Research into file-notification attacks on Linux

Date:
Thu, 24 Sep 2026 17:40:36 +0000

Description:
Sudheendra Raghav Neela, a member of a group of researchers from Graz University of Technology , has announced the
release of research into file-notification attacks that would allow spying on user activity on Android, Linux, macOS, and Windows. The group has published
a paper with
details on the research as well as a web site with demonstrations of the vulnerabilities. On Linux, an attacker can use inotifywatch to
monitor a directory to conduct an inter-keystroke timing attackeven if
they do not have read access to the files within a directory. The group also discovered a method to conduct a UI-redress
attack (or " clickjacking " attack) on
KDE5 and KDE6 by monitoring /usr/bin/pkexec to detect when Polkit spawns an authentication
prompt. An attacker could draw a fake password window on top of the real window
to collect a user's credentials. Both of these flaws are still present today, though the Linux kernel did partially mitigate the issue with a
fix that was included in the 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.65,
and 6.18.3 kernels shipped in January. See the web site for more information and
a mitigation to prevent password-prompt windows from losing focus.

======================================================================
Link to news story:
https://lwn.net/Articles/1096431/


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet UK HUB @ hub.uk.erb.pw (1337:1/100)