Feeds

Microsoft: IE mouse tracking vuln no big deal. Sort of...

Will fix it anyway. Probably...

The Essential Guide to IT Transformation

Microsoft has dismissed allegations that Internet Explorer can allow attackers to track the position of the user's mouse cursor, arguing that the original report was self-serving and that the observed behavior does not represent a credible threat.

"From what we know now, the underlying issue has more to do with competition between analytics companies than consumer safety or privacy," Dean Hachamovitch, corporate VP of Microsoft's Internet Explorer group, said in a blog post.

On Wednesday, web analytics company Spider.io disclosed a method by which hackers can use just a few lines of JavaScript code to monitor and record the position of the user's cursor whenever IE is running, even when the browser window is inactive or minimized.

The company said the alleged vulnerability is present in IE versions 6 through 10, and that although it had disclosed the threat privately to the Microsoft Security Research Center, Redmond had said it had "no immediate plans" to issue a patch.

"The vulnerability is already being exploited by at least two display ad analytics companies across billions of page impressions per month," Spider.io said.

But on Thursday, Hachamovitch argued that Spider.io was only concerned about what these web analytics companies were allegedly doing because Spider.io is itself a web analytics company, and that its complaints, purportedly on behalf of users, were really motivated by commercial concerns.

"The only reported active use of this behavior involves competitors to Spider.io providing analytics," Hachamovitch wrote.

In its initial report, Spider.io claimed that by recording the movement of a user's mouse cursor on the screen, attackers could potentially monitor what users type into onscreen keyboards and virtual keypads, allowing them to record passwords and other sensitive data.

Unlikely, Hachamovitch said.

"Getting all the pieces to line up in order to take advantage of this behavior – serving an ad to a site that asks for a logon, the user using an on screen (or virtual) keyboard, knowing how that onscreen keyboard works – is hard to imagine," he wrote. "From our conversations with security researchers across the industry, we see very little risk to consumers at this time."

In a separate blog post on Friday, Spider.io said, "We do not feel at all comfortable participating in this public debate." But they went ahead anyway.

"According to existing privacy standards, it is not ok for a browser to leak your mouse co-ordinates outside of the particular browser window," company reps wrote. "Should Microsoft fix this bug? This is a matter for the public to decide – in particular, it's a matter for the privacy experts."

Curiously enough, however, the second paragraph of Hachamovitch's blog post begins with a rather germane sentence: "We are actively working to adjust this behavior in IE." ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Tor attack nodes RIPPED MASKS off users for 6 MONTHS
Traffic confirmation attack bared users' privates - but to whom?
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.