizing FSEvents to circumvent the prohibition against reading restricted directories. However, by scrutinizing public files, they could still reliably detect the launching and operation of specific applications, the connection of peripheral devices, and modifications to audio outputs, power parameters, Bluetooth status, printing queues, and network configurations. Therefore, while the magnitude of the data leakage is comparatively weaker than on rival platforms, the mechanism unequivocally remains a viable surveillance channel.
For Linux environments, the most critically perilous facet of this vulnerability received a partial mitigation back in December 2025. Vulnerability CVE-2025-68788, which SUSE assigned a CVSS 4.0 severity rating of 5.7, permitted adversaries to capture access and modification events targeting special device files residing within the /dev directory. Subsequent kernel iterations ceased generating these specific notifications, effectively neutralizing the demonstrated keystroke surveillance attack vector. However, the broader architectural class of data leakage via file events has not been entirely eradicated.
Implementing these presented attack scenarios fundamentally requires local, unprivileged access, a secondary account on a shared workstation, or a previously executing malicious process—perhaps introduced via a compromised software package. The research team currently possesses no concrete evidence that these sophisticated attacks have been weaponized in real-world incidents. Furthermore, no dedicated, comprehensive defensive mitigations currently exist for either Android or macOS regarding these specific surveillance scenarios. The culmination of this research has been formally accepted for presentation at the prestigious ACM CCS 2026 conference.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
