Windows, Linux, Android File Notification Systems Leak User Activity

The file-notification system on Linux, Android, Windows, and macOS allows applications to be informed when files change, such as being opened, closed, written to, or deleted. With read-only access to a file or directory, an attacker can monitor these notifications and reconstruct user behavior.

Three platform-specific issues were identified as severe and unique to each operating system:

1. On Linux, an attacker can watch a readable directory and receive notifications for every event on a file inside it, even if the attacker cannot read the file directly. This is particularly concerning for the /dev/input directory, which is discussed in the context of inter-keystroke timing attacks.

2. On Android, the FileObserver system allows an unprivileged app to bypass the FUSE layer's per-app storage view and monitor another app's private folder. This enables an attacker to observe the arrival or deletion of files within the private folder, as demonstrated using the WhatsApp app.

3. On Windows, an attacker can monitor the root directory (C:) and receive notifications for every file touched anywhere on the system, regardless of permissions or user ownership. This can potentially leak the websites visited by another user in real-time, as shown in the research.

Additionally, the research highlights other interesting case studies on Linux and Windows platforms, demonstrating how file notification leakage can occur and potentially reveal sensitive user, system, and application behavior.