The researchers from the Institute of Information Security at Graz University of Technology (TU Graz) summarized their findings in the paper entitled, “File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS.” Authors of the paper are Sudheendra Raghav Neela, Xufan Zhao, Jeanette Angelika Wultsch, Hannes Weissteiner, Florian Draschbacher, Stefan Gast and Daniel Gruss, all from TU Graz, Austria.
The researchers discovered that apps or other users on the same system can monitor these notifications, even without administrator rights. This makes it possible to track what other users on the system are doing.
Read Access
Read access to specific folders is all that ends up required to view all files stored in a folder, as well as the subfolders and their contents – even if they do not actually permit read access. One thing that applies to all systems: File contents cannot be read; only file names and changes can end up detected. However, this is sufficient to monitor user, system and application behavior.
The research team uses case studies to illustrate what such attacks could actually look like.
To bypass the read-access restrictions on folders and files in Windows, the researchers simply tapped into the file notification system of the parent directory not read-protected.
Using notifications of the main directory C:\, the researchers discovered it was possible to track all file system events in all subfolders, including filenames. As browsers such as Firefox create a separate folder for every visited website that requires local storage, with the folder name containing the name of the website, attackers can easily trace where users have been on the Internet in real time.
File Notification Systems of popular operating systems allow spying.
Source: Brinda Neela
On Linux, the researchers used the “inotify” file notification system to track keystrokes within a read-protected file. Although Linux initially prevented direct monitoring on the file, it became possible as it was in a readable folder, which allowed to spy on everything in it via the notification system.
This made the keystrokes in the read-protected file visible. While the team could not see which keys ended up pressed, inter-keystroke timing attacks have been around for more than two decades. Thanks to knowledge accumulated over the years, the time elapsing between individual keystrokes now reveals plenty of information.
KDE Plasma
On KDE Plasma, a popular desktop environment on Linux, the security researchers managed to overlay fake password entry windows on top of the genuine ones as soon as an authentication prompt called up, even when the secure Wayland display server protocol was in use.
To achieve this, they monitored the executable file of the “polkit” programming interface, which carries out authorization checks. As soon as they detected an access attempt that opened a password window, the test attackers superimposed a fake password window over it so that users would enter their details there and reveal their passwords.
On Android, the “FUSE” system should prevent apps from accessing each other’s folders.
Not even the folders’ contents should be visible. However, an app without special permissions was still able to spy on activity within another app’s folder by using file notifications as a workaround.
The team was thus able to observe whether images, videos and files were arriving in, sent from or deleted from WhatsApp’s folders.
Researchers emphasize they could not see the contents of these files, but they could read the file names, which might reveal something about the file’s contents and the behavior of the user using the Android phone.
MacOS Less Exposed
While macOS exposes the least amount of information via globally readable files, the team found user, application, and system behavior can still end up tracked, pointing out the macOS “FSEvents” application programming interface (API) still yields meaningful insight into user activity.
As is customary in such cases, the research team alerted the relevant teams at Linux, KDE, Android, Microsoft and Apple to the potential vulnerabilities at an early stage so they could respond before the paper published. In collaboration with the Linux security team, patches have already been rolled out to address some of the vulnerabilities.
Click here to view the entire paper.