When File Watchers Become Spies: The Metadata Leak Hiding in Plain Sight

Security teams often harden what files contain. The harder question is what the operating system reveals while those files are changing. File-notification APIs are built for sync tools, editors, backups, and monitoring, but they can also become a quiet surveillance layer: a stream of events that hints at what a user is doing, when they are doing it, and sometimes which applications or devices are involved.

Fast Facts

• File-notification systems on Linux, Windows, and macOS can leak behavioral metadata through event timing and scope.
• The research class described can infer activity such as keystroke timing, website visits, USB use, VPN changes, and printing patterns.
• Administrative privileges may not be required if an attacker can observe the relevant directories or notification stream.
• Windows has a mitigation for one disclosure path, but administrators may need to enable it explicitly.
• Android uses a similar event-driven model through FileObserver, which makes the broader design pattern relevant beyond desktop systems.

The leak is not the file - it is the trace around it

At the technical level, this is a metadata side channel. The attacker is not breaking encryption or opening protected documents. Instead, the attacker watches filesystem events and uses timing, filenames, and directory activity as clues. On Linux, inotify can report changes inside watched directories. On Windows, directory-change notifications can expose information tied to the parent folder. On macOS, FSEvents emits directory-level change signals that can still reveal useful patterns. Android’s FileObserver follows the same general event-driven idea.

That matters because human activity is often repetitive. Typing, opening apps, inserting a USB device, changing network state, or visiting a website can all leave an event pattern behind. Inference does not need perfect visibility to be useful. A partial signal can still narrow down what a user is doing, especially when combined with predictable application behavior.

The practical risk is broader than one bug in one product. It shows how convenience features can become intelligence leaks when permission checks, directory scope, or event granularity are too generous. The available information supports a risk analysis, not a definitive claim that every platform leaks the same way or with the same strength.

Why defenders should care

Side-channel exposure changes the threat model for endpoint security. A process may be blocked from reading a file, yet still learn enough from notification traffic to profile the user. That can support follow-on abuse such as behavioral reconnaissance, workstation fingerprinting, or timing-based inference attacks. It also complicates the assumption that content controls alone are sufficient.

Defensive pressure should focus on directory access, watcher scope, and OS-level permission boundaries. Sensitive trees should not sit in broadly observable parent directories. Monitoring agents should be reviewed for excess directory reach. And where vendors provide fixes or permission checks, they need to be evaluated, enabled, and kept current.

Conclusion

The lesson is blunt: a system can lock down the document and still leak the story around it. File-notification APIs are useful, but they also prove that metadata is not harmless by default. In modern endpoint defense, the quiet signals deserve as much attention as the content itself.

WIKICROOK

• Side channel: An indirect way to learn information from timing, patterns, or other signals rather than from direct access to data.
• File-notification API: An operating system interface that reports when files or directories change.
• Metadata: Information about data, such as names, timestamps, paths, or event patterns, rather than the file contents.
• inotify: A Linux kernel mechanism for watching file and directory events.
• FSEvents: Apple’s macOS filesystem event system for directory-level change notifications.