**Hacker Pranks: Decades-Old File Security Flaws Exposed in Android, Linux, macOS, and Windows**
**A Potential Security Nightmare Unfolds: Researchers Uncover Flaws in File Notification Systems**
In a disturbing revelation, security researchers from Austria's Graz University of Technology have discovered decades-old file security flaws in Android, Linux, macOS, and Windows. These vulnerabilities, rooted in the file-notification subsystems, can leak sensitive system information, potentially compromising user data. The affected systems include inotify on Linux since 2005, FileObserver on Android since 2008, ReadDirectoryChangesW on Windows since 2000, and FSEvents on macOS since 2007. These file notification subsystems inform applications about file changes, but the researchers found that the data can be used to infer user activities, conduct inter-keystroke-timing attacks, and even steal credentials.
**Unprivileged Users Can Access File Notification Subsystems**
The researchers, led by Sudheendra Raghav Neela, a doctoral student at TU Graz, discovered that unprivileged users can access the file notification subsystem, which allows them to monitor file changes even without read access. On Linux and Windows, file information is available without read access, making it easier for attackers to exploit these vulnerabilities. The attack scenarios involve a local attacker with access to an account that can read files shared by multiple users.
**Local and Remote Attack Scenarios**
Neela and his team demonstrated various attack scenarios, including:
* **Inter-keystroke-timing attacks**: The researchers showed that monitoring file events can reveal user input, both locally and remotely over SSH. They achieved a keystroke accuracy score of 93.1-100% across seven users and 100% remotely. * **Website fingerprinting attacks**: The team conducted website fingerprinting attacks on the top 100 sites, achieving a success rate of 87.9%. * **UI redress attacks**: They also demonstrated UI redress attacks, which allow attackers to steal credentials.
**Partial Fixes and Continued Vulnerabilities**
Although partial fixes were implemented in December 2025 for Linux kernels 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 6.18.3, the researchers note that further mitigations are needed to address these vulnerabilities. No mitigation has been implemented for Android devices, and Apple's macOS provided the least information due to the lack of bypasses for reading private directories.
**Recommendations for Mitigation**
The researchers propose several measures to mitigate these vulnerabilities:
* **Capability checks**: Extend capability checks to monitoring one's own files and any readable file. * **Disallow monitoring of entire drives**: On Windows, disallow monitoring of entire drives to prevent unauthorized access. * **Permission system**: Introduce a permission system on Windows and macOS to control access to file notification subsystems.
The research paper, titled "File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS," is scheduled to appear at ACM CCS 2026 in November. The discovery of these decades-old file security flaws highlights the need for continued vigilance and mitigation efforts to protect user data.
The researchers' findings underscore the importance of regularly reviewing and updating security protocols to prevent potential breaches. As technology continues to evolve, it is essential to stay ahead of emerging threats and vulnerabilities. The researchers' work serves as a reminder that even seemingly innocuous features can have significant security implications.
**Stay Informed, Stay Safe**
By staying informed about the latest security research and developments, you can better protect yourself and your organization from potential threats. Hacker Pranks will continue to provide you with the latest news, insights, and expert analysis on cybersecurity and related topics.