Graz researchers turn OS file-change alerts into a monitor for typing and browsing

Most of the attacks need an adversary who can already run code on the machine under a separate account ^[3]. The notification feature itself needs no elevated privileges, only read access to the location being watched ^[2]. On a shared Linux or Windows host, any other user meets that bar. On Android, the separate account is just another app that requests no permissions ^[3]. The researchers say they are not aware of in-the-wild exploitation ^[14].

The Linux keystroke channel gets around a permission check. A user refused the right to watch a protected file can still receive its events by watching the folder that holds it, as long as that folder is readable ^[4]. Pointed at the keyboard device files, this shows when a key goes down, but not which key ^[4]. The timing alone is useful to an attacker. Research going back more than two decades has used the intervals between keystrokes to infer what is being typed ^[6]. Input that puts nothing on screen, such as a hidden sudo password, is not captured ^[7].

Linux leaks in other ways too. Tracking which system fonts Firefox loads for a page identified sites from the top 100 with 87.9% accuracy ^[8]. On KDE Plasma 6 under Wayland, a malicious process running as the victim detects when the real authentication dialog is about to appear and draws a fake one over it to capture credentials ^[20]. That attack needs code running in the victim's own account ^[20]. On multi-user Linux hosts, the keystroke channel is the part with a kernel fix. With no reported exploitation, I'd put that fix in the ordinary kernel update cycle ^[13][14].

On Windows the leak comes through file paths. Watching the root of the system drive returns the full path of every file changed anywhere on the machine, including inside other users' home directories that the watching account cannot read ^[21]. How much that reveals depends on how each application names its folders. Firefox keeps data for many websites in folders named after the site. Edge creates such folders for far fewer sites ^[22]. Across the same top 1,000 sites, Firefox browsing was identified 49.3 percentage points more accurately than Edge browsing ^[24].

A Microsoft spokesperson said: "We investigated and determined that this is not a security vulnerability. The technique requires an attacker to already have the ability to run code locally on a device under a separate user account and does not provide access to file contents." ^[17]

macOS leaks the least, because only globally readable files can be monitored ^[23]. The researchers could still track application launches, app interactions and settings changes there ^[23].