Feeds

Microsoft: IE mouse tracking vuln no big deal. Sort of...

Will fix it anyway. Probably...

Boost IT visibility and business value

Microsoft has dismissed allegations that Internet Explorer can allow attackers to track the position of the user's mouse cursor, arguing that the original report was self-serving and that the observed behavior does not represent a credible threat.

"From what we know now, the underlying issue has more to do with competition between analytics companies than consumer safety or privacy," Dean Hachamovitch, corporate VP of Microsoft's Internet Explorer group, said in a blog post.

On Wednesday, web analytics company Spider.io disclosed a method by which hackers can use just a few lines of JavaScript code to monitor and record the position of the user's cursor whenever IE is running, even when the browser window is inactive or minimized.

The company said the alleged vulnerability is present in IE versions 6 through 10, and that although it had disclosed the threat privately to the Microsoft Security Research Center, Redmond had said it had "no immediate plans" to issue a patch.

"The vulnerability is already being exploited by at least two display ad analytics companies across billions of page impressions per month," Spider.io said.

But on Thursday, Hachamovitch argued that Spider.io was only concerned about what these web analytics companies were allegedly doing because Spider.io is itself a web analytics company, and that its complaints, purportedly on behalf of users, were really motivated by commercial concerns.

"The only reported active use of this behavior involves competitors to Spider.io providing analytics," Hachamovitch wrote.

In its initial report, Spider.io claimed that by recording the movement of a user's mouse cursor on the screen, attackers could potentially monitor what users type into onscreen keyboards and virtual keypads, allowing them to record passwords and other sensitive data.

Unlikely, Hachamovitch said.

"Getting all the pieces to line up in order to take advantage of this behavior – serving an ad to a site that asks for a logon, the user using an on screen (or virtual) keyboard, knowing how that onscreen keyboard works – is hard to imagine," he wrote. "From our conversations with security researchers across the industry, we see very little risk to consumers at this time."

In a separate blog post on Friday, Spider.io said, "We do not feel at all comfortable participating in this public debate." But they went ahead anyway.

"According to existing privacy standards, it is not ok for a browser to leak your mouse co-ordinates outside of the particular browser window," company reps wrote. "Should Microsoft fix this bug? This is a matter for the public to decide – in particular, it's a matter for the privacy experts."

Curiously enough, however, the second paragraph of Hachamovitch's blog post begins with a rather germane sentence: "We are actively working to adjust this behavior in IE." ®

Gartner critical capabilities for enterprise endpoint backup

More from The Register

next story
Microsoft: We plan to CLEAN UP this here Windows Store town
Paid-for apps that provide free downloads? Really
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Hear ye, young cyber warriors of the realm: GCHQ wants you
Get involved, get a job and then never discuss work ever again
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
BYOD's dark side: Data protection
An endpoint data protection solution that adds value to the user and the organization so it can protect itself from data loss as well as leverage corporate data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?