Feeds

Microsoft: IE mouse tracking vuln no big deal. Sort of...

Will fix it anyway. Probably...

Next gen security for virtualised datacentres

Microsoft has dismissed allegations that Internet Explorer can allow attackers to track the position of the user's mouse cursor, arguing that the original report was self-serving and that the observed behavior does not represent a credible threat.

"From what we know now, the underlying issue has more to do with competition between analytics companies than consumer safety or privacy," Dean Hachamovitch, corporate VP of Microsoft's Internet Explorer group, said in a blog post.

On Wednesday, web analytics company Spider.io disclosed a method by which hackers can use just a few lines of JavaScript code to monitor and record the position of the user's cursor whenever IE is running, even when the browser window is inactive or minimized.

The company said the alleged vulnerability is present in IE versions 6 through 10, and that although it had disclosed the threat privately to the Microsoft Security Research Center, Redmond had said it had "no immediate plans" to issue a patch.

"The vulnerability is already being exploited by at least two display ad analytics companies across billions of page impressions per month," Spider.io said.

But on Thursday, Hachamovitch argued that Spider.io was only concerned about what these web analytics companies were allegedly doing because Spider.io is itself a web analytics company, and that its complaints, purportedly on behalf of users, were really motivated by commercial concerns.

"The only reported active use of this behavior involves competitors to Spider.io providing analytics," Hachamovitch wrote.

In its initial report, Spider.io claimed that by recording the movement of a user's mouse cursor on the screen, attackers could potentially monitor what users type into onscreen keyboards and virtual keypads, allowing them to record passwords and other sensitive data.

Unlikely, Hachamovitch said.

"Getting all the pieces to line up in order to take advantage of this behavior – serving an ad to a site that asks for a logon, the user using an on screen (or virtual) keyboard, knowing how that onscreen keyboard works – is hard to imagine," he wrote. "From our conversations with security researchers across the industry, we see very little risk to consumers at this time."

In a separate blog post on Friday, Spider.io said, "We do not feel at all comfortable participating in this public debate." But they went ahead anyway.

"According to existing privacy standards, it is not ok for a browser to leak your mouse co-ordinates outside of the particular browser window," company reps wrote. "Should Microsoft fix this bug? This is a matter for the public to decide – in particular, it's a matter for the privacy experts."

Curiously enough, however, the second paragraph of Hachamovitch's blog post begins with a rather germane sentence: "We are actively working to adjust this behavior in IE." ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.