Pull to refresh
Logo
Daily Brief
Following Why Sign Up
File-notification side-channel attacks exposed across Windows, Linux, Android and macOS

File-notification side-channel attacks exposed across Windows, Linux, Android and macOS

New Capabilities

TU Graz researchers show unprivileged processes can recover keystrokes, browsing and file activity; Linux patched, Microsoft calls the behavior by design

Yesterday: TU Graz publishes the File Notification Attacks paper

Overview

Updated 1 hour ago

A process running without special permissions can track what you type, which websites you visit, and when you open or delete files. It can even overlay a fake password prompt on a legitimate one. The technique doesn't exploit a bug in file handling—it abuses the file-notification systems that Windows, Linux, Android and macOS have shipped for two decades.

Researchers at Graz University of Technology demonstrated the attacks across all four platforms with timing resolution under 12 milliseconds. Linux has shipped a partial fix tracked as CVE-2025-68788. Microsoft says the Windows behavior is by design and will not patch it. Apple and Google have not issued fixes.

Why it matters

An unprivileged process can recover your keystrokes, browsing and file activity through notifications the operating system generates itself.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

4
Operating systems exposed
Linux inotify, Windows ReadDirectoryChangesW, macOS FSEvents, Android FileObserver.
100%
Linux inter-keystroke timing accuracy (F1)
Perfect detection of keystroke timing, local and remote over SSH, across 7 users.
97.8%
Windows website fingerprinting accuracy (F1)
Reliably identifies sites visited from the top 1000 websites by an unprivileged user.
0.2–11.5 ms
Attack temporal resolution
How tightly the side channel can resolve the timing of file operations.
6
Linux kernel branches partially patched
CVE-2025-68788 mitigated in stable branches 5.10.248 through 6.18.3.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

Greg Kroah-Hartman
Greg Kroah-Hartman
Linux kernel maintainer, stable release coordinator
Coordinated the partial mitigation of CVE-2025-68788

Organizations Involved

Graz University of Technology, Institute of Information Security
Graz University of Technology, Institute of Information Security
University research institute
Disclosed the file-notification attacks and published the research paper

Security research group that discovered and documented the file-notification side-channel attacks across four operating systems.
Microsoft
Microsoft
Software company
Declined to fix the Windows file-notification disclosure, calling it by design

Vendor of Windows, whose ReadDirectoryChangesW API leaks file paths and operation timing to unprivileged users.
LI
Linux kernel security team
Open-source security response group
Shipped partial mitigation in stable kernels, assigned CVE-2025-68788

Maintainers who coordinated the first fix for the file-notification leak on Linux.
KDE
KDE
Open-source software community
Demonstrated target of a password-prompt forgery attack

Developer community behind the KDE Plasma desktop, vulnerable to a UI redress attack even under Wayland.

Timeline

January 2000 September 2026

7 events Latest: Yesterday
Tap a bar to jump to that date

  1. TU Graz publishes the File Notification Attacks paper

    Latest Disclosure

    Full paper and attack details released publicly, with Microsoft confirming its by-design stance.

  2. The Register reports on the findings

    Media

    Early coverage details the decades-old flaws and the disclosure to vendors.

  3. Linux kernel partially mitigates the leak

    Security Fix

    CVE-2025-68788 assigned; character device files stop generating access and modify events.

  4. Android adds FileObserver API

    Technology

    Android exposes file-notification events to apps.

  5. macOS introduces FSEvents

    Technology

    Apple ships the FSEvents file-system event API.

  6. Linux kernel adds inotify

    Technology

    The inotify file-monitoring subsystem becomes part of the kernel.

  7. Windows ships ReadDirectoryChangesW

    Technology

    File-notification API added to Windows 2000.

Scenarios

1

Linux closes the remaining file-notification leaks

Likely Resolves by Q1 2027

Discussed by: TU Graz researchers and the Linux kernel security team, which acknowledged partial mitigation only

After the December 2025 patch stopped events on /dev character devices, the kernel team continues hardening other file types that leak user activity, including /usr file monitoring used for website fingerprinting. New kernel CVE assignments or stable-branch patches would mark this scenario resolved.

2

Windows and macOS keep current behavior, documented as by design

Likely Resolves by Q1 2027

Discussed by: Microsoft, which has already told researchers the behavior is not a vulnerability; Apple has not responded publicly

Microsoft maintains that file names and paths in another user's directory are not sensitive and that any fix would break legitimate file-monitoring applications. Apple ships no mitigation for FSEvents. The disclosure becomes a documented risk accepted by both vendors, and no security updates address it.

3

Android adds a notification permission gate

Possible Resolves by Q2 2027

Discussed by: Security researchers noting the Android FUSE workaround, which let a permissionless app spy on WhatsApp activity

Google tightens the FileObserver API or the FUSE mount so apps cannot observe activity in another app's sandbox without explicit user consent. The Android case is the only one where the disclosure maps directly to an app-permission model, giving Google a clear path to a fix.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

March 2015

Rowhammer (2015)

Researchers at Google Project Zero and academic labs showed that repeatedly accessing DRAM rows could flip bits in adjacent rows, corrupting data across memory-isolation boundaries. The attack required no kernel exploit and worked on commodity hardware.

Then

Chipmakers added hardware mitigations and operating systems adopted software defenses like memory deduplication changes.

Now

Rowhammer became a decades-long research thread, with ongoing variants and a partial mitigation posture accepted by the industry.

Why this matters now

Rowhammer, like file-notification leakage, attacks a trusted hardware or OS subsystem rather than an application bug. The response pattern—partial fixes, residual risk, and continued research—closely tracks what is unfolding here.

January 2018

Spectre and Meltdown (2018)

Researchers at Google Project Zero and TU Graz—the same university behind this disclosure—found that speculative execution on Intel, AMD and ARM chips could leak memory contents across security boundaries. Meltdown was co-discovered by the Graz group led by Daniel Gruss.

Then

Vendors shipped kernel page-table isolation and microcode updates within weeks, often at a measurable performance cost.

Now

Years of follow-on hardware flaws emerged, and some residual speculative-execution risk was accepted as unavoidable.

Why this matters now

Like the file-notification attacks, Spectre and Meltdown were cross-platform side channels disclosed through vendor coordination, with partial mitigations and some vendors declining to treat the behavior as a vulnerability.

Sources

(9)
+3
Inoti.fyi project site EurekAlert! TU Graz news SecurityWeek The Register LWN.net ZeroHour Privacy Guides CCS 2026 paper