Any page loaded in IE can track your mouse movements anywhere

http://spider.io/blog/2012/12/internet-explorer-data-leakage/

by nicksdjohnson • 14 years ago

292 161 14 years ago

lini• 14 years ago

Original Bugtraq post for those that are interested: http://seclists.org/bugtraq/2012/Dec/81

benologist• 14 years ago

Interesting that this has been around for so long. What are the ramifications of leaking mouse/ctrl/alt/shift if they don't have any context about what you are clicking on?

jtchang• 14 years ago

Who says they don't have any context?

Off the top of my head I know ingdirect had a virtual pinpad. Combine this with a XSS vulnerability Icould easily send you a link to login to your bank website. The link would then load this type of mouse tracking data.

nl• 14 years ago

The INGDirect virtual pinpad changes the arrangement of the numbers everytime it loads and hides them when you click. That does provide some protection.

Too• 14 years ago

What kind of security by obscurity banks are people using where they have to enter numbers with the mouse to avoid keyloggers and answer to silly questions like my mothers last occupation??!

Any reputable bank will give you a small external card reader with a keypad where you have to insert your smartcard, enter your pin and a punch in the challenge-response code from the website. 2-factor authentication is a solved problem, plus no risk of keyloggers since the device is disconnected from the computer. (Most come with the option of connecting to the computer via usb to save you from manually entering the challenge-response but your pin is always entered on the external keypad.)

DanBC• 14 years ago

As others have said, some clicks are going to be things on a screen-keypad.

The pad can be anywhere on the screen, and it can be in a different place each time, but you'd be able to capture repeated patterns of clicks.

meaty23• 14 years ago

Looking at the holes and crocks of shit we see every damn day related to HTTP, HTML, JavaScript and the whole programming model that surrounds them, it's about time someone just shot it all and started again putting security and privacy first rather than playing whack-a-mole all the time.

Unfortunately I fear this is not possible based on the sheer momentum that this ball of sticky tape and string has.

I think the sheer number of articles that paper HN all the time over browser and protocol vulnerabilities, leaks and problems back up my assertion.

EDIT: just to add, my frustrations are based on having to spend 5 hours porting some JS code so it works properly on all browsers.

davedx• 14 years ago

It's an Internet Explorer vulnerability. Shell level IE exploits are one of the reasons Firefox and Chrome have done so well, because they're more secure. Don't paint every browser with the same brush.

shin_lao• 14 years ago

An interesting statement, which would be more interesting if backed up by facts. All brothers are basically virtual machines running remote code, how could they be secure?

meaty23• 14 years ago

Yes I know but the sheer number of articles aggregated across all browsers point to the architecture of the web being completely flawed.

Consequentially, they're all as bad as each other.

"More secure" is subjective i.e. it's more secure to us public but who the hell knows there aren't 100 zero day's out there in the wild changing hands for thousands of dollars.

r00fus2• 14 years ago

Interesting - would this vulnerability exist when running IE rendering engine through, say IETab or via other browser shells, a la Maxthon?

mattmanser• 14 years ago

Do you know how hard that would be?

It's not momentum, the browser is essentially a universal OS, the holes would still be there if you started again from scratch.

meaty23• 14 years ago

Yes I do know how hard that would be. I didn't say it would be easy.

Actually the browser is a non-universal OS which has several vendor extensions and incompatibilities which poke you in the eye day after day.

It's like the UNIX fragmentation in the 90's (OSF/1=Firefox, HPUX=Chrome, Solaris=IE, UNICOS=Opera).

It's possible to build something without holes. You just have to hire the right people and actually think about it before adding shitty features.

delano• 14 years ago

The world is a lovely, messy place.

J_Darnley2• 14 years ago

Just removing javascript from a browser would cure most ills these days, and not all of them security issues.

paulgb• 14 years ago

Likewise, disabling the internet would do wonders for computer security.

jneen• 14 years ago

Three guidelines for computer security:

1) Don't have a computer

2) Don't turn one on

3) For goodness' sake, don't connect one to a network.

javajosh2• 14 years ago

I see that to other responses have taken the sarcastic route, and I was strongly tempted to join them. Instead, I'm going to control myself and respond to this as if it was serious.

The simple fact is that there is a high demand for interactive applications. One of the best ways to distribute these applications is the web using JavaScript. If, for some reason, this distribution channel were removed (let's say it was removed by law) the demand would still be there, and the 'older' channel still remains - native apps. If the average person uses, say, 20 webapps heavily and a few hundred glancingly, and let's say that 10% of these survive the transition (probably a high figure) that's still a good handful of new native apps, each of them with their own security issues.

lucian1900• 14 years ago

Anything you replace it with will have tons of vulnerabilities as well. Formal verification might help, but that's entirely orthogonal to the programming model.

Sure, it sucks to develop for. But it's not fundamentally impossible to make it secure and private.

derleth2• 14 years ago

> it's about time someone just shot it all and started again putting security and privacy first rather than playing whack-a-mole all the time.

I agree fully. So do the people working on Algol-68, PL/I, Multics, the Canon Cat, Plan 9, and, perhaps most relevant to this, Project Xanadu.

(Esperanto probably deserves a mention here, but it's duking it out somewhere with Volapük, Ido, Interlingua, Loglan, and Lojban.)

meaty23• 14 years ago

I think only the Plan 9 people have got the idea so far.

The problem that has shot us as a race is that in the 1990s, technology became suddenly ubiquitous and whatever was lying around was glued together to fill a niche which took off before people had a chance to think about it and engineer something sound. An analogy perhaps:

http://megaswf.com/s/2529389/

jl6• 14 years ago

This is a tempting option in so many situations, not just software. But it never works because you can never wipe the slate truly clean. The state of the world is dependent on the previous state of the world.

majc2• 14 years ago

Yes, reminds me of this essay from Joel Spolsky: http://www.joelonsoftware.com/articles/fog0000000069.html

79523• 14 years ago

Are you suggesting that there is something uniquely vulnerable about web technologies? Problems occur at every level of the stack from the OS on the client up to the server software. The big advantage of that programming model is how different elements can be loosely coupled. You can fix a problem by swapping individual parts of the stack without changing the experience.

meaty23• 14 years ago

Yes, the data has code in it...

Once that one is out, you're screwed.

That applies to most of computer science ironically.

Yaggo3• 14 years ago

> EDIT: just to add, my frustrations are based on having to spend 5 hours porting some JS code so it works properly on all browsers.

Tells nothing more than someone has written shitty code in the beginning.

meaty23• 14 years ago

Well yes its shitty code that has to work on numerous old shitty browsers.

Yaggo3• 14 years ago

> Looking at the holes and crocks of shit we see every damn day related to HTTP, HTML, JavaScript

Many "browser vulnerabilities" (esp. non-IE) are actually vulnerabilities of Flash, an entirely different [and dying] platform.

ams6110• 14 years ago

The problem is not the technology, it's human nature. There are a certain number of scumbags out there, who will lie, cheat, spy, eavesdrop, backstab, whatever it takes to get something for themselves. This has been going on since we've existed as a species and I see no reason to expect it to ever stop.

meaty23• 14 years ago

And that's more of a reason not to execute code from them isn't it?

dasil0036• 14 years ago

If 20 years ago some clairvoyant genius had foreseen what web applications would become, and decided to create a sane and secure alternative, and by some miracle had managed to pull it off without falling into numerous tarpits owing to an unsinkable combination of intelligence, persistence and vision, it still never would have taken off because it would be too complicated to gain traction compared to the simplicity of HTML.

The key thing you need to wrap your head around is that software ecosystems are not designed; they accrete and evolve organically, and no one has any power to change that.

pjmlp5• 14 years ago

It is called the desktop.

drivebyacct22• 14 years ago

Because inventing something from scratch is a fool-proof way to have bug and exploit free code.

What are you even doing these days that requires "porting JS code"? I haven't had to do that for ages and it was on poorly written JS to begin with.

meaty23• 14 years ago

Changing the fundamentals at the core is what I'd like to see.

This code has to work right down to ie6.

egeozcan• 14 years ago

The limited nature of the environment actually makes it much more secure and I'd guess that IE is not written in JavaScript. =)

happslappy• 14 years ago

This could be used to track entropy of encryption key generation(like trucrypt or, the new MEGA site, any site that employs mouse/key binding for entropy.)

Damn, this is FUBAR!

chris_wot• 14 years ago

I find it particularly inspiring that they turned this into a game. And more inspiring still that folks spent 4 hours playing the game!

scotty793• 14 years ago

It's a shame that before releasing that to the public noone gathered few terabytes of such data and put it up on torrents.

We might learn a lot about how people use computers and UIs with such data.

algorias• 14 years ago

Right, and the affected people's right to privacy be damned...

scotty793• 14 years ago

Yes. But I think the data would be also useful if you don't include IP address. This should limit the damage to acceptable levels.

r00fus2• 14 years ago

Ignoring the keypresses (to prevent inadvertent credential sharing), and just doing mouseclick heatmaps while anonymizing the IPs involved and sites visited would be interesting (you'd want to keep screen size/browser.version data, for an understanding of what the heatmaps represent).

Would provide lots of info without compromising much details.

ygra5• 14 years ago

You'd get only mouse move events, no clicks.

ZoFreX3• 14 years ago

How would it provide lots of info? Without any data on which program they were interacting with at the time, I'd have thought data on the mouse movements would be fairly useless?

alexjeffrey2• 14 years ago

While this seems like something that Microsoft should fix as a matter of urgency, I don't believe the problem is as severe as is being portrayed.

In order to get any meaningful information from this attack, you would need to know what application/website the user is currently using (or send them to it), where it's positioned on the screen and the exact layout of the subject. The interface would also have to be either mouse- or meta-key driven, which isn't a common facet for sensitive inputs (passwords, bank transfers, and private messages off the top of my head).

ch0wn• 14 years ago

I guess it shouldn't be too hard to create an algorithm that maps the movements to potential numbers on a visual type pad. Once you have the numbers, you just need to match them to patterns which could be cc numbers, phone numbers, bank accounts and so on. You just need to collect enough to find some useful data.

njr123• 14 years ago

As they mention in the article, if the user is using an onscreen keyboard, then the trace essentially amounts to a keylog. And since on screen keyboard usage would have very distinctive patterns, if you had a large enough dataset, you should be able to extract those logs relatively easily.

slashdotdash• 14 years ago

Has anyone tried this with Microsoft's Surface tablet to find out whether the on-screen keyboard can be tracked?

ygra5• 14 years ago

I guess the on-screen keyboard when used with a finger won't yield any mouse move events.

davidjgraph• 14 years ago

Whether it's common or not isn't the issue, it's whether it's done at _all_ by banks and suchlike.

My bank on their online site asks for my account number, a memorable piece of data and a 6 digit passnumber that they generate (and I can't change). The passnumber is entered using pull-down menus for each digit, always ordered 0-9.

So, no, an attacker wouldn't have access to all the information they need, but they'd certainly have access to more than they should, in this case, if they're able to take advantage of this, that is.

And it's not just for general users, some sites do often additional functionality in this field for users with accessibility requirements (large on-screen number pads, etc).

So, yes, I'm sure the % of affected sites is low, but just 1 bank whose online system is comprised by this is 1 bank too many.

Even if mouse position tracking is permitted, it should clearly be limited to the current tab. Cross-tab, and certainly, cross-application is just clearly wrong.

alexjeffrey2• 14 years ago

agreed, which is why Microsoft should be held to account for not prioritising fixing this problem. However, I felt that the portrayal of this particular hole in the linked article made it out to be more than it is.

colkassad• 14 years ago

>The vulnerability is already being exploited by at least two display ad analytics companies across billions of page impressions per month.

Who are these companies?

38254• 14 years ago

Name no names please. Don't want a witch hunt when we are in a glass house.

javajosh2• 14 years ago

Honestly, I don't understand this reluctance to name wrongdoers, especially for something like this where verifying the wrong is trivial (e.g. load up a client site and find the offending code in source).

It seems to me that the harm is greater not naming names - reputation is important and if you take steps to invade user's privacy then your reputation can and should suffer for it.

saraid2162• 14 years ago

My first thought on reading this was, "Ah. 3825 works for one of them."

mtgx• 14 years ago

So much for Microsoft's automatic Do Not Track. It seems users are less safe, not more with IE, from ad companies.

Already__Taken• 14 years ago

Do Not Track was always a sham.

It's a symbolic flag to respect users preferences or browser vendors are going to make ad-block standard by default just like pop-up blockers.

If ad companies ignore DNT they are digging their own graves.

It's not about protecting users. It's about heading off an arms race to help protect the ad industry.

wahsd• 14 years ago

Kind of ironic considering Windows 8 visual/swipe password feature. Which, in general, is quite novel and interesting, albeit not very secure for various other reasons.

snarfy• 14 years ago

The proof-of-concept should be a page that tracks the swipes and can then log in on Windows 8. I bet then Microsoft would prioritize fixing it.

ygra5• 14 years ago

It cannot. The log-on gesture is made on a completely different desktop under a completely different user account. If that worked then Microsoft would have a much more severe problem to fix.

abdophoto• 14 years ago

Freaking IE. I hate that damn browser

alpb2• 14 years ago

This is not correct. When I run it on IE, first it asks permission to run ActiveX controls on my browser, which I don't allow if I trust.

Then of course, it is just like Flash, it can track your mouse.

jey• 14 years ago

Where in the exploit HTML + JS is the ActiveX component being invoked from?

blahpro3• 14 years ago

This is probably related to the YouTube video embed on the demo page, which I believe uses Flash. The mouse tracking itself is entirely JavaScript.

Edit: I am one of the authors of the demo code included in the disclosure.

wlesieutre• 14 years ago

I received no ActiveX warning with Windows 7 and IE9. What version are you running?

alpb2• 14 years ago

IE10.

navneetpandey• 14 years ago

I have no problem at all, whether they track mouse movement or anything else.

You know why? because I use Chrome.

rossc1• 14 years ago

Is there any, any whatsoever, evidence to say that this exploit has ever been exploited?

It seems far fetched. And if your using a virtual keyboard for security... you'd be using IE? C'mon now.

bonjourmr• 14 years ago

This should scare customers whose bank uses a login system such as this, correct? https://online.westpac.com.au/esis/Login/SrvPage?referrer=ht...

goggles99• 14 years ago

This is so low risk, why even bother posting it? Zero days come out every month or two with far better attack vectors. Criminals are not going to waste their time with this rubbish.

blahpro3• 14 years ago

Just to point out how ridiculous this is: you can get mouse position information from any event (fired programatically using fireEvent or otherwise). You can even get it from the "onbounce" event on <marquee> elements, for goodness’ sake.

Any page loaded in IE can track your mouse movements anywhere

Related Stories