Menu
Microsoft: We're working to 'adjust' IE's mouse tracking

Microsoft: We're working to 'adjust' IE's mouse tracking

U.K. analytics firm returns fire Friday, alleges Microsoft downplays the security, privacy threat

A U.K. analytics firm that warned earlier this week of an information leak in Internet Explorer (IE) today rebuked Microsoft for downplaying the bug.

Microsoft, however, has announced it is working on a fix, although the nature of the anticipated patch was unclear.

Spider.io, a company that provides metrics to online advertisers, claimed on Wednesday that all versions of IE can be manipulated via JavaScript to reveal the position and movement of the mouse cursor on the screen, even when the JavaScript code is on an inactive tab, or when IE itself is inactive or even minimized to the taskbar.

Criminals could use the technique, Spider.io alleged, to monitor mouse movements used to log into sensitive websites with "virtual keyboards," on-screen keyboards similar to those on smartphones. Some websites, notably a few banking sites, rely on virtual keyboards as a way to stymie the far-more-common malware that captures keystrokes from a physical keyboard.

Yesterday, Microsoft downplayed the threat, noting -- as Spider.io had also charged -- that only a pair of advertising analytics companies have taken advantage of the bug. Those firms, said Spider.io, monitor cursor movement to track whether an ad is visible to the user, or whether it is hidden because the web page is larger than the viewing area of the browser.

Spider.io relies on its own technology to determine what proportion of the ad is visible. The technique, which Spider.io CEO Douglas de Jager labeled "browser optimization" in an October interview, watches how a browser allocates resources to render an ad.

The U.K. firm posted a message on Bugtraq, one of the most popular security mailing lists, on Tuesday, then followed that with a blog post Wednesday, recounting how it reported the bug to Microsoft on Oct. 1, but was later told by Microsoft that the Redmond, Wash. developer had no plans to fix the flaw.

Microsoft's top executive for IE, Dean Hachamovitch, took to a company blog Thursday to counter Spider.io's claims.

Hachamovitch downplayed the threat to Windows users, and said that Spider.io's report was motivated more by spite than by concerns over security. "From what we know now, the underlying issue has more to do with competition between analytics companies than consumer safety or privacy," said Hachamovitch. "The only reported active use of this behavior involves competitors to Spider.io providing analytics."

However, Hachamovitch did promise that Microsoft was on the case. "We are actively working to adjust this behavior in IE," he said.

The "adjustment," he said, would bring IE into line with other browsers' behavior. "Analytics firms can expect to do viewpoint detection in IE similarly to how they do this in other browsers."

Ad visibility can be monitored in other browsers, such as Chrome and Safari, with different techniques, but those work only when the tracking code has been placed on the same page as the ad, and when the ad originates from the same domain as the Web page's content.

In other words, ad analytics companies would not be able to "game" IE to get more information than they would get from a competing browser.

In a Friday rebuttal of Hachamovitch, de Jager added more to the debate. He did not address Hachamovitch's allegation that competition drove the bug's disclosure, however, or respond to Computerworld's questions on the topic.

Instead, de Jager took Microsoft to task for refusing to address the problem, even though that had been made moot by Hachamovitch's statement that Microsoft is working on a fix of some kind.

"It isn't for Microsoft and the various companies currently exploiting the vulnerability to decree unilaterally that this vulnerability is not important enough to fix," said de Jager. "According to existing privacy standards, it is not OK for a browser to leak your mouse coordinates outside of the particular browser window." De Jager suggested that the decision should be put in the hands of privacy experts.

He also blasted Hachamovitch for minimizing the threat with language such as "theoretical" and "very little risk to consumers."

"Ads do not need to be served to sites requiring login details," said de Jager. "Ads need only to be served to some page which is open in Internet Explorer."

Hachamovitch had pointed out that there was no reliable way for an attacker to know what was beneath the mouse cursor at any given point, and so criminals would be unlikely to figure out which mouse movements were, for instance, related to a virtual keyboard. At one point, Hachamovitch said it was "hard to imagine" how attackers could put all the necessary pieces together to pull off the theft of virtual keyboard entries.

De Jager did not address that aspect of Hachamovitch's rebuttal, or reply to questions about how the IE bug might be exploited in real-world attacks.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed. His email address is gkeizer@computerworld.com.

See more by Gregg Keizer on Computerworld.com.

Read more about malware and vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.

Follow Us

Join the ARN newsletter!

Error: Please check your email address.

Tags MicrosoftWindowssoftwareMalware and Vulnerabilitiesoperating systems

Upcoming

Slideshows

IN PICTURES: Nutanix's .NEXT channel event in Sydney (+20 photos)

IN PICTURES: Nutanix's .NEXT channel event in Sydney (+20 photos)

Nutanix recently held its customer and channel event, .NEXT, in Sydney. The event, held at the Sheraton on the Park saw attendance from more than 150 channel and technology partners and customers. It was the first in a series of events Nutanix is holding in A/NZ in August and September, the objective of which is to brief partners and customers on “what’s next” in the design and management of datacentre technology.

IN PICTURES: Nutanix's .NEXT channel event in Sydney (+20 photos)
IN PICTURES: EDGE 2015 sponsor debrief (+23 photos)

IN PICTURES: EDGE 2015 sponsor debrief (+23 photos)

Some of the sponsors of ARN's inaugural EDGE 2015 event got together at the ARN office for a debrieef of the event. Over some drinks and cheese, these attendees got an update on some key statistics that arose from the EDGE event and discussed potential topics and improvements that can be made at next year's event.

IN PICTURES: EDGE 2015 sponsor debrief (+23 photos)
IN PICTURES: ARN Distributor Roundtable, Sydney, 26.08.15 (+26 photos)

IN PICTURES: ARN Distributor Roundtable, Sydney, 26.08.15 (+26 photos)

ARN hosted a distributor roundtable at Cafe Del Mar in Sydney, at which attendees and their partners discussed the changing role of the traditional IT distributor. They spoke about the challenges of digital disruption, the blurring lines of the channel in the age of digital transformation, and examined the ever-evolving business models. This roundtable was sponsored by Distribution Central, Exclusive Networks, Rhipe, and Hemisphere Technologies. Photos by ARN Editorial Director, Mike Gee.

IN PICTURES: ARN Distributor Roundtable, Sydney, 26.08.15 (+26 photos)

iasset.com is a channel management ecosystem that automates all major aspects of the entire sales, marketing and service process, including data tracking, integrated learning, knowledge management and product lifecycle management.

Show Comments