File Notification Systems in Major OSes Leak User Activity

Vulnerability in File Notification Systems

Researchers at Graz University of Technology have identified a vulnerability in the file-change notification features present in Linux, Android, Windows, and macOS. These systems, designed to alert applications when files are created, modified, or deleted, can be exploited to monitor user activity. This includes inferring typing patterns and websites visited, even without elevated privileges, requiring only read access to the monitored location.

Attack Mechanisms and Scope

The attacks do not expose the content of files but leverage file names and the timing of events to reconstruct user, application, and system activity. For most operating systems, an adversary must already be able to run code on the machine under a separate account. On Android, however, a malicious app can perform these actions without requesting any special permissions.

Specific Exploits Demonstrated

On Linux, researchers showed that watching a folder containing protected files can reveal events, even if the user lacks permission to watch the files directly. This was used to detect keystrokes by monitoring device files representing keyboard input, achieving 93.1% to 100% accuracy in tests. Other Linux attacks included website fingerprinting via system font loading in Firefox, identifying top 100 sites with 87.9% accuracy, and a fake password prompt attack on KDE Plasma 6 on Wayland.

Android evaluations on Google Pixel and Samsung Galaxy phones revealed that a permission-less app could monitor another app's private storage. This allowed detection of when photos, videos, and documents were received, sent, or deleted in WhatsApp, along with their file names. The most significant Windows issue involves monitoring the root of the system drive.

Implications for User Privacy

This research highlights a significant privacy concern, as common operating system features can be repurposed for surveillance. While file contents remain secure, the metadata and timing of file operations are sufficient to reconstruct sensitive user behaviors. This underscores the need for developers and users to be aware of the potential for side-channel attacks through seemingly innocuous system functionalities.