Researchers from the Graz University of Technology identified vulnerabilities in file operation notification mechanisms across Android, Linux, macOS, and Windows. These systems, including Linux inotify, Android FileObserver, Windows ReadDirectoryChangesW, and macOS FSEvents, expose metadata about file access, modification, or deletion without requiring read permissions.
The flaw allows unauthorized users to monitor file events, enabling side-channel attacks. By analyzing timing intervals between keystrokes, researchers achieved up to 100% accuracy in capturing input locally and via SSH. Additionally, the method allows identifying visited websites with 87.9% accuracy and performing interface spoofing attacks to steal credentials.
In Linux, monitoring the /dev/input directory allows tracking keystrokes. A partial fix for CVE-2025-68788 was released in December 2025 for several kernel versions, blocking event generation for special files in /dev/. Android's FileObserver bypasses FUSE isolation, letting apps track activity in restricted folders like WhatsApp without special permissions.
On Windows, monitoring the root directory C:\ reveals paths to files accessed by any user, regardless of permissions. Researchers demonstrated this by tracking Firefox browsing history with 97.8% accuracy. Microsoft stated this behavior is an undocumented architectural feature. Apple's macOS FSEvents allows tracking system changes, including DNS updates and Bluetooth device status.
