<p>Sudheendra Raghav Neela, a member of a group of researchers from <a
href="https://www.tugraz.at/en/home">Graz University of Technology</a>, has <a
href="https://infosec.exchange/@vmcall/117327103049106849">announced</a> the
release of research into file-notification attacks that would allow spying on
user activity on Android, Linux, macOS, and Windows. The group has published <a
href="https://inoti.fyi/pubs/file-notification-attacks.pdf">a paper</a> with
details on the research as well as a <a href="https://inoti.fyi/">web site</a>
with demonstrations of the vulnerabilities.</p>

<p>On Linux, an attacker can use <a
href="https://linux.die.net/man/1/inotifywatch"><tt>inotifywatch</tt></a> to
monitor a directory to conduct an inter-keystroke timing attack&mdash;even if
they do not have read access to the files within a directory. The group also
discovered a method to conduct a <a
href="https://www.deepwatch.com/glossary/ui-redress-attack/">UI-redress
attack</a> (or "<a
href="https://en.wikipedia.org/wiki/Clickjacking">clickjacking</a>" attack) on
KDE&#160;5 and KDE&#160;6 by monitoring <tt>/usr/bin/pkexec</tt> to detect when <a
href="https://en.wikipedia.org/wiki/Polkit">Polkit</a> spawns an authentication
prompt. An attacker could draw a fake password window on top of the real window
to collect a user's credentials.</p>

<p>Both of these flaws are still present today,
though the Linux kernel did partially mitigate the issue with <a
href="https://lore.kernel.org/linux-cve-announce/2026011303-CVE-2025-68788-05bd@gregkh/">a
fix</a> that was included in the 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.65,
and 6.18.3 kernels shipped in January. See the web site for more information and
a mitigation to prevent password-prompt windows from losing focus.</p>