[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [QUIET] · [TECHNOLOGY]

2 clusters · 15 sources · 4 days · First seen · Last updated

Operating system file notification security vulnerabilities

Overview

Security researchers at the Institute of Information Security at TU Graz have identified significant vulnerabilities within the file notification subsystems of Android, Linux, macOS, and Windows. These flaws, rooted in long-standing implementations, allow unprivileged users or malicious applications to monitor file-related events—such as when a file is opened, modified, or deleted—without requiring direct read access to the files themselves.

By utilizing these systems as a side channel, attackers can track filenames and the timing of file events to infer sensitive user activities. Specific demonstrations include using timing analysis of keystrokes to infer text on Linux, monitoring browser history through folder creation patterns on Windows, and observing activity within private app folders on Android via the FUSE layer. Researchers also noted the potential for UI redress attacks, such as creating fake password prompts in the KDE Plasma environment to intercept credentials.

While macOS was found to be the least susceptible, researchers noted that user behavior could still be tracked. The research team has informed the affected companies, and patches are already being developed for Linux.

Entities

Graz University of Technology · TU Graz · Institute of Information Security · Android · Windows

Timeline

  1. [TECHNOLOGY] 11 sources
    TU Graz researchers find security flaws in major operating systems

    TU Graz researchers discovered that file notification systems in Windows, Linux, Android, and macOS can be exploited to track user activity, browsing history, and keystrokes via side-channel attacks.

  2. [TECHNOLOGY] 4 sources
    Security flaws found in Android, Linux, macOS, and Windows file systems

    Researchers have discovered decades-old security flaws in the file notification systems of Android, Linux, macOS, and Windows that allow attackers to monitor user activity via side-channel leaks.

Sources

5min.at · all-about-security.de · colegionuestrasenoradelaaltagracia.edu.do · dev.to · dijitaliyidir.com · epochtimes.pl · it-daily.net · ithome.com · nczas.info · oesterreich.orf.at · presseradar.de · security.nl · theregister.co.uk · upday.com · windows-faq.de

This summary has been updated 1 time: see revision history