{"id":183466,"date":"2026-09-25T16:54:15","date_gmt":"2026-09-25T14:54:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/ataki-po-storonnim-kanalam-cherez-mehanizm-otslezhivaniya-izmenenij-v-fs"},"modified":"2026-09-25T16:54:21","modified_gmt":"2026-09-25T14:54:21","slug":"side-channel-attacks-via-the-file-system-change-tracking-mechanism","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/side-channel-attacks-via-the-file-system-change-tracking-mechanism","title":{"rendered":"Napadi prek stranskih kanalov preko mehanizma sledenja spremembam v FS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Raziskovalci z Tehni\u010dne univerze na Dunaju (Avstrija) so odkrili vrsto napadov preko zunanjih kanalov (PDF), ki se izvajajo preko mehanizmov za sledenje spremembam v datote\u010dnem sistemu. Napadi omogo\u010dajo sledenje aktivnostim drugih uporabnikov na podlagi analize dogodkov dostopa do datotek in map preko API-jev, kot so inotify v Linuxu, FileObserver v Androidu, ReadDirectoryChangesW v Windows in File System Events v macOS. Pridobljeni podatki se lahko uporabijo za ponovno ustvarjanje informacij, vnesenih s tipkovnico, za dolo\u010ditev dostopnih spletnih strani ali za organizacijo napadov clickjacking, ki prekrivajo vsebino aktivnega okna v trenutku pred klikom. Koda za implementacijo metod napadov je objavljena pod MIT licenco.    <\/p>\n<p>Prva metoda napada je bila demonstrirana v Linuxu in je izpostavljena mo\u017enosti dolo\u010danja dostopa do datotek znotraj mape, ki neposredno ni dostopna za branje in spremljanje. S funkcijo inotifywatch lahko posredno sledimo dejstvom spremembe datotek znotraj mape skozi spremljanje same mape.     <\/p>\n<p>Neposredno nima nepridobljen uporabnik pravic dostopa do branja vsebine in sledenja aktivnosti naprave \/dev\/input\/event4, ki odra\u017ea dogodke vnosov s tipkovnice. Vendar dogodki, ki se zgodijo s datoteko \/dev\/input\/event4, vplivajo na stanje nadrejene mape in jih je mogo\u010de spremljati preko nadzora spremembe metapodatkov mape \/dev\/input. Sprememba stanja \/dev\/input\/event4 se zgodi pri vnosu podatkov, zamiki med zajetimi dogodki preko inotify pa so korelirani z zamiki med pritiskanji tipk na tipkovnici.     <\/p>\n<p>Z uporabo statisti\u010dnih analiz in ob upo\u0161tevanju, da so zamude med pritiski pri vnosu odvisne od postavitve tipk na tipkovnici, je mogo\u010de z dolo\u010denim odstotkom verjetnosti rekonstruirati vnesene informacije. Na primer, reakcija pri vnosu \u010drke 'F' je hitrej\u0161a kot pri vnosu 'Q' ali 'X', saj je za pritisk potrebno manj gibov prstov; prav tako je ponovni pritisk na isto tipko hitrej\u0161i, kot pritisk tipk, ki so blizu skupaj ('s' po 'a' pritisnejo znatno hitreje kot 'g' po 's').    <center>  <video controls=\"\" style=\"width: 700px; height: 400px; max-width:100%\" loading=\"lazy\"><source src=\"https:\/\/inoti.fyi\/vid\/linux-local-iki.mp4\" type=\"video\/mp4\" loading=\"lazy\"><\/video>  <\/center>  <\/p>\n<p>Metoda se lahko uporabi tudi za obnovitev vnosa v SSH sejah, ko sta dva razli\u010dna uporabnika povezana na en SSH stre\u017enik. V tem primeru lahko eden od uporabnikov spremlja dogodke, ki se pojavijo pri vnosu drugega uporabnika, tako da spremlja napravo datoteke \/dev\/pts. Te\u017eava je bila re\u0161ena v januarskih posodobitvah jedra 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.65 in 6.18.3 z zavrnitvijo generiranja dogodkov ACCESS in MODIFY za nadrejeni imenik pri dostopu ali spreminjanju posebnih datotek znotraj njega.              <center>  <video controls=\"\" style=\"width: 700px; height: 400px; max-width:100%\" loading=\"lazy\" preload=\"none\"><source src=\"https:\/\/inoti.fyi\/vid\/linux-remote-iki.mp4\" type=\"video\/mp4\" loading=\"lazy\"><\/video>  <\/center>      <\/p>\n<p>Drugi na\u010din napada omogo\u010da dolo\u010ditev trenutka, ko sistem Polkit prika\u017ee okno za vnos avtentikacijskih parametrov, preko spremljanja dostopa do izvajalne datoteke \/usr\/bin\/pkexec. V tem trenutku lahko napadalec ustvari ponarejeno okno, stilizirano kot okno za vnos gesla, in ga prika\u017ee nad pravim zahtevkom za geslo. Uporabnik, ki ne opazi zamenjave, lahko vpi\u0161e geslo za potrditev operacije v ponarejeno okno. Mo\u017enost izvedbe tak\u0161nega napada je bila prikazana v distribucijah s okoljem delovne povr\u0161ine KDE Plasma.      <center>  <video controls=\"\" style=\"width: 700px; height: 400px; max-width:100%\" loading=\"lazy\" preload=\"none\"><source src=\"https:\/\/inoti.fyi\/vid\/linux-auth-ui.mp4\" type=\"video\/mp4\" loading=\"lazy\"><\/video>  <\/center>  <\/p>\n<p>API FileObserver, ki ga zagotavlja platforma Android, se lahko uporablja za sledenje dejavnosti z datotekami v zasebnih imenikih drugih aplikacij. Na primer, z analizo dejavnosti v imeniku \/sdcard\/Android\/media\/com.whatsapp\/WhatsApp lahko spremljate dejstva o brisanju, po\u0161iljanju in prejemanju datotek, videoposnetkov ali slik v WhatsApp, pa tudi imena poslanih ali prejetih datotek.    <center><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/09\/ebf8b5a70063a90e9067532381814c77.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/center>    <\/p>\n<p>V operacijskem sistemu Windows se je izkazalo, da vklju\u010ditev sledenja dogodkom za korensko mapo (C:) prena\u0161a informacije, vklju\u010dno s polno potjo do datoteke, o vseh dogodkih z vsemi datotekami v datote\u010dnem sistemu, ne glede na pravice do datotek. Raziskovalci so pokazali, da je mogo\u010de to funkcionalnost uporabiti za sledenje v resni\u010dnem \u010dasu tem, katere spletne strani uporabniki odpirajo v Firefoxu (za vsako stran se ustvari lo\u010dena mapa z imenom strani, ki se uporablja za bazo podatkov IndexedDB in predpomnilnik v Firefoxu in jo je mogo\u010de slediti). Reakcija Microsofta na to varnostno te\u017eavo je bila nominirana za Pwnies Award 2026 v kategoriji najneprimernej\u0161a reakcija proizvajalca (Lamest Vendor Response), saj so predstavniki podjetja sprva trdili, da to ni ranljivost, temve\u010d dokumentirana funkcionalnost.        <center>  <video controls=\"\" style=\"width: 700px; height: 400px; max-width:100%\" loading=\"lazy\" preload=\"none\"><source src=\"https:\/\/inoti.fyi\/vid\/windows-website.mp4\" type=\"video\/mp4\" loading=\"lazy\"><\/video>  <\/center><br \/>\n<br \/>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=66340\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f) \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0441\u0435\u0440\u0438\u044e \u0430\u0442\u0430\u043a \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c (PDF), \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0410\u0442\u0430\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u043e\u0431 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430\u043c \u0447\u0435\u0440\u0435\u0437 \u0442\u0430\u043a\u0438\u0435 API, \u043a\u0430\u043a inotify \u0432 Linux, FileObserver \u0432 Android, ReadDirectoryChangesW \u0432 Windows \u0438 File System Events \u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":183468,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183466","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f) \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0441\u0435\u0440\u0438\u044e \u0430\u0442\u0430\u043a \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c (PDF), \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sl\/blog\/news\/side-channel-attacks-via-the-file-system-change-tracking-mechanism\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sl_SI\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0410\u0442\u0430\u043a\u0438 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u0447\u0435\u0440\u0435\u0437 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0424\u0421 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f) \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0441\u0435\u0440\u0438\u044e \u0430\u0442\u0430\u043a \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c (PDF), \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sl\/blog\/news\/side-channel-attacks-via-the-file-system-change-tracking-mechanism\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-09-25T14:54:15+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-25T14:54:21+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Napadi prek stranskih kanalov z mehanizmom za sledenje sprememb v datote\u010dnem sistemu | ProHoster","description":"Raziskovalci z Gra\u0161ke tehni\u0161ke univerze (Avstrija) so odkrili vrsto napadov prek stranskih kanalov (PDF), ki se izvajajo z uporabo mehanizmov za sledenje sprememb v datote\u010dnem sistemu.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/side-channel-attacks-via-the-file-system-change-tracking-mechanism","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0438 \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c \u0447\u0435\u0440\u0435\u0437 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0424\u0421 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0413\u0440\u0430\u0446\u0441\u043a\u043e\u0433\u043e \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 (\u0410\u0432\u0441\u0442\u0440\u0438\u044f) \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0441\u0435\u0440\u0438\u044e \u0430\u0442\u0430\u043a \u043f\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043a\u0430\u043d\u0430\u043b\u0430\u043c (PDF), \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/side-channel-attacks-via-the-file-system-change-tracking-mechanism","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-09-25T14:54:15+00:00","article:modified_time":"2026-09-25T14:54:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/183466","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=183466"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/183466\/revisions"}],"predecessor-version":[{"id":183467,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/183466\/revisions\/183467"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/183468"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=183466"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=183466"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=183466"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}