²⁰²⁶⁻⁰⁹⁻²⁸
Decades-Old Bugs Found on Linux, Windows, Android: File Notification Attacks

Operating systems let programs subscribe to file events (opened, written, deleted) through APIs like inotify on Linux, FileObserver on Android, and ReadDirectoryChangesW on Windows. “File Notification Attacks” finds that these APIs don’t enforce the same permission checks as normal file access, so an unprivileged process can watch activity on files it cannot read. The paper presents keystroke timing attacks on Linux, reveals when WhatsApp media is sent or received on Android, and exposes which websites another user visits on Windows (97.8% F1 score on the top 1,000 sites in Firefox). File contents importantly do not leak. Linux has a partial kernel fix, Windows has an opt-in policy that is off by default, and Android and macOS have no fix yet.