File Notification Features Exploited for Cross-User Surveillance
Researchers from Graz University of Technology in Austria have demonstrated that built-in file-change notification systems in Linux, Windows, macOS, and Android can be abused to monitor the activities of other users on the same system. These features, which allow applications to subscribe to alerts when files are created, modified, or deleted, are commonly used by text editors, file managers, sync clients, and antivirus software. Crucially, they require no elevated privileges — only read access to the monitored directory.
The attack does not expose file contents, but researchers found that file names and the timing of events are sufficient to infer sensitive user behavior. On Linux, Windows, and macOS, an adversary need only run code under a separate user account to begin surveillance. On Android, even an app requesting no permissions can exploit this mechanism.
Keystroke Timing and Website Fingerprinting Demonstrated
By monitoring device files representing keyboard input, attackers can detect when keys are pressed — though not which keys — enabling inference of typed text through inter-keystroke timing. In tests with seven typists, the method achieved between 93.1% and 100% accuracy in detecting keystrokes using a standard metric. Hidden inputs like sudo passwords remain undetected since they produce no on-screen text.
Additionally, researchers showed that website fingerprinting is possible by observing which system fonts Firefox loads for a given page. This technique identified sites from the top 100 with 87.9% accuracy. On KDE Plasma 6 running Wayland, a malicious process can detect when a legitimate authentication dialog is about to appear and overlay a fake prompt to steal credentials.
Android and Windows Reveal App-Specific and Cross-User Activity
On Android, tests conducted on Google Pixel and Samsung Galaxy devices confirmed that an app with no permissions can monitor another app’s private storage folder. In experiments with WhatsApp, this revealed when photos, videos, and documents were sent or received — including their file names — and when such media was later deleted.
The most severe finding on Windows occurs when a user monitors the root of the system drive. Windows then reports the full path of every file changed anywhere on the machine, including inside other users’ home directories — even if the monitoring account lacks permission to read those directories. Because Firefox stores site data in folders named after the domain, an unprivileged user can see in real time which websites another user is visiting. Across the top 1,000 sites, this achieved 97.8% accuracy for Firefox and 48.5% for Edge, which creates fewer site-specific folders.
macOS Less Vulnerable but Not Immune
On macOS, the attack surface is more limited because only globally readable files can be monitored. However, researchers were still able to track application launches, app interactions, and settings changes.
Limited Mitigations and No Widespread Patches
The Linux kernel has been partially hardened to prevent device files from generating access and modify events, addressing what researchers call the most severe issues. This fix is tracked as CVE-2025-68788. No patches are currently planned for Android or macOS.
Microsoft maintains that the Windows behavior is by design, arguing that it only reveals file names and paths in other users’ profiles — not file contents or sensitive data. A Microsoft spokesperson told SecurityWeek: “We thank the researcher for reporting this behavior. We investigated and determined that this is not a security vulnerability. The technique requires an attacker to already have the ability to run code locally on a device under a separate user account and does not provide access to file contents. Customers can help protect themselves by following security best practices, including limiting local access to trusted users, and keeping systems up to date.” Microsoft also referenced protections documented in April 2025 for certain file-path disclosure scenarios involving directory change notifications, which administrators can enable.
Apple and Google have not responded to requests for comment. The researchers state they are unaware of any real-world exploitation of these techniques. However, they have published proof-of-concept code for the attacks on GitHub.
Source: SecurityWeek