TU Graz researchers find security flaws in major operating systems

Researchers at the Institute of Information Security at TU Graz have identified significant security vulnerabilities in the file notification systems of Windows, Linux, Android, and macOS. These systems, designed to alert applications to file changes like creation or modification, can be exploited through side-channel attacks to monitor user activity without administrator privileges.

While the actual contents of protected files remain inaccessible, the researchers demonstrated that observing file names and timestamps allows for extensive data collection. On Windows, attackers can bypass folder restrictions by monitoring parent directories, enabling them to track web browsing history via browser-generated folders. On Linux, researchers successfully monitored keystroke timing and even created fake password prompts in the KDE Plasma environment to intercept credentials.

On Android, the vulnerabilities allow apps to spy on activity within other app directories, such as monitoring when media is added to WhatsApp. macOS was found to be the least susceptible, though user behavior could still be tracked. The research team has informed the affected companies, and patches are already being developed for Linux.