Researchers from Graz University of Technology (Austria) have identified a series of attacks via side channels (PDF) executed through file system change tracking mechanisms. These attacks allow monitoring the activity of other users based on the analysis of events related to file and directory access through APIs such as inotify in Linux, FileObserver in Android, ReadDirectoryChangesW in Windows, and File System Events in macOS. The obtained information can be used to reconstruct data entered by users via the keyboard, determine accessed websites, or organize clickjacking attacks that overlay content on an active window at the moment before a click. The code implementing the attack methods is published under the MIT license.
The first attack method demonstrated in Linux exploits the ability to determine access to files within a directory that are not directly readable or trackable. Using the inotifywatch function, it is possible to indirectly monitor file changes within a directory through monitoring the directory itself.
A non-privileged user has no permission to read the contents and monitor the activity of the device /dev/input/event4, which reflects keyboard input events. However, events occurring with the file /dev/input/event4 affect the state of its parent directory and can be tracked through monitoring directory metadata changes at /dev/input. The state of /dev/input/event4 changes upon data entry, and the delays between events recorded via inotify correlate with the delays between key presses on the keyboard.
By utilizing statistical analysis methods and taking into account that typing delays between key presses depend on key positioning on the keyboard, it is possible to reconstruct the entered information with a certain degree of probability. For example, the reaction time when typing the letter 'F' is faster than when typing 'Q' or 'X', as less finger movement is required for pressing it. Additionally, re-pressing the same key is done more quickly, and pressing adjacent keys ('s' after 'a') is significantly faster than pressing 'g' after 's'.
The method is also applicable for recreating input in SSH sessions when connecting two different users to the same SSH server. In this case, one of the users can monitor events occurring due to the other user’s input by monitoring the device file /dev/pts. The issue was resolved in the January updates for kernels 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.65, and 6.18.3 by blocking the generation of ACCESS and MODIFY events for the parent directory when accessing or modifying special files within it.
The second attack method allows determining the moment the Polkit subsystem prompts for authentication parameters by tracking access to the executable file /usr/bin/pkexec. At this moment, an attacker can create a fake window styled like the password input dialog and display it over the real password prompt. A user unaware of the substitution may enter the operation confirmation password in the attacker's window. The possibility of conducting such an attack has been demonstrated in distributions using the KDE Plasma desktop environment.
The Android API FileObserver provided by the platform can be used to monitor file activity in other applications’ private directories. For example, by analyzing activity in the directory /sdcard/Android/media/com.whatsapp/WhatsApp, one can track events of file deletion, sending, and receiving of files, videos, or images in WhatsApp, as well as identify the names of sent or received files.
In Windows, it was found that enabling event tracking for the root directory (C:\) transmits information, including the full file path, about any events with all files in the file system, regardless of file access rights. Researchers have demonstrated the possibility of using this feature to monitor in real-time which websites users are opening in Firefox (a separate directory named after each site is created for IndexedDB and cache in Firefox, which can be tracked). Microsoft’s reaction to this security issue has been nominated for the Pwnies Award 2026 in the category of the lamest vendor response, as company representatives initially claimed that this was not a vulnerability, but an undocumented feature.
Source: opennet.ru
