In this paper, we show that such seemingly minor information leaks can have more serious consequences than the system designer thought. We present a new at- tack in which a malicious user can eavesdrop on others’ keystrokes using nothing but her non-privileged account. Our attack takes advantage of the information disclosed by procfs [19], the process file system supported by most Unix-like operating systems such as Linux, BSD, Solaris and IBM AIX. Procfs contains a hierarchy of virtual files that describe the current kernel state, including statistical information about the memory of processes and some of their register values. These files are used by the programs like ps and top to collect.
