File Notification Attacks: Side-Channel Leakage from the File-Notification System on Linux, Android, Windows, and macOS
Summary
Researchers demonstrate that file-notification systems (inotify on Linux, FileObserver on Android, ReadDirectoryChangesW on Windows, and File System Events on macOS) leak sensitive user and app activity through event notifications, even when file contents are unreadable. The paper provides four demos across platforms, highlights cross-user leakage risks, and discusses mitigations and patches, noting partial Linux mitigations and Windows policy updates. This has broad implications for developers, admins, and OS security teams.