File notifications rank among the oldest facilities in any operating system, and a research group in Austria says they have been quietly reporting on whoever else is using the machine. The team at Graz University of Technology, led by doctoral student Sudheendra Raghav Neela, probed four implementations and found that each one hands an unprivileged program more than it should know about other accounts.
The four are ReadDirectoryChangesW on Windows, inotify on Linux, FSEvents on macOS and FileObserver on Android, with roots stretching back two decades. None of them exposes the contents of a file. What they expose is the traffic of events around it, and Neela’s group argues that the stream alone works as a side channel.
Three demonstrations stand out. Aiming a watch at the input device directory on Linux turned every keystroke into a notification, and the resulting timing attack recovered typed input at 93 to 100 percent accuracy across seven users, and at 100 percent when the attacker reached the machine remotely over SSH. Microsoft’s subsystem proved the most generous: a watch on the root of the C: drive returned the full path of each file touched system-wide, permissions notwithstanding, and the trail let the group work out which sites a second user opened in Firefox with 97.8 percent accuracy. Android supplied the third route, because FileObserver slips past the storage layer meant to keep apps apart, so software holding no permissions can follow another app’s private folder and note when photographs and documents land.
The Linux bug carries the identifier CVE-2025-68788, and kernels shipped in December 2025 contain a partial fix. Android has nothing so far. Microsoft’s answer (that the behavior is intentional and undocumented) is the one the group points out was nominated for a lamest-vendor-response award.
