File Notification Attacks: Side-Channel Leakage from the File-Notification System on Linux, Android, Windows, and macOS
CCS paper shows Linux, Android, Windows, and macOS file notifications leak activity without revealing file contents.
A CCS 2026 paper shows file-notification APIs on Linux, Android, Windows, and macOS leak user and application behavior to a watcher that cannot read file contents. On Linux, an inotify watch on a readable parent such as /dev/input reports keypress timing and can trigger a fake polkit password dialog on KDE Plasma. Android's FileObserver bypasses per-app storage isolation against WhatsApp, while Windows ReadDirectoryChangesW on C:\ discloses full paths, including websites visited by other users. Microsoft treated the Windows behavior as an undocumented feature.
63