Researchers from the Graz University of Technology in Austria have uncovered vulnerabilities in the file-change notification features across major operating systems such as Linux, Windows, Android, and macOS. These weaknesses could potentially allow for the monitoring of user activities, including keystroke patterns and website visits.
Understanding the File Notification Systems
Many operating systems, including Linux, Windows, macOS, and Android, offer applications the ability to be notified when files are modified, deleted, or created. This feature is widely utilized by applications like text editors, file managers, and antivirus software. It generally requires only read access to the directory, eliminating the need for special permissions.
While these attacks do not expose the actual content of files, researchers demonstrated that monitoring file names and event timings suffices to deduce user and system activities. Most scenarios require that an attacker can execute code on the same device under a different account. On Android, even apps without explicit permissions can exploit these notifications.
Specific Vulnerabilities Across Platforms
On Linux, even without permission to monitor a specific file, a user can track changes by observing the encompassing directory, provided it is accessible. This method can reveal when keys are pressed, although not the specific keys. Historical research indicates that keystroke intervals can suggest what is being typed, with accuracy reaching up to 100% in trials.
Further attacks on Linux include website fingerprinting by examining system fonts loaded by Firefox, achieving an 87.9% accuracy rate for top sites. Additionally, a simulated password prompt attack was conducted on the KDE Plasma desktop, exploiting the system’s authentication procedures.
Impact on Android and Windows Platforms
During their Android tests on Google Pixel and Samsung Galaxy devices, researchers found apps could monitor another app’s storage modifications without permissions. This method uncovered activities such as file transfers and deletions within WhatsApp.
In Windows, the primary concern is the ability to oversee changes at the system drive’s root, exposing file paths from all users’ directories. This flaw enables real-time tracking of website visits, with a 97.8% accuracy rate for Firefox and 48.5% for Edge.
Current Mitigations and Future Outlook
While partial mitigations have been implemented in the Linux kernel to address critical vulnerabilities, similar fixes for Android and macOS remain unreported. Microsoft contends that the behavior in question does not constitute a security flaw, as it requires pre-existing local code execution capabilities.
Microsoft advises users to follow security best practices, including restricting local access to trusted individuals and maintaining updated systems. The researchers have shared proof-of-concept code online and note no known real-world exploitation of these vulnerabilities.
