Security researchers at Graz University of Technology have uncovered decades-old flaws in the file-notification subsystems of Android, Linux, macOS, and Windows. These subsystems, which inform applications when files change, leak event metadata that can be used as a side channel to infer other users' activities. The affected components include Linux's inotify (since 2005), Android's FileObserver (2008), Windows' ReadDirectoryChangesW (2000), and macOS's FSEvents (2007).
Using this data, the researchers demonstrated inter-keystroke timing attacks, website fingerprinting, and UI redress attacks. On Linux, watching /dev/input yielded keystroke accuracy of 93.1-100% locally and 100% over SSH. On Windows, watching the root directory C:\ exposed full file paths across all users, allowing real-time tracking of Firefox visits with 97.8% accuracy. On Android, FileObserver bypasses the FUSE isolation layer, letting a permissionless app watch WhatsApp's private folder for file activity.
Only Linux has received a partial fix, in December 2025, that suppresses access and modify events for special files in /dev/. No mitigation has appeared for Android, and Apple's macOS leaked the least information because private directories could not be read. Microsoft told the researchers the Windows behavior is 'by design' and an undocumented feature, a response the team nominated for the Pwnie Awards. The paper is scheduled for ACM CCS 2026.