# How Routine File-Monitoring Features Can Be Weaponized for Cross-User Surveillance on Everyday Devices
## A Deep Dive Into an Overlooked Threat Vector
Modern operating systems have long offered developers a way to subscribe to notifications whenever a file is created, modified, or deleted on a system. This functionality underpins a wide range of everyday software — from sync services and backup tools to text editors and security scanners. What many users don’t realize is that this seemingly benign feature can be turned into a powerful surveillance mechanism, exposing detailed information about what other people using the same machine are doing.
Security researchers have demonstrated a series of attacks that exploit these built-in file-monitoring APIs across all major desktop and mobile platforms. The attacks work without ever reading actual file contents. Instead, they rely on observing file names, folder structures, and the precise timing of change events — details that are freely accessible to any process with basic read permissions to the monitored directory.
## How the Attacks Work Across Platforms
### Linux: Keystroke Rhythm Reconstruction and Beyond
On Linux systems, the vulnerability stems from how directory-level permissions interact with file notification requests. A user who lacks permission to read a specific file can still subscribe to change events occurring in the folder that contains that file. This technical gap has dramatic consequences.
When applied to the special device files that represent keyboard input, an attacker can detect the rhythm of another user’s typing — not by capturing individual characters, but by measuring the precise intervals between keystrokes. Decades of academic research have established that typing cadence is highly individualistic. In controlled experiments with seven test subjects, the attack reliably identified when keys were being pressed, achieving accuracy scores ranging from 93.1 percent to a perfect 100 percent on standardized benchmarks.
It is worth noting that this method captures only input that produces visible on-screen text. Hidden passwords entered via the sudo command, for example, would not be exposed through this channel. Other Linux-based attacks demonstrated include inferring which websites a user is visiting by observing which system fonts Firefox loads for each page. By analyzing font-loading patterns, researchers identified sites from a list of the top 100 most popular websites with an accuracy rate of 87.9 percent.
A separate attack targeted the KDE Plasma 6 desktop environment running on the Wayland display server. In this scenario, a malicious process running under the victim’s account would detect when the legitimate authentication dialog was about to appear and instantly overlay a counterfeit prompt, tricking the user into entering credentials into the fake interface.
### Windows: Comprehensive File-Activity Exposure
Windows presents perhaps the most severe exposure of the bunch. When a user configures a file-monitoring watcher on the root of the system drive, the operating system reports the full path of every single file that changes anywhere on the machine — including inside other users’ home directories that the monitoring account has no ability to read directly.
This behavior means that even a low-privilege user can get a real-time map of another user’s activity simply by watching for filesystem changes. One of the most effective techniques involves monitoring the folder where Firefox stores its per-site data. Each website gets its own uniquely named folder, so an unprivileged observer can watch which folders are created, modified, or accessed in real time — effectively learning which websites the other user is visiting.
Testing across the top 1,000 websites yielded a staggering 97.8 percent accuracy for Firefox. The researchers also tested Microsoft Edge, achieving a lower accuracy of 48.5 percent. The significant gap between the two browsers is largely attributable to Edge’s design choice of creating far fewer per-site folders on disk.
### Android: Permissionless Espionage
The mobile platform story is equally concerning. On Android devices, a malicious application that requests zero permissions at all can still monitor the private storage folder belonging to another app. Testing on both Google Pixel and Samsung Galaxy handsets confirmed that this attack works in practice.
Against the messaging app WhatsApp, researchers were able to determine precisely when photos, videos, and documents were received or sent, capture the filenames involved, and even detect when that media was later deleted — all without the spyware ever having been granted a single system permission.
### macOS: The Most Restrictive by Design
Apple’s operating system is the least exposed of the four, thanks to a design philosophy that only allows monitoring of files and folders that are globally readable. Even with this constraint, researchers were still able to track application launches, observe interactions between apps, and detect changes to system settings. While the attack surface is smaller, it is not entirely eliminated.
## Industry Responses
Some vendors have begun addressing these issues. Linux kernel developers have partially hardened the system so that the special device files representing keyboard and other input hardware no longer generate access and modify events. This mitigation addresses the most critical class of attacks on Linux.
Microsoft, however, has characterized the Windows behavior as an intentional design choice rather than a vulnerability. The company’s position is that the notifications reveal only file names and paths within another user’s profile directory, never the actual contents of files. Microsoft recommended that customers follow standard security practices — such as limiting local machine access to trusted individuals and keeping systems updated — as their primary defense.
The company also pointed to protections documented earlier in 2025 that administrators can enable to address certain directory change notification scenarios involving file-path disclosure.
Apple and Google have not publicly commented on the findings as of the time of reporting.
## No Known In-the-Wild Exploitation — Yet
The researchers have stated that they are not aware of any real-world attacks using these techniques. However, proof-of-concept code demonstrating the file-notification attack has been made publicly available, which means the barrier to entry for potential adversaries has been significantly lowered.
—
## Frequently Asked Questions
**What exactly are file-change notification features?**
File-change notification APIs allow software applications to register for alerts whenever a file or directory is created, modified, or deleted. Operating systems provide these capabilities natively, and they are used by a wide range of legitimate software including backup tools, antivirus programs, cloud sync clients, and file managers.
**Do these attacks reveal the contents of my files?**
No. The attacks described never access or expose the actual contents of any files. They work exclusively by observing file names, folder structures, and the timing of filesystem change events.
**Can an attacker on my device see what I’m typing?**
On Linux, an attacker can detect the rhythm and timing of your keystrokes by monitoring input device files. They can learn *when* you are typing and infer patterns, but they cannot capture individual characters or passwords through this method. The attack is more about behavioral fingerprinting than capturing specific input.
**Do I need elevated administrator privileges for these attacks to work?**
No. The vast majority of the attacks require only that the attacker can run code on the same machine under a separate user account. No special administrator or root access is needed. On Android, the attacker’s app doesn’t even need to request any system permissions at all.
**Are these attacks theoretical or have they been demonstrated?**
The researchers have successfully demonstrated every major attack vector in controlled testing environments and have published proof-of-concept code. The attacks were evaluated on real hardware running real operating systems including Linux desktop environments, Windows, Android phones, and macOS.
**What can I do to protect myself?**
Users can reduce their exposure by ensuring that only trusted individuals have local accounts on shared machines, keeping all operating systems and software updated, and being mindful of who has physical access to their devices. On Windows, administrators can enable the file-path disclosure protections documented by Microsoft. On Linux, the kernel has been partially patched to reduce the attack surface, so keeping your distribution updated is important.
**Has this been exploited in the wild?**
The research team reported that they are not aware of any real-world exploitation of these techniques. However, the public release of proof-of-concept code means that malicious actors could potentially develop similar attacks.
**Which operating system is the safest from these attacks?**
macOS currently has the smallest attack surface due to its restrictive monitoring permissions, but it is not fully immune. No major desktop or mobile operating system currently provides complete protection against all variants of these attacks.
—
## Conclusion
The findings underscore a sobering reality: the very features that make modern operating systems convenient for developers and users alike can also serve as channels for unintended information leakage. File-change notifications, a staple of desktop and mobile computing for decades, turn out to be a rich source of behavioral data that can be exploited with nothing more than basic access to a monitored directory.
While no evidence of real-world exploitation currently exists, the publication of working proof-of-concept code changes that calculus significantly. These attacks sit in a troubling gray zone — they don’t break encryption, don’t steal file contents, and don’t require elevated privileges — yet they can still reveal intimate details about a user’s daily digital life.
Operating system vendors will need to reckon with the dual-use nature of file-monitoring APIs. For now, the most effective defense remains the simplest one: treat your device as a shared space, limit access to trusted users, and keep your systems patched and updated as new mitigations become available.
Thank you for reading.
