DEV Community

Anoymask
Anoymask

Posted on

File Change Notification Side Channel: Estimating Keystroke Timing and Browsing Activity on Linux, Android, and Windows

#security #threatintel

1. Overview

2. Executive Summary

Researchers demonstrated that unprivileged local processes and Android apps without special permissions can use file change notifications to infer keystroke timings, browsing destinations, and WhatsApp media interactions without reading the file contents. Leaked information and prerequisites vary by operating system.

3. Attack Flow

The validation and implementation paths indicated by public sources are organized below. See "Attack Success Verification" for the scope of the researchers' demonstrations and the status of in-the-wild exploitation.

Path A: Activity Monitoring on Linux, Windows, and Android

  1. An attacker executes unprivileged code on the target device and registers notifications for monitorable directories depending on the operating system.
  2. Researchers verified monitoring of readable parent directories on Linux, drive roots on Windows, and specific app media areas via FileObserver on Android.
  3. Activity is inferred from the acquired path names and event timestamps. On Windows browser storage, site names included in paths may leak directly.

Path B: Spoofed Authentication Prompt in the Victim's Linux User Session

  1. The attacker's process runs under the victim's user account within the same graphical session.
  2. Notifications detect when the KDE Plasma 6 authentication screen appears, and a spoofed screen is overlaid.
  3. Credentials entered by the victim into the fake screen are captured. This differs from the separate-user monitoring permission conditions in Path A.

4. Attacker Position and Execution Location

  • Activity monitoring requires unprivileged code execution on the device. On Android, validation used apps that do not request additional permissions.
  • Credential theft via the KDE fake authentication screen assumes the attacker's process runs under the victim's user account within the same graphical session.

5. Victim and Administrator Perspective

Victim

  • For activity monitoring alone, there are no noticeable screen changes. In the KDE PoC, a fake screen resembling the legitimate authentication prompt appears.

Administrator

  • File notification APIs are also used by normal applications. Identifying suspicious monitoring targets or spoofed screen processes requires appropriate endpoint telemetry.

6. Success and Failure Conditions

Success Conditions

  • The attacker can execute code on the target host and monitor parent directories or roots.
  • Observable path and timing patterns exist that link notification events to user actions.
  • Credential theft via the KDE fake authentication screen additionally requires the attacker's process to run under the victim's user account within the same graphical session and user input into the fake screen.

Failure Conditions and Risk Reduction Measures

  • Apply Linux kernels containing the fix for CVE-2025-68788. This fix is a partial mitigation that suppresses access and modify notifications for special files, and does not resolve all information leaks demonstrated in the research.
  • Install the applicable Windows updates released on or after April 8, 2025, then enable EnforceDirectoryChangeNotificationPermissionCheck according to Microsoft's guidance after testing compatibility. This is disabled by default and adds access checks to NTFS/ReFS change notifications.
  • Review local execution privileges, app installations, and user isolation on shared hosts.

7. Impact Upon Success

  • Keystroke timings, web browsing destinations, WhatsApp media filenames and operations, and app launches are inferred.
  • The Linux same-user PoC displays a fake authentication dialog at an opportune time to proceed with password theft.

8. Observable Logs

The following items are investigation perspectives for your organization. They do not indicate that every item was observed in actual attacks.

  • Email: No reports indicate email was used as an initial access vector.
  • Proxy / SWG / DNS: Check for outbound transmission of inferred results or credentials.
  • Endpoint / EDR: If corresponding telemetry is enabled, inspect monitored targets of inotify, FileObserver, or ReadDirectoryChangesW, executing processes, and fake authentication screens. Standard EDR logs may not capture all API calls.
  • Identity / IdP: Verify creation of separate local users, interactive logins, and sudo failures.
  • SaaS / Cloud: Check MDM app installation history and VDI user allocations. These records alone do not confirm actual use of FileObserver.
  • Network: Check for external transmission of observation results or credentials. Local directory monitoring itself does not appear in network logs.

9. Attack Success Verification

Confirmed in Public Information

  • Initial Execution Confirmed: Public Information: Researchers executed side-channel PoCs on Linux, Android, Windows, and macOS. (Scope: Controlled experiments. Active exploitation in the wild unconfirmed)
  • Information Theft or Session Compromise Confirmed: Public Information: Researchers demonstrated credential acquisition via fake authentication dialogs in a Linux KDE PoC. (Scope: Research environment under same-user privileges)

10. Investigation Playbook

The following are investigation and response recommendations for your organization based on public information:

  • Starting Point: Begin with suspicious local processes, fake authentication screens, or unusual file monitoring.
  • Initial Response: Check OS and update status, executing user, monitorable directories, and Windows access check settings.
  • Endpoint: Preserve available notification API and process records, fake screen executables, and app lists.
  • Identity / Cloud: Check tokens, keys, logins, and SaaS/cloud audit logs.
  • Follow-up Verification: Track information theft, lateral movement, additional payloads, and configuration changes.
  • Containment: Isolate and remove suspicious apps or processes, and verify OS-specific mitigations. If input into a fake screen is suspected, rotate the relevant credentials from a trusted device.
  • Determination: Record contact, initial execution, successful authentication/malware, information compromise, and subsequent compromise separately.

11. Defense and Detection Ideas

  • Single Events: Inspect available endpoint logs for unusual notification registration targets or authentication processes impersonating legitimate screens. Notification API usage alone does not indicate maliciousness.
  • Timeline: Correlate process execution, notification registration, fake authentication prompts, and outbound communications within a short timeframe.
  • Hunting: Cross-reference impact periods and asset inventories to proactively hunt for matching IoCs and behaviors.
  • Log Gaps: Notification API monitored targets and calls may not appear in standard audit logs. Verify measurement capabilities and do not treat a lack of logs as proof of non-execution.
  • Priority Actions: Verify Linux partial mitigations and Windows optional settings, and restrict unnecessary local code execution and app installations.

12. Facts / Inference / Hypothesis

Facts

  • In a Linux research environment, monitoring readable parent directories to obtain child file notifications yielded F1 scores of 93.1% to 100% in local keystroke timing detection across seven users. These notifications reveal keystroke timing, not the characters typed. In the separate SSH-based attack using /dev/pts, inputs that produce no terminal output, such as sudo password entry with echo disabled, do not generate the required notifications.
  • On Linux, font access notifications for Firefox top 100 site classification reported an open-world evaluation F1 score of 87.9%. Credential acquisition via fake authentication screens was also demonstrated on KDE Plasma 6 under the same user privileges.
  • On Android, apps requiring no additional permissions used FileObserver to observe filenames, transmissions, and deletion timestamps in WhatsApp's private media folders.
  • On Windows, monitoring the drive root via ReadDirectoryChangesW revealed full paths including other users' areas. Evaluating 975 responsive sites out of the top 1,000, browsing destination detection F1 scores were 97.8% for Firefox and 48.5% for Edge.
  • Linux features a partial mitigation via CVE-2025-68788. Microsoft initially stated the behavior was by design, but researchers later confirmed mitigation via Windows access check settings that are disabled by default. Research sites do not list fixes for Android and macOS.
  • On macOS, observed leakage was limited to information about globally readable files. Researchers did not identify an unreadable-file bypass comparable to those found on Linux, Windows, and Android.

Inference

  • Because path names and event timelines become sensitive even if file contents cannot be read, directory read permissions alone cannot be treated as low risk.

Hypothesis

No additional hypotheses. Unverified items are listed under "Uncertainties and Additional Investigation".

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1056.002 Input Capture: GUI Input Capture High Researchers captured input into a fake authentication screen during the KDE same-user privilege PoC. Keystroke timing observation alone is not mapped to character keylogging or screen capture.

14. Uncertainties and Additional Investigation

  • Reproduction scope across various Android vendors and OS versions, and future platform patches.
  • Compatibility when enabling Windows settings and confirmation of active exploitation in operational environments.

15. Impact on SOCs and Organizations

On shared Linux servers and VDIs, activity may leak from notification path names and timelines even if reading file contents is prohibited. Because notification APIs are used by normal apps, decisions must combine monitoring targets, the processes and user accounts performing the monitoring, spoofed screens, and outbound communications. Differentiate the scopes of Linux partial mitigations and Windows optional settings, and evaluate isolation between endpoints and users.

16. Summary by Role

  • SOC: Check for mass monitoring registrations, C:\ or /dev monitoring, browser cache/font path events, and outbound communications.
  • Administrators: Apply Linux patches, verify Windows settings and local access restrictions, and strengthen isolation between users and workloads on shared hosts.
  • Users: Activity can be inferred even by apps requesting no additional permissions. Do not add unnecessary apps or local accounts to devices.

Top comments (0)