Graz University of Technology reveals file notification leaks in Windows, Linux, Android

Source published 2h 26m agoTerminal published 2h 23m ago

Summary

Researchers at Graz University of Technology in Austria have revealed that file-change notification features in operating systems such as Windows, Linux, Android, and macOS can be exploited to monitor user activities, including keystrokes and web browsing. While the attacks do not expose actual file contents, the identification of file names and event timing allows for significant user activity reconstruction. Most attacks require the attacker to already have code running on the affected machine, but techniques demonstrated include monitoring folders to track file access or employing counterfeit prompts to capture credentials. Although the Linux kernel has received a partial fix (CVE-2025-68788), no patches have been released for Android or macOS, and Microsoft characterizes the Windows behavior as intentional and not a vulnerability. Proof-of-concept code for these attacks is publicly available on GitHub, but the researchers are not aware of any real-world exploitation.

Analysis

Apple: Apple develops the macOS operating system. The company has not responded to inquiries regarding the file notification leaks identified in the research. Linux: Linux is an open-source operating system kernel used in servers, desktops, and embedded devices. Its file notification mechanisms allow monitoring of device files and directories, enabling keystroke timing inference and other activity tracking by unprivileged processes. A partial kernel hardening addresses some issues via CVE-2025-68788. macOS: macOS is Apple's desktop operating system. Its file notification system leaks the least among tested platforms because it restricts monitoring to globally readable files, yet still allows tracking of application launches and interactions. Apple has not responded to requests for comment on the findings. Google: Google develops the Android operating system. The company has not responded to requests for comment on the demonstrated attacks allowing permissionless monitoring of other apps' storage. Android: Android is Google's mobile operating system based on Linux. The study found that apps with no permissions can observe file changes in other apps' private storage folders on devices like Google Pixel and Samsung Galaxy phones. This reveals details such as media sharing and deletion in apps like WhatsApp. Windows: Windows is a widely used operating system developed by Microsoft for personal computers and servers. The research shows that its file-change notification features can leak full paths of modified files across user accounts when monitoring the system drive root. Microsoft responded that the observed behavior is by design and not a security vulnerability. Microsoft: Microsoft develops the Windows operating system and related software. In response to the reported vulnerabilities, the company stated that the behavior requires local code execution under a separate account and provides no access to file contents. It pointed to existing administrator-configurable protections for certain file-path scenarios. Graz University of Technology: Graz University of Technology is an Austrian research institution focused on technical and scientific fields including computer security. Researchers from the university identified vulnerabilities in file notification systems across multiple operating systems that allow unprivileged monitoring of user activity. Their work demonstrates practical attacks on Linux, Windows, macOS, and Android without requiring elevated privileges. Research Impact: Proof-of-concept code for the file notification attacks has been published on GitHub, with no known in-the-wild exploitation reported by the researchers. Vendor Responses: Microsoft assessed the Windows behavior as by design and not a vulnerability, while Apple and Google have not commented on the reported issues. Platform Mitigations: The Linux kernel received a partial fix tracked as CVE-2025-68788, with no patches issued for Android or macOS.

Summary

Analysis

Categories