File-Change Notifications Can Reveal User Activity Across Four Operating Systems, Researchers Find
Summary
Researchers showed that file-change notifications can expose user activity across Linux, Android, Windows, and macOS. Attacks can reveal keystroke timing, visited websites, and app activity; most require local code execution, while Android examples needed no app-per
Key points
- File-change notification access can reveal file names and event timing, but not file contents; most attacks require code running locally under a separate account.
- On Linux, monitoring readable folders can expose keyboard-event timing and support website fingerprinting; researchers also demonstrated a fake KDE Plasma password prompt.
- In Android tests, an app without permissions could monitor another app’s private storage and track media transfers and deletions in WhatsApp.
- On Windows, monitoring the system-drive root can expose paths of changed files across users; Firefox folder names also enabled website tracking.
- macOS exposed less, but researchers could track application launches, interactions, and settings changes.
- Linux has partially hardened device-file notifications, tracked as CVE-2025-68788; the article reports no fixes for most other scenarios. Microsoft considers its behavior by design and cites administrator protections for some path-disclosure scenarios.
- Researchers reported no known in-the-wild exploitation; proof-of-concept code was published.
Article Details
- Attack Vectors
- On Linux, an unprivileged process can watch a readable folder containing protected device files and infer keyboard activity from file-change events.
- Linux file-change notifications can reveal which websites are visited by monitoring Firefox font loads and can support a counterfeit KDE Plasma 6 authentication dialog on Wayland to capture credentials.
- On Android, an app with no permissions can monitor another app’s private storage folder and infer file activity, including media transfers and deletions in WhatsApp.
- On Windows, monitoring the system-drive root can expose paths of files changed across the machine, including files in other users’ home directories.
- On macOS, monitoring globally readable files can reveal application launches, app interactions, and settings changes.
- Defensive Notes
- The Linux kernel has been partially hardened to prevent device files from generating access and modify events; the fix is tracked as CVE-2025-68788.
- The researchers listed no fixes for the Android or macOS attack scenarios.
- Microsoft said the Windows behavior is by design and pointed administrators to protections documented in April 2025 for certain file-path disclosure scenarios involving directory change notifications.
- Microsoft recommended limiting local access to trusted users and keeping systems up to date.
MITRE ATT&CK
CVE
Vendors
AppleApple and Google have not responded to SecurityWeek’s request for comment.GoogleThe researchers carried out their Android evaluations on a Google Pixel and Samsung Galaxy phones.MicrosoftMicrosoft told the researchers that the Windows behavior is by design, and that it reveals only file names and paths in another user’s profile directory, not file contents or sensitive data.
Products
AndroidUniversity of Technology in Austria show that the file-change notification features built into Linux, Android, Windows, and macOS can be abused to monitor other users on the same system, from the rhythm of theirEdgeAcross the top 1,000 websites, the researchers achieved 97.8% accuracy for Firefox and 48.5% for Edge, which creates folders for far fewer sites.KDE Plasma 6100 with an accuracy of 87.9%. The researchers also demonstrated a fake password prompt attack on the KDE Plasma 6 desktop running on Wayland. A malicious process running as the victim detects when the realLinuxat Graz University of Technology in Austria show that the file-change notification features built into Linux, Android, Windows, and macOS can be abused to monitor other users on the same system, from the rhythm ofmacOSin Austria show that the file-change notification features built into Linux, Android, Windows, and macOS can be abused to monitor other users on the same system, from the rhythm of their typing to the websitesMicrosoft Windowsof Technology in Austria show that the file-change notification features built into Linux, Android, Windows, and macOS can be abused to monitor other users on the same system, from the rhythm of their typing toMozilla FirefoxOther Linux attacks include website fingerprinting based on which system fonts Firefox loads for a page. This identified sites from the top 100 with an accuracy of 87.9%. The researchers also demonstrated a fakeWaylandThe researchers also demonstrated a fake password prompt attack on the KDE Plasma 6 desktop running on Wayland. A malicious process running as the victim detects when the real authentication dialog is about to appearWhatsAppIn tests against WhatsApp, the technique revealed when photos, videos, and documents were received or sent, along with their file names.