Security flaws found in Android, Linux, macOS, and Windows file systems

Security researchers at Graz University of Technology have identified long-standing vulnerabilities in the file notification subsystems of Android, Linux, macOS, and Windows. These flaws allow unprivileged users or malicious applications to monitor file-related events, such as when a file is opened, changed, or deleted, without needing direct read access to the files themselves.

By observing these file events, attackers can utilize the information as a side channel to infer sensitive user activities. Potential exploits include inter-keystroke-timing attacks to reveal user input, website fingerprinting to track browsing history, and UI redress attacks for credential theft. The vulnerabilities affect core components including inotify on Linux, FileObserver on Android, ReadDirectoryChangesW on Windows, and FSEvents on macOS.

While the research indicates that active exploitation in the wild has not been confirmed, the researchers demonstrated that unprivileged local processes can estimate activities such as WhatsApp media interactions and browsing destinations with high precision. The flaws are described as being rooted in decades-old implementations within modern operating systems.