File Notification Systems Leak User Activity Across Major Operating Systems

Researchers at Graz University of Technology in Austria have demonstrated that file-change notification systems in Windows, Linux, Android, and macOS can be exploited to monitor user activity. These built-in features, which allow applications to receive alerts when files are created, modified, or deleted, can be abused to reconstruct sensitive information such as keystroke timing and browsing habits.

The notification systems typically require no elevated privileges, requiring only read access to the location being monitored. While the attacks do not expose the actual contents of files, the researchers found that file names and the timing of events are sufficient to infer significant user behaviour.

Impact Across Operating Systems

On Linux, the research highlighted several methods of surveillance. By monitoring device files that represent keyboard input, attackers can detect the timing of keystrokes. In tests involving seven typists, this method achieved an accuracy rate between 93.1% and 100% for detecting keystrokes. Additionally, researchers demonstrated website fingerprinting with 87.9% accuracy by observing which system fonts Firefox loads for specific web pages. The study also included a counterfeit authentication prompt attack on the KDE Plasma 6 desktop environment running on Wayland.

Android devices were also found to be susceptible. An application with no requested permissions can monitor the private storage folders of other apps. When tested against WhatsApp, this technique allowed researchers to identify when photos, videos, or documents were sent or received, as well as the names of those files and when they were subsequently deleted.

The Windows environment presented a distinct risk when a user monitors the root of the system drive. In such cases, Windows reports the full path of every changed file across the entire machine, including files within other users’ home directories. Using this method, researchers achieved 97.8% accuracy in identifying websites visited via Firefox, though accuracy was lower for Microsoft Edge at 48.5% due to its differing folder structure.

macOS appeared to be the most resilient, as monitoring is limited to globally readable files. However, researchers were still able to track application launches and changes to system settings.

Vendor Responses and Mitigations

The Linux kernel has already undergone partial hardening to prevent device files from generating access and modify events. This specific fix is associated with CVE-2025-68788.

Microsoft has stated that the observed Windows behaviour is by design. A company spokesperson noted that the process only reveals file names and paths within other user profiles rather than sensitive file contents. Microsoft advised customers to follow security best practices, such as limiting local access to trusted users.

The researchers noted that they are not currently aware of any instances where these techniques have been exploited in the wild. Proof-of-concept code for the file notification attack has been made available on GitHub.