Most people assume computer spying requires a keylogger, browser extension, or malware that reads private data. New research shows a quieter possibility. Normal file-notification features built into Windows, Linux, and macOS can sometimes expose browsing activity, application use, and even typing patterns without opening protected files. The discovery highlights a privacy problem: routine operating-system metadata can reveal far more about a person’s activity than most users realize during everyday use.
File Alerts Can Reveal Your Activity
Researchers at Graz University of Technology found that file-notification systems can expose more than expected. Depending on the platform, these features can report when files or folders are accessed, changed, renamed, created, or deleted. Usually, that helps software react quickly without repeated checks.
The problem starts when another process watches those events and links them to user activity. A program may never read a private file, yet it could still notice where related files are stored or when they change. The researchers’ file-notification attack project shows how those signals can reveal browsing activity, application use, keyboard timing, printing, network changes, and other behavior while file contents remain hidden.
Why File Notifications Exist
File notifications are part of an operating system. Browsers update caches, office programs create temporary files, backup tools watch folders, and security software scans data. Without notifications, many apps would keep checking the same places just to learn whether something changed.
Windows includes ReadDirectoryChangesW for this job. Linux uses inotify, while macOS relies on FSEvents. None is malicious. The privacy issue appears when file names, paths, timestamps, or repeated events reveal clues that permissions were supposed to keep separate. That is how a side channel can form: the attacker learns from traces left by an activity instead of reading protected information directly.
Windows Can Expose Browsing Clues
The Windows results were among the study’s most striking. Researchers found that an unprivileged user could watch the root of the C: drive and receive full paths tied to file activity elsewhere, including another user’s profile, even without permission to open those files.
Browsers make that important because they constantly update local data. Firefox can create site-related folders for websites using local storage, IndexedDB, or caching. If a folder contains a website name, an observer may infer which site another user visited without opening browser history.
In the top-1,000-site experiment, Firefox monitoring reached a 97.8 percent F1 score. Help Net Security also reported that Firefox created site-named directories for 95.7 percent of the 975 websites that responded during testing, with no false website matches in that experiment. These were controlled tests, but they show how revealing a simple file path can become.
Linux Can Leak Typing Rhythm
Linux showed a different kind of leak. Researchers found that a user who could watch a readable parent directory could sometimes receive inotify events for files inside it without permission to read the individual file. On affected systems, that behavior also reached special device files tied to keyboard input.
The notification did not reveal which key was pressed. It revealed when a keypress happened. Local inter-keystroke timing detection ranged from 93.1 percent to 100 percent F1 across seven users, while the SSH timing experiment reached 100 percent F1.
Ubuntu’s CVE-2025-68788 notice describes a Linux kernel change that prevents certain access and modify events on special files from being reported to parent-directory watchers. The researchers call the Linux issue partially mitigated, with the most serious paths addressed. This is still different from a keylogger because the attacker sees timing around typing, not the characters entered.
macOS Reveals Less, Not Nothing
macOS exposed less information than Windows and Linux in this research. The researchers did not find the same private cross-user file leakage there, which is an important difference.
That does not make the system silent. Researchers still linked some filesystem activity with app launches and interactions, printing, Bluetooth changes, and software installation. Apple’s File System Events documentation explains how apps receive notifications when directory contents change. macOS looked better in this comparison, but less leakage is not the same as no observable behavior.
Shared Computers Carry More Risk
This does not mean a random person on the internet can suddenly watch your browsing. The demonstrated attacks require a local foothold, such as another user account, a compromised service, or compromised software already running on the machine.
The researchers describe this local attacker model and say they are unaware of these techniques being exploited in the wild. Risk rises on systems shared by several people, accounts, or services.
Examples include:
- Family computers with separate user accounts.
- Shared workplace PCs and multi-user workstations.
- Servers running services under different accounts.
- Development computers and shared technical systems.
- PCs holding sensitive customer or business information.
A single-user home PC running trusted software has a different risk profile from a shared workstation or server.
Steps Users and Businesses Can Take
There is no single switch that blocks every file-notification side channel. The goal is to reduce unnecessary accounts and background programs, keep software current, and make it harder for untrusted code to remain on a system.
Users and small businesses should:
- Install operating-system, browser, and security updates promptly.
- Remove old user accounts that are no longer needed.
- Uninstall unfamiliar or unnecessary background utilities.
- Limit administrator privileges to people and processes that need them.
- Review startup apps and long-running services from time to time.
- Use reputable endpoint protection on business systems.
- Keep sensitive work off heavily shared computers when practical.
Windows administrators have another option to review. Microsoft documents access-check enhancements for directory-change notifications through a policy called EnforceDirectoryChangeNotificationPermissionCheck. It is included in Windows updates released on or after April 8, 2025, but Microsoft says it is disabled by default to avoid unexpected security risks or application disruption. Businesses should test it before wider deployment.
What JENI® Users Should Know
For JENI® users, the main lesson is simple: computer maintenance and cybersecurity controls solve different problems. Cleaning temporary files or improving performance does not replace access controls, security updates, endpoint protection, or careful account management.
It also matters what is allowed to run on the computer. An old account, forgotten utility, or compromised service can create privacy risk even when the machine looks stable. Regular maintenance works alongside security practices rather than replacing them.
Why Metadata Can Expose Activity
Privacy does not stop at the contents of a file. File names, folder paths, timestamps, access patterns, and application activity can reveal useful information even when the document itself stays protected. NIST defines metadata as information that describes characteristics of data.
A malicious process may never open browser history, yet site-related folders can still provide clues. It may never read a document, yet file activity can hint at which application is using it. The problem appears when small clues line up and form a recognizable pattern.
Frequently Asked Questions
Can this attack read my private files?
Not by itself. The research focuses on notifications, file paths, timing, and other information around file activity rather than directly reading protected file contents.
Can someone do this over the internet?
Not simply by connecting to your computer from somewhere else. The demonstrated attacks generally require local code, another account, a compromised process, or a compromised software component already running on the system.
Is this the same as a keylogger?
No. A traditional keylogger records the actual keys a person types, while the Linux technique in this research exposed when keystrokes happened without directly identifying which keys were pressed.
Are Windows users at greater risk?
Windows produced some of the study’s strongest cross-user results, especially for full file paths and Firefox browsing activity. Actual risk still depends on software, permissions, accounts, configuration, and whether an attacker already has some level of local access.
Should I enable the Windows fix?
Microsoft offers an optional permission-check policy that can reduce unauthorized file-path disclosure, but it is disabled by default because of possible disruption or security concerns. Home users should avoid advanced system changes they do not understand, while business administrators can test the policy before wider use.
Privacy Can Leak Through Patterns
Computer security often asks who can open a file, read a database, or capture a password. This research adds another question: what can someone learn just by watching the system react?
NIST describes a side channel as a way to infer information by observing indirect effects of a program or system instead of the protected data itself. File notifications fit that broader idea. One event may mean little. A stream of repeated events can tell a much richer story.
For most home users, this is not a reason to panic. The researchers say they are unaware of these attacks being used in the wild, and the techniques need local access or compromised software. Keep systems updated, remove accounts and programs you do not need, and treat metadata as part of your privacy picture. Sometimes the activity around a file can reveal almost as much as the file itself.
Related Articles
How Keyloggers Spy on Your Computer
Learn how keyloggers capture passwords and private activity, what warning signs to watch for, and practical ways to reduce the risk of computer spying.
How Browser Fingerprinting Tracks You
See how browser fingerprinting can identify and track users without cookies, what information browsers reveal, and which privacy controls can limit tracking.
Why Least Privilege Protects Windows
Learn how standard user accounts, UAC, and application controls limit unnecessary access and reduce what compromised software can do on a Windows PC.
Detect Unwanted Windows App Installs
Learn how to spot software installed without permission, monitor unexpected changes, and reduce the risk from unwanted programs running in the background.
