File Notification Attacks: Side-Channel Leakage from the File-Notification System on Linux, Android, Windows, and macOS
CCS paper shows Linux, Android, Windows, and macOS file notifications leak activity without revealing file contents.
A CCS 2026 paper shows file-notification APIs on Linux, Android, Windows, and macOS leak user and application behavior to a watcher that cannot read file contents. On Linux, an inotify watch on a readable parent such as /dev/input reports keypress timing and can trigger a fake polkit password dialog on KDE Plasma. Android's FileObserver bypasses per-app storage isolation against WhatsApp, while Windows ReadDirectoryChangesW on C:\ discloses full paths, including websites visited by other users. Microsoft treated the Windows behavior as an undocumented feature.
- Linux inotify on a readable directory reports events for unreadable files, including keystroke timing via /dev/input.
- Android FileObserver can watch another app's private folder, revealing WhatsApp media arrivals and deletions.
- Windows watches on C:\ report full paths system-wide, leaking another user's visited websites in real time.
- Watching pkexec lets a same-user process overlay a fake KDE Plasma password dialog.
- Organizations
- KDE
From the original article
9 min read at inoti.fyiSide-Channel Leakage from the File-Notification System on Linux, Android, Windows, and macOS. Accepted at The ACM Conference on Computer and Communications Security (CCS) , November 15-19, 2026 — The Hague, Netherlands File-notification systems tell applications when files change, e. g.
By inoti.fyi by sneela · inoti.fyi
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.