{"id":183466,"date":"2026-09-25T16:54:15","date_gmt":"2026-09-25T14:54:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/ataki-po-storonnim-kanalam-cherez-mehanizm-otslezhivaniya-izmenenij-v-fs"},"modified":"2026-09-25T16:54:21","modified_gmt":"2026-09-25T14:54:21","slug":"side-channel-attacks-via-the-file-system-change-tracking-mechanism","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/side-channel-attacks-via-the-file-system-change-tracking-mechanism","title":{"rendered":"Attacks through external channels via the file system change tracking mechanism","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Researchers from Graz University of Technology (Austria) have identified a series of attacks via side channels (PDF) executed through file system change tracking mechanisms. These attacks allow monitoring the activity of other users based on the analysis of events related to file and directory access through APIs such as inotify in Linux, FileObserver in Android, ReadDirectoryChangesW in Windows, and File System Events in macOS. The obtained information can be used to reconstruct data entered by users via the keyboard, determine accessed websites, or organize clickjacking attacks that overlay content on an active window at the moment before a click. The code implementing the attack methods is published under the MIT license. <\/p>\n
The first attack method demonstrated in Linux exploits the ability to determine access to files within a directory that are not directly readable or trackable. Using the inotifywatch function, it is possible to indirectly monitor file changes within a directory through monitoring the directory itself. <\/p>\n
A non-privileged user has no permission to read the contents and monitor the activity of the device \/dev\/input\/event4, which reflects keyboard input events. However, events occurring with the file \/dev\/input\/event4 affect the state of its parent directory and can be tracked through monitoring directory metadata changes at \/dev\/input. The state of \/dev\/input\/event4 changes upon data entry, and the delays between events recorded via inotify correlate with the delays between key presses on the keyboard. <\/p>\n
Using statistical analysis methods and considering that the delays between keystrokes depend on the layout of keys on the keyboard, it is possible to recreate the input information with a certain probability. For example, the reaction when typing the letter 'F' is faster than when typing 'Q' or 'X', as fewer finger movements are required for pressing it. Additionally, repeated pressing of the same key occurs more quickly, as well as pressing adjacent keys ('s' after 'a' is pressed significantly faster than 'g' after 's').