Ethical Hacking News
Decades-old security flaws have been discovered in the file notification systems of Android, Linux, macOS, and Windows, exposing users to potential data breaches and attacks. The vulnerabilities, which have been present in these systems for over two decades, can be exploited by malicious actors to gain unauthorized access to sensitive user data. The discovery highlights the importance of keeping operating systems and software up to date and prioritizing security measures to protect user data and prevent attacks.
Decades-old file security flaws have been discovered in Android, Linux, macOS, and Windows operating systems. These vulnerabilities can be exploited to gain unauthorized access to sensitive user data and conduct various types of attacks. File notification subsystems in these operating systems can leak potentially compromising system information. These subsystems can be used to conduct side-channel attacks, including inter-keystroke-timing, website fingerprinting, and UI redress attacks. Researchers have identified several vulnerable systems, including inotify on Linux, FileObserver on Android, ReadDirectoryChangesW on Windows, and FSEvents on macOS. Mitigations are needed to protect user privacy and data security, including disallowing drive monitoring on Windows and introducing permission systems on macOS and Windows.
A recent discovery by security researchers has shed light on decades-old file security flaws in Android, Linux, macOS, and Windows operating systems. The vulnerabilities, which have been present in these systems for over two decades, can be exploited by malicious actors to gain unauthorized access to sensitive user data and conduct various types of attacks.
The research, conducted by a team of security experts from Austria's Graz University of Technology, has identified several file notification subsystems in these operating systems that can leak potentially compromising system information. The most affected systems include inotify on Linux since 2005, FileObserver on Android since 2008, ReadDirectoryChangesW on Windows since 2000, and FSEvents on macOS since 2007.
These file notification subsystems are designed to inform applications when files change, but they can be used as a side channel to infer the activities of other users of the computer. An attacker who gains access to these subsystems can conduct various types of attacks, including inter-keystroke-timing attacks that reveal user input, website fingerprinting attacks that reveal website visits, and UI redress attacks that allow credential theft.
The researchers found that on Linux, watching a readable directory can leak events on files inside it that the user cannot even read, which can be turned into a local inter-keystroke timing attack with a 93.1-100% keystroke accuracy score across seven users. Similarly, on Windows, watching the root directory C:\ can report the full path of every file touched anywhere on the system, across all users, regardless of permissions, enough to track which websites another user visits in real-time at a 97.8% accuracy score.
Microsoft has responded to the discovery by stating that the side-channel leak of file events is "by design," and that it is an undocumented feature. However, the researchers argue that further mitigations are needed to protect user privacy and data security.
The researchers' paper, titled "File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS," is scheduled to appear at ACM CCS 2026 this November in The Hague, Netherlands. The authors propose several mitigations, including disallowing the monitoring of entire drives on Windows and introducing a permission system on macOS and Windows.
The discovery highlights the importance of keeping operating systems and their software up to date, as well as the need for more robust security measures to protect user data and prevent attacks. As the use of artificial intelligence and machine learning continues to grow, it is essential to prioritize security and data protection to prevent the exploitation of vulnerabilities like those discovered in Android, Linux, macOS, and Windows.
Related Information:
https://www.ethicalhackingnews.com/articles/Decades-Old-Security-Flaws-Exposed-in-Android-Linux-macOS-and-Windows-A-Threat-to-User-Privacy-and-Data-Security-ehn.shtml
https://www.theregister.com/security/2026/09/24/decades-old-file-security-flaws-found-in-android-linux-macos-and-windows/5298672
Published: Thu Sep 24 12:48:03 2026 by llama3.2 3B Q4_K_M
