Microsoft responds to IE mouse tracking vulnerability

http://blogs.msdn.com/b/ie/archive/2012/12/13/update-to-alleged-information-and-security-issue-with-mouse-position-behavior.aspx

by alt_ • 14 years ago

32 47 14 years ago

blogs.msdn.com

magnetikonline• 14 years ago

Heh, happy to note that "There are similar capabilities available in other browsers" - but then nicely ignores the fact that the crux of this issue is mouse position can be read even when mouse is out of browser window focus.

kevingadd7• 14 years ago

It has yet to be conclusively proven that this information presents a real risk to anyone's privacy. It would certainly be nice to fix (and you can observe from the post that MS is not opposed to fixing it) but it is hardly a crisis.

chris_wot5• 14 years ago

I'm hoping it won't be conclusively proven, because by definition the proof will be an exploit in the wild.

kevingadd7• 14 years ago

I find Microsoft's explanation of the facts to be quite logical. How many users are actually going to interact with an onscreen keyboard using the mouse cursor? It's already been stated that the supposed exploit doesn't affect the touch keyboard on Win8.

chris_wot5• 14 years ago

As has been pointed out, at least one bank has a mouse controlled pin keyboard.

meaty• 14 years ago

Someone needs to fire their UI guys

kevingadd7• 14 years ago

Are you seriously suggesting that given nothing other than a small window into mouse position and modifier keys (the latter would be useless for a mouse controlled pin keyboard), an attacker would be able to not only identify when the user clicks, but when they're visiting the bank and the alignment of the pin keyboard? And then somehow leverage this information by itself to attack someone without having any of their other personal information?

It is certainly information that COULD be useful as part of an attack, but it seems utterly ridiculous that just mouse information would somehow enable you to compromise the security of someone's bank account.

Private information should certainly remain private, and I don't doubt that this leakage will be fixed one way or another, but this really seems more like paranoia than anything else unless there's at least a concrete description of how the data provided is enough to actually inflict harm. Lots of potentially useful data is exposed by browsers (and browser plugins) every day; this isn't the only bit.

to3m3• 14 years ago

The layout of the PIN keyboard at my last bank was randomized for each logon. I always thought this paranoid, but it's now looking prescient...

desas• 14 years ago

ING Direct in the UK randomise the position of the keys on the keyboard for each login attempt.

chris_wot5• 14 years ago

Getting all the pieces to line up in order to take advantage of this behavior – serving an ad to a site that asks for a logon, the user using an on screen (or virtual) keyboard, knowing how that onscreen keyboard works – is hard to imagine.

ORLY? The imagination of a Microsoft engineer quite clearly is no equal to the imagination of a creative exploiter. After all, nobody could imagine the Morris Worm, or Word Macro viruses, or even SQL Slammer.

Attacks come through exploitable vectors. Lining up those exploitable vectors may seem tricky, but that hasn't stopped this from happening. And frankly, this particular attack vector seems to be one of the more exploitable ones.

mattmanser• 14 years ago

I don't agree at all.

It's an x, y position, what possible use is it? Two integers.

MS are right about this, this is just spider.io being alarmist for free publicity.

ambrop7• 14 years ago

So you're saying if you were given a mouse movement trace on top of a virtual keyboard, you couldn't possibly deduce what was typed?

Someone should just make a program that does that, and this will all be settled. Maybe even make it guess what kind of virtual keyboard was used.

flixic• 14 years ago

If password is sufficiently long, x and y coordinates are all what is needed to deduce keyboard coordinates, button size and then, password.

ch0wn• 14 years ago

They seem to have never seen terminal PCs. I know a couple of places in my city where you have IE-based kiosk terminals with touch-on-screen keyboards that emulate a cursor. It should be even much easier to map mouse movement to actual inputs as the emulated cursor "jumps" from key to key during input.

nmcfarl• 14 years ago

My recollection is that those PCs don't allow background windows. And this attack works in all browsers for the foreground window.

wglb2• 14 years ago

That is admittedly a weak part of their response, but to their credit in the previous sentence they say We take these risks very seriously.

Aardwolf2• 14 years ago

Saying is not doing.

marcosdumay• 14 years ago

The entire buleting stands for:

"We take these risks very seriously. We analised it, and concluded that we shouldn't take this risk seriously."

RoryH• 14 years ago

'Redmond is (still) evil' it seems :-)

dchest3• 14 years ago

Why the hell they issue statements instead of patches? Is it hard to fix? If yes, let us know. If no, just fix it.

kevingadd7• 14 years ago

Microsoft cannot issue patches instantly. They have to go through testing.

dchest3• 14 years ago

The issue was reported in October.

"Whilst the Microsoft Security Research Center has acknowledged the vulnerability in Internet Explorer, they have also stated that there are no immediate plans to patch this vulnerability in existing versions of the browser."

http://spider.io/blog/2012/12/internet-explorer-data-leakage...

So, instead of fixing it:

- receive vulnerability report

- don't fix it and wait until there's PR disaster

- issue statement that now "we're working actively to fix it"

- [future] fix the issue

My question, again -- why the hell they didn't fix it in the first place? Why go though this? Do you have to be a psychic to figure out that any Microsoft's non-response to vulnerability (even if its effect is overblown) is a PR disaster?

pyxy• 14 years ago

My guess is that Microsoft might get profit from this "feature". They don't think it's a bug or a vulnerability, it's just a "tool" they may provide to thirdparties. They must be annoyed by all those crying nerds.

mtgx• 14 years ago

I have the feeling Windows 8 will become a better attack target than Windows 7 was, because of all the new (and exploitable) stuff Microsoft introduced through the Metro stuff and through the Windows store, that are still very much untested.

culshaw• 14 years ago

Whoever Gillian is, she just rocked my world with that comment.

frontsideair• 14 years ago

Those pesky spokespeople. Microsoft should fire them all, they're damaging the already damaged Microsoft image. Just take a look at this statement:

"There are similar capabilities available in other browsers. Analytics firms can expect to do viewpoint detection in IE similarly to how they do this in other browsers."

Aren't they just throwing their hands up in defense and telling us "We're not the only ones! Everyone else is doing it too!" That's slimy.

to3m3• 14 years ago

I'm sure most spokespeople are fine. This one is not. The same information could have been much better presented. A skilled spokesperson could have performed just as much arse-covering and justification, and just as little apology, without coming across like such a petulant whinger ;)

Really, it sounds more like something one might write on an internal mailing list than a message intended for general consumption. Rolling your eyes about seemingly overblown theoretical worries is fine, but one should be a bit more contrite in public.

abcd_f• 14 years ago

> damaged Microsoft image

I think you are stuck in the past. Microsoft has dramatically improved the security of their system. I've been using Windows as my primary OS since 3.11 days, and I hated Microsoft guts for cutting corners and shipping crap. Not anymore. They really pulled their act together in last couple of years. From Windows Updates, to mitigation tools like EMET, to much improved MSDN documentation - I really can't be believe that I'm saying this - they did a great job. So please if you feel like bashing M$, there's a dedicated website for that... it's called Slashdot :)

omgtehlion• 14 years ago

> dramatically improved the security of their system

yes they did, but their perceived image is still badly damaged

crististm• 14 years ago

Nothing to see here; move along...

Interesting wording of the message. Microsoft tries to lead the attention from the real problem to an analytics company that can't stand the heat of competition.

We learn something new every day.

blahpro• 14 years ago

To highlight the ridiculousness of this vulnerability: you don't even need to use `fireEvent("onmousemove")` to gain access to this information. You can use events that have absolutely nothing to do with the mouse, such as onbounce* on a hidden <marquee> element (seriously).

* "Fires when the behavior property of the marquee object is set to "alternate" and the contents of the marquee reach one side of the window." -- http://msdn.microsoft.com/en-us/library/ie/ms536910(v=vs.85)...

Microsoft responds to IE mouse tracking vulnerability

Related Stories