Feeds

Microsoft: IE mouse tracking vuln no big deal. Sort of...

Will fix it anyway. Probably...

Internet Security Threat Report 2014

Microsoft has dismissed allegations that Internet Explorer can allow attackers to track the position of the user's mouse cursor, arguing that the original report was self-serving and that the observed behavior does not represent a credible threat.

"From what we know now, the underlying issue has more to do with competition between analytics companies than consumer safety or privacy," Dean Hachamovitch, corporate VP of Microsoft's Internet Explorer group, said in a blog post.

On Wednesday, web analytics company Spider.io disclosed a method by which hackers can use just a few lines of JavaScript code to monitor and record the position of the user's cursor whenever IE is running, even when the browser window is inactive or minimized.

The company said the alleged vulnerability is present in IE versions 6 through 10, and that although it had disclosed the threat privately to the Microsoft Security Research Center, Redmond had said it had "no immediate plans" to issue a patch.

"The vulnerability is already being exploited by at least two display ad analytics companies across billions of page impressions per month," Spider.io said.

But on Thursday, Hachamovitch argued that Spider.io was only concerned about what these web analytics companies were allegedly doing because Spider.io is itself a web analytics company, and that its complaints, purportedly on behalf of users, were really motivated by commercial concerns.

"The only reported active use of this behavior involves competitors to Spider.io providing analytics," Hachamovitch wrote.

In its initial report, Spider.io claimed that by recording the movement of a user's mouse cursor on the screen, attackers could potentially monitor what users type into onscreen keyboards and virtual keypads, allowing them to record passwords and other sensitive data.

Unlikely, Hachamovitch said.

"Getting all the pieces to line up in order to take advantage of this behavior – serving an ad to a site that asks for a logon, the user using an on screen (or virtual) keyboard, knowing how that onscreen keyboard works – is hard to imagine," he wrote. "From our conversations with security researchers across the industry, we see very little risk to consumers at this time."

In a separate blog post on Friday, Spider.io said, "We do not feel at all comfortable participating in this public debate." But they went ahead anyway.

"According to existing privacy standards, it is not ok for a browser to leak your mouse co-ordinates outside of the particular browser window," company reps wrote. "Should Microsoft fix this bug? This is a matter for the public to decide – in particular, it's a matter for the privacy experts."

Curiously enough, however, the second paragraph of Hachamovitch's blog post begins with a rather germane sentence: "We are actively working to adjust this behavior in IE." ®

Remote control for virtualized desktops

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Seattle children’s accelerates Citrix login times by 500% with cross-tier insight
Seattle Children’s is a leading research hospital with a large and growing Citrix XenDesktop deployment. See how they used ExtraHop to accelerate launch times.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?