Researchers at Graz University of Technology in Austria show that the file-change notification features built into Linux, Android, Windows, and macOS can be abused to monitor other users on the same system, from the rhythm of their typing to the websites they visit.
Linux, Windows, macOS, and Android let applications ask to be alerted when files are created, modified, or deleted. Text editors, file managers, sync clients, and antivirus products are among the programs that use this capability. It requires no elevated privileges, only read access to the location being watched.
The attacks never expose file contents, but the researchers demonstrated that file names and the timing of events are enough to reconstruct user, application, and system activity. Most of the attacks require an adversary who can already run code on the machine under a separate account. On Android, it would be an app that requests no permissions.
On Linux, a user who is denied permission to watch a protected file can still receive its events by watching the folder that contains it, as long as that folder is readable. Applied to the device files that represent keyboard input, this reveals when a user presses a key, though not which key.
Research going back more than two decades has shown that the intervals between keystrokes can help infer what is being typed. In tests with seven typists, the attack reliably detected keystrokes, scoring between 93.1% and 100% on a standard accuracy measure. Input that produces no on-screen text, such as a hidden sudo password, is not captured.
Other Linux attacks include website fingerprinting based on which system fonts Firefox loads for a page. This identified sites from the top 100 with an accuracy of 87.9%. The researchers also demonstrated a fake password prompt attack on the KDE Plasma 6 desktop running on Wayland. A malicious process running as the victim detects when the real authentication dialog is about to appear and draws a counterfeit over it to capture credentials.
The researchers carried out their Android evaluations on a Google Pixel and Samsung Galaxy phones. They found that an app with no permissions can watch another app’s private storage folder.
In tests against WhatsApp, the technique revealed when photos, videos, and documents were received or sent, along with their file names. It also revealed when that media was later deleted.
The most serious Windows issue arises when a user monitors the root of the system drive. Windows then reports the full path of every file changed anywhere on the machine, including inside other users’ home directories that the monitoring account cannot read.