{
  "id": 9683823,
  "title": "File Notification Attacks: Side-Channel Leakage from the File-Notification System on Linux, Android, Windows, and macOS",
  "url": "https://urgent.news/2026/09/25/file-notification-attacks-side-channel-leakage-from-the-file",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-25T02:50:41.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://inoti.fyi/"
  },
  "original_language": "en",
  "account": "The file-notification system on Linux, Android, Windows, and macOS allows applications to be informed when files change, such as being opened, closed, written to, or deleted. With read-only access to a file or directory, an attacker can monitor these notifications and reconstruct user behavior.\n\nThree platform-specific issues were identified as severe and unique to each operating system:\n\n1. On Linux, an attacker can watch a readable directory and receive notifications for every event on a file inside it, even if the attacker cannot read the file directly. This is particularly concerning for the /dev/input directory, which is discussed in the context of inter-keystroke timing attacks.\n\n2. On Android, the FileObserver system allows an unprivileged app to bypass the FUSE layer's per-app storage view and monitor another app's private folder. This enables an attacker to observe the arrival or deletion of files within the private folder, as demonstrated using the WhatsApp app.\n\n3. On Windows, an attacker can monitor the root directory (C:) and receive notifications for every file touched anywhere on the system, regardless of permissions or user ownership. This can potentially leak the websites visited by another user in real-time, as shown in the research.\n\nAdditionally, the research highlights other interesting case studies on Linux and Windows platforms, demonstrating how file notification leakage can occur and potentially reveal sensitive user, system, and application behavior.",
  "summary": null,
  "key_points": [
    "Linux attackers can monitor readable directories for file events.",
    "Android apps can bypass FUSE layer to observe private folders.",
    "Windows root directory monitoring reveals real-time website visits."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}