Sudheendra Raghav Neela, a member of a group of researchers from Graz University
of Technology, has announced the
release of research into file-notification attacks that would allow spying on
user activity on Android, Linux, macOS, and Windows. The group has published a
paper with
details on the research as well as a web site
with demonstrations of the vulnerabilities.

On Linux, an attacker can use inotifywatch to
monitor a directory to conduct an inter-keystroke timing attack-even if
they do not have read access to the files within a directory. The group also
discovered a method to conduct a UI-redress
attack (or "clickjacking" attack) on
KDE�5 and KDE�6 by monitoring /usr/bin/pkexec to detect when Polkit spawns an
authentication
prompt. An attacker could draw a fake password window on top of the real window
to collect a user's credentials.

Both of these flaws are still present today,
though the Linux kernel did partially mitigate the issue with a
fix that was included in the 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.65,
and 6.18.3 kernels shipped in January. See the web site for more information and
a mitigation to prevent password-prompt windows from losing focus.

https://lwn.net/Articles/1096431/
--- SBBSecho 3.37-Linux
 * Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)