{"id":183466,"date":"2026-09-25T16:54:15","date_gmt":"2026-09-25T14:54:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/ataki-po-storonnim-kanalam-cherez-mehanizm-otslezhivaniya-izmenenij-v-fs"},"modified":"2026-09-25T16:54:21","modified_gmt":"2026-09-25T14:54:21","slug":"side-channel-attacks-via-the-file-system-change-tracking-mechanism","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/side-channel-attacks-via-the-file-system-change-tracking-mechanism","title":{"rendered":"R\u00fcnnakud kolmandate osapoolte kanalite kaudu failis\u00fcsteemi muudatuste j\u00e4lgimismehhanismi kaudu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Graz Tehnikainstituudi teadlased (Austria) avastasid mitmeid r\u00fcnnakumeetodeid, mis toimuvad kolmandate kanalite kaudu (PDF), kasutades failis\u00fcsteemi muudatuste j\u00e4lgimise mehhanisme. R\u00fcnnakud v\u00f5imaldavad j\u00e4lgida teiste kasutajate tegevust, anal\u00fc\u00fcsides failide ja kaustade juurde p\u00e4\u00e4semise s\u00fcndmusi, kasutades selliseid API-sid nagu inotify Linuxis, FileObserver Androidis, ReadDirectoryChangesW Windowsis ja File System Events macOS-is. Saadud teavet saab kasutada kasutaja klaviatuuriga sisestatud teabe taastamiseks, k\u00fclastatud veebilehtede m\u00e4\u00e4ramiseks v\u00f5i clickjacking-r\u00fcnnakute korraldamiseks, kus sisu kattub aktiivse aknaga enne kliki sooritamist. R\u00fcnnakumeetodid on avaldatud MIT litsentsi all.    <\/p>\n<p>Esimene r\u00fcnnakumeetod on demonstreeritud Linuxis, kus on v\u00f5imalik tuvastada juurdep\u00e4\u00e4s faile kaustas, mis ei ole otse loetavad ega j\u00e4lgitavad. Kasutades funktsiooni inotifywatch, saab kaudselt j\u00e4lgida failide muudatusi kausta sees, j\u00e4lgides kausta ennast.     <\/p>\n<p>Otseselt ei ole privileege mitteomaval kasutajal \u00f5igusi lugeda sisu ja j\u00e4lgida seadme tegevust \/dev\/input\/event4, mis peegeldab klaviatuurisisestuse s\u00fcndmusi. Siiski m\u00f5jutavad \/dev\/input\/event4 failiga toimuvad s\u00fcndmused vanema kausta olekut ja neid saab j\u00e4lgida kausta \/dev\/input metaandmete muutuste j\u00e4lgimise teel. Oleku muutumine \/dev\/input\/event4 toimub andmete sisestamisel ning s\u00fcndmuste viivitus, mis fikseeritakse inotify kaudu, korreleerub klaviatuuril klahvide vajutamise vaheliste viivitustega.     <\/p>\n<p>Kasutades statistilise anal\u00fc\u00fcsi meetodeid ja arvestades, et klaviatuuril tr\u00fckkides on viivitused klahvivajutuste vahel s\u00f5ltuvad klahvide asendist, on v\u00f5imalik teatud t\u00f5en\u00e4osusega taastada sisestatud teavet. N\u00e4iteks on reaktsioon t\u00e4hte &#171;F&#187; tr\u00fckkides kiirem kui t\u00e4hte &#171;Q&#187; v\u00f5i &#171;X&#187; tr\u00fckkides, kuna selle vajutamiseks on vajalik v\u00e4hem s\u00f5rme liikumisi; samuti toimub \u00fche klahvi uuesti vajutamine ja k\u00fclgnevate klahvide vajutamine kiiremini (&#171;s&#187; p\u00e4rast &#171;a&#187; vajutatakse m\u00e4rgatavalt kiiremini kui &#171;g&#187; p\u00e4rast &#171;s&#187;).    <center>  <video controls=\"\" style=\"width: 700px; height: 400px; max-width:100%\" loading=\"lazy\"><source src=\"https:\/\/inoti.fyi\/vid\/linux-local-iki.mp4\" type=\"video\/mp4\" loading=\"lazy\"><\/video>  <\/center>  <\/p>\n<p>Meetod on samuti rakendatav SSH-seansside sisenemise taastamiseks, kui kaks erinevat kasutajat on \u00fchendatud \u00fchte SSH-serverisse. Sellisel juhul saab \u00fcks kasutaja j\u00e4lgida teise kasutaja sisendi ajal toimuvaid s\u00fcndmusi, j\u00e4lgides seadme faili \/dev\/pts. Probleem lahendati 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.65 ja 6.18.3 tuumauuendustes, takistades juurdep\u00e4\u00e4su ja muutuse s\u00fcndmuste genereerimist vanemakataloogis, kui access v\u00f5i muudeti erifailide sisu.              <center>  <video controls=\"\" style=\"width: 700px; height: 400px; max-width:100%\" loading=\"lazy\" preload=\"none\"><source src=\"https:\/\/inoti.fyi\/vid\/linux-remote-iki.mp4\" type=\"video\/mp4\" loading=\"lazy\"><\/video>  <\/center>      <\/p>\n<p>Teine r\u00fcnnaku meetod v\u00f5imaldab m\u00e4\u00e4rata hetke, mil Polkit alams\u00fcsteem k\u00fcsib autentimisparameetrite dialooge, j\u00e4lgides p\u00e4ringut t\u00e4itva faili \/usr\/bin\/pkexec. Sel hetkel saab r\u00fcndaja luua valeaken, mis on kujundatud parooli sisestamise dialooge sarnaseks, ja kuvada selle p\u00e4ris parooli n\u00f5udmise kohal. Ahnuslik kasutaja, kes ei m\u00e4rka, et vahetus on aset leidnud, v\u00f5ib sisestada kinnitamise parooli r\u00fcndaja aknas. Sarnase r\u00fcnnaku teostamise v\u00f5imalust on demonstreeritud KDE Plasma t\u00f6\u00f6laua keskkonnas.      <center>  <video controls=\"\" style=\"width: 700px; height: 400px; max-width:100%\" loading=\"lazy\" preload=\"none\"><source src=\"https:\/\/inoti.fyi\/vid\/linux-auth-ui.mp4\" type=\"video\/mp4\" loading=\"lazy\"><\/video>  <\/center>  <\/p>\n<p>Androidi platvormi pakutavat API-d FileObserver saab kasutada teiste rakenduste privaatsetes kataloogides failitegevuse j\u00e4lgimiseks. N\u00e4iteks anal\u00fc\u00fcsides tegevust kataloogis \/sdcard\/Android\/media\/com.whatsapp\/WhatsApp, saab j\u00e4lgida faile, videoid v\u00f5i pilte, mis on kustutatud, saadetud ja saadud WhatsAppis, samuti teada saama saadetud v\u00f5i saadud failide nimesid.    <center><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/09\/ebf8b5a70063a90e9067532381814c77.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/center>    <\/p>\n<p>Windowsis selgus, et juurkatalooge (C:&#092;) s\u00fcndmuste j\u00e4lgimise aktiveerimine edastab teavet, sealhulgas t\u00e4ieliku failitee, k\u00f5igi failis\u00fcsteemis toimuva tegevuse kohta, s\u00f5ltumata failide p\u00e4\u00e4seloast. Uurijad on demonstreerinud, et seda omadust saab kasutada reaalajas j\u00e4lgimiseks, milliseid saite kasutajad Firefoxis k\u00fclastavad (Iga saidi jaoks luuakse Firefoxis IndexedDB ja v\u00f5rgu vahem\u00e4lu jaoks eraldi kataloog, mille nimi on sait, millele p\u00e4\u00e4semist saab j\u00e4lgida). Microsofti reageerimist sellele turvan\u00f5rkusele on esitatud Pwnies Award 2026 auhinnale kui k\u00f5ige ebamugavam reageering tootjalt (Lamest Vendor Response), kuna ettev\u00f5tte esindajad v\u00e4itsid alguses, et tegemist ei ole haavatavusega, vaid dokumenteerimata v\u00f5imalusega.        <center>  <video controls=\"\" style=\"width: 700px; height: 400px; max-width:100%\" loading=\"lazy\" preload=\"none\"><source src=\"https:\/\/inoti.fyi\/vid\/windows-website.mp4\" type=\"video\/mp4\" loading=\"lazy\"><\/video>  <\/center><br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=66340\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f) \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0441\u0435\u0440\u0438\u044e \u0430\u0442\u0430\u043a \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c (PDF), \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0410\u0442\u0430\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u043e\u0431 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430\u043c \u0447\u0435\u0440\u0435\u0437 \u0442\u0430\u043a\u0438\u0435 API, \u043a\u0430\u043a inotify \u0432 Linux, FileObserver \u0432 Android, ReadDirectoryChangesW \u0432 Windows \u0438 File System Events \u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":183468,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183466","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f) \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0441\u0435\u0440\u0438\u044e \u0430\u0442\u0430\u043a \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c (PDF), \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/side-channel-attacks-via-the-file-system-change-tracking-mechanism\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0410\u0442\u0430\u043a\u0438 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u0447\u0435\u0440\u0435\u0437 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0424\u0421 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f) \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0441\u0435\u0440\u0438\u044e \u0430\u0442\u0430\u043a \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c (PDF), \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/side-channel-attacks-via-the-file-system-change-tracking-mechanism\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-09-25T14:54:15+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-25T14:54:21+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47K\u00fcljekanali r\u00fcnnakud failis\u00fcsteemi muutuste j\u00e4lgimise mehhanismi l\u00e4bi | ProHoster","description":"Graz Tehnika \u00dclikooli teadlased tuvastasid rida r\u00fcnnakuid k\u00f5rvalkanalite kaudu (PDF), mis toimuvad failis\u00fcsteemi muutuste j\u00e4lgimise mehhanismide kaudu.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/side-channel-attacks-via-the-file-system-change-tracking-mechanism","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0438 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u0447\u0435\u0440\u0435\u0437 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0424\u0421 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f) \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0441\u0435\u0440\u0438\u044e \u0430\u0442\u0430\u043a \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c (PDF), \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/side-channel-attacks-via-the-file-system-change-tracking-mechanism","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-09-25T14:54:15+00:00","article:modified_time":"2026-09-25T14:54:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/183466","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=183466"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/183466\/revisions"}],"predecessor-version":[{"id":183467,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/183466\/revisions\/183467"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/183468"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=183466"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=183466"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=183466"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}