File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS

Modern operating systems like Linux, Windows, and macOS provide built-in subsystems to monitor filesystem events: inotify, ReadDirectoryChangesW, and FSEvents, respectively. User processes can subscribe to receive file-operation notifications when actions like accessing, writing, opening, and closing are performed on a monitored file or directory. However, the attack surface opened up by these notification systems is not well understood, as prior work only showed that file-open events leak application startups on Android.

In this paper, we demonstrate the first generic file-notification template attacks on Linux, Windows, and macOS, allowing to spy on various system and user activity. The foundation of our attack is a new approach to discover exploitable file-notification side-channel leakage. We template the broad range of cross-user leakage from various operations including running terminal commands, keyboard and mouse input, browsing websites, web server activity, printing, running VMs and containers, changing connectivity settings (e.g., bluetooth, network, and VPN), and interacting with USB devices. With our templating, we demonstrate attacks on all systems, with a temporal resolution in the range of 2.5ms to 11.5ms.

On Linux, we demonstrate a local inter-keystroke timing attack with 93.9% to 100% F1 score across 7 users, a remote (SSH) inter-keystroke timing attack with 100% F1 score, an end-to-end authentication UI redress attack on KDE Plasma 6 (Wayland), and a website fingerprinting attack on the top-100 websites with an F1 score of 87.9% in an open-world setting. On Windows, even worse, we show that any unprivileged user can leak the full paths of all files even without read-permissions on a directory (e.g., users' home directories), directly leaking user and application file usage, exploitable, e.g., to reliably monitor website visits with an F1 score of 97.8% on the top-1000 websites. This shows that file-notification attacks are a generic security problem, cross-cutting across all modern operating systems despite their independent development.