Researchers from the Technical University of Graz (Austria) identified a series of side-channel attacks (PDF), carried out through mechanisms for tracking changes in the file system. Attacks allow you to track the activity of other users based on the analysis of events about accessing files and directories through APIs such as inotify in Linux, FileObserver in Android, ReadDirectoryChangesW on Windows and File System Events on macOS. The information obtained can be used to reconstruct the user’s keyboard input, to determine which sites are being opened, or to launch clickjacking attacks that overlay content on the active window at the moment before the click. The code implementing the attack methods is published under the MIT license.
The most dangerous attack method has been demonstrated in Linux and is caused by the ability to determine access to files inside a directory that are not directly accessible for reading and tracking. Using the inotifywatch function, you can indirectly monitor changes to files within a directory through monitoring the directory itself.
Directly, an unprivileged user does not have access rights to read the contents and monitor the activity of the device /dev/input/event4, which reflects keyboard input events. But events that happen to /dev/input/event4 affect the state of the parent directory and can be monitored by monitoring /dev/input directory metadata changes. The state of /dev/input/event4 changes when data is entered, and delays between events recorded through inotify correlate with delays between keystrokes on the keyboard.
Using statistical analysis methods and taking into account