A Chilling Reality: File Notification Systems Exposed on Windows, Linux, Android, and macOS
Security researchers at Graz University of Technology in Austria have uncovered a disturbing truth about file-change notification systems built into popular operating systems. These systems, designed to alert applications when files are created, modified, or deleted, can be exploited by malicious actors to monitor user activity, from the rhythm of their typing to the websites they visit. The researchers demonstrated that this vulnerability affects not only Windows but also Linux, Android, and macOS.
The attacks work by leveraging file names and event timing to reconstruct user, application, and system activity. This is made possible because many applications rely on these notification systems, including text editors, file managers, sync clients, and antivirus products. To exploit the vulnerability, an adversary only needs read access to the location being watched, which requires no elevated privileges.
On Linux, for example, a user who is denied permission to watch a protected file can still receive its events by monitoring the folder that contains it. This can be particularly insidious on Android, where an app requesting no permissions can watch another app’s private storage folder. The researchers demonstrated this by watching WhatsApp activity, revealing when photos, videos, and documents were received or sent.
The most serious issue arises on Windows, where a user monitoring the root of the system drive can see the full path of every file changed anywhere on the machine, including inside other users’ home directories that the monitoring account cannot read. This is particularly concerning because it allows an attacker to gather sensitive information without needing elevated privileges.
Firefox and Edge browsers are also vulnerable, with Firefox leaking site visits in real-time with 97.8% accuracy for the top 1,000 websites. On macOS, while only globally readable files can be monitored, researchers could still track application launches, app interactions, and settings changes.
So far, no patches have been released to address most of these attack scenarios. While Microsoft has downplayed the issue, stating that it is “by design” and does not provide access to file contents or sensitive data, the researchers argue that this vulnerability highlights the need for better security practices. This includes limiting local access to trusted users and keeping systems up-to-date.
In light of these findings, it’s essential for individuals and organizations to take steps to protect themselves from such attacks. This can be achieved by following basic security best practices, including regularly updating operating systems and applications, being cautious when granting permissions to apps, and implementing robust monitoring and logging mechanisms to detect suspicious activity.
Source: SecurityWeek — 2026-09-25