Any page loaded in IE can track your mouse movements anywhere

[colkassad]

>The vulnerability is already being exploited by at least two display ad analytics companies across billions of page impressions per month.

Who are these companies?

[mtgx]

So much for Microsoft's automatic Do Not Track. It seems users are less safe, not more with IE, from ad companies.

[3825]

Name no names please. Don't want a witch hunt when we are in a glass house.

[lini]

Original Bugtraq post for those that are interested: http://seclists.org/bugtraq/2012/Dec/81

[chris_wot]

I find it particularly inspiring that they turned this into a game. And more inspiring still that folks spent 4 hours playing the game!

[happslappy]

This could be used to track entropy of encryption key generation(like trucrypt or, the new MEGA site, any site that employs mouse/key binding for entropy.)

Damn, this is FUBAR!

[alexjeffrey]

While this seems like something that Microsoft should fix as a matter of urgency, I don't believe the problem is as severe as is being portrayed.

In order to get any meaningful information from this attack, you would need to know what application/website the user is currently using (or send them to it), where it's positioned on the screen and the exact layout of the subject. The interface would also have to be either mouse- or meta-key driven, which isn't a common facet for sensitive inputs (passwords, bank transfers, and private messages off the top of my head).

[njr123]

As they mention in the article, if the user is using an onscreen keyboard, then the trace essentially amounts to a keylog. And since on screen keyboard usage would have very distinctive patterns, if you had a large enough dataset, you should be able to extract those logs relatively easily.

[ch0wn]

I guess it shouldn't be too hard to create an algorithm that maps the movements to potential numbers on a visual type pad. Once you have the numbers, you just need to match them to patterns which could be cc numbers, phone numbers, bank accounts and so on. You just need to collect enough to find some useful data.

[davidjgraph]

Whether it's common or not isn't the issue, it's whether it's done at _all_ by banks and suchlike.

My bank on their online site asks for my account number, a memorable piece of data and a 6 digit passnumber that they generate (and I can't change). The passnumber is entered using pull-down menus for each digit, always ordered 0-9.

So, no, an attacker wouldn't have access to all the information they need, but they'd certainly have access to more than they should, in this case, if they're able to take advantage of this, that is.

And it's not just for general users, some sites do often additional functionality in this field for users with accessibility requirements (large on-screen number pads, etc).

So, yes, I'm sure the % of affected sites is low, but just 1 bank whose online system is comprised by this is 1 bank too many.

Even if mouse position tracking is permitted, it should clearly be limited to the current tab. Cross-tab, and certainly, cross-application is just clearly wrong.

[slashdotdash]

Has anyone tried this with Microsoft's Surface tablet to find out whether the on-screen keyboard can be tracked?

[scotty79]

It's a shame that before releasing that to the public noone gathered few terabytes of such data and put it up on torrents.

We might learn a lot about how people use computers and UIs with such data.

[algorias]

Right, and the affected people's right to privacy be damned...

[r00fus]

Ignoring the keypresses (to prevent inadvertent credential sharing), and just doing mouseclick heatmaps while anonymizing the IPs involved and sites visited would be interesting (you'd want to keep screen size/browser.version data, for an understanding of what the heatmaps represent).

Would provide lots of info without compromising much details.

[benologist]

Interesting that this has been around for so long. What are the ramifications of leaking mouse/ctrl/alt/shift if they don't have any context about what you are clicking on?

[jtchang]

Who says they don't have any context?

Off the top of my head I know ingdirect had a virtual pinpad. Combine this with a XSS vulnerability Icould easily send you a link to login to your bank website. The link would then load this type of mouse tracking data.

[DanBC]

As others have said, some clicks are going to be things on a screen-keypad.

The pad can be anywhere on the screen, and it can be in a different place each time, but you'd be able to capture repeated patterns of clicks.

[bonjourmr]

This should scare customers whose bank uses a login system such as this, correct? https://online.westpac.com.au/esis/Login/SrvPage?referrer=ht...

[meaty]

Looking at the holes and crocks of shit we see every damn day related to HTTP, HTML, JavaScript and the whole programming model that surrounds them, it's about time someone just shot it all and started again putting security and privacy first rather than playing whack-a-mole all the time.

Unfortunately I fear this is not possible based on the sheer momentum that this ball of sticky tape and string has.

I think the sheer number of articles that paper HN all the time over browser and protocol vulnerabilities, leaks and problems back up my assertion.

EDIT: just to add, my frustrations are based on having to spend 5 hours porting some JS code so it works properly on all browsers.

[dasil003]

If 20 years ago some clairvoyant genius had foreseen what web applications would become, and decided to create a sane and secure alternative, and by some miracle had managed to pull it off without falling into numerous tarpits owing to an unsinkable combination of intelligence, persistence and vision, it still never would have taken off because it would be too complicated to gain traction compared to the simplicity of HTML.

The key thing you need to wrap your head around is that software ecosystems are not designed; they accrete and evolve organically, and no one has any power to change that.

[davedx]

It's an Internet Explorer vulnerability. Shell level IE exploits are one of the reasons Firefox and Chrome have done so well, because they're more secure. Don't paint every browser with the same brush.

[mattmanser]

Do you know how hard that would be?

It's not momentum, the browser is essentially a universal OS, the holes would still be there if you started again from scratch.

[7952]

Are you suggesting that there is something uniquely vulnerable about web technologies? Problems occur at every level of the stack from the OS on the client up to the server software. The big advantage of that programming model is how different elements can be loosely coupled. You can fix a problem by swapping individual parts of the stack without changing the experience.

[J_Darnley]

Just removing javascript from a browser would cure most ills these days, and not all of them security issues.

[jl6]

This is a tempting option in so many situations, not just software. But it never works because you can never wipe the slate truly clean. The state of the world is dependent on the previous state of the world.

[ams6110]

The problem is not the technology, it's human nature. There are a certain number of scumbags out there, who will lie, cheat, spy, eavesdrop, backstab, whatever it takes to get something for themselves. This has been going on since we've existed as a species and I see no reason to expect it to ever stop.

[delano]

The world is a lovely, messy place.

[lucian1900]

Anything you replace it with will have tons of vulnerabilities as well. Formal verification might help, but that's entirely orthogonal to the programming model.

Sure, it sucks to develop for. But it's not fundamentally impossible to make it secure and private.

[Yaggo]

> Looking at the holes and crocks of shit we see every damn day related to HTTP, HTML, JavaScript

Many "browser vulnerabilities" (esp. non-IE) are actually vulnerabilities of Flash, an entirely different [and dying] platform.

[Yaggo]

> EDIT: just to add, my frustrations are based on having to spend 5 hours porting some JS code so it works properly on all browsers.

Tells nothing more than someone has written shitty code in the beginning.

[egeozcan]

The limited nature of the environment actually makes it much more secure and I'd guess that IE is not written in JavaScript. =)

[derleth]

> it's about time someone just shot it all and started again putting security and privacy first rather than playing whack-a-mole all the time.

I agree fully. So do the people working on Algol-68, PL/I, Multics, the Canon Cat, Plan 9, and, perhaps most relevant to this, Project Xanadu.

(Esperanto probably deserves a mention here, but it's duking it out somewhere with Volapük, Ido, Interlingua, Loglan, and Lojban.)

[drivebyacct2]

Because inventing something from scratch is a fool-proof way to have bug and exploit free code.

What are you even doing these days that requires "porting JS code"? I haven't had to do that for ages and it was on poorly written JS to begin with.

[alpb]

This is not correct. When I run it on IE, first it asks permission to run ActiveX controls on my browser, which I don't allow if I trust.

Then of course, it is just like Flash, it can track your mouse.

[blahpro]

This is probably related to the YouTube video embed on the demo page, which I believe uses Flash. The mouse tracking itself is entirely JavaScript.

Edit: I am one of the authors of the demo code included in the disclosure.

[jey]

Where in the exploit HTML + JS is the ActiveX component being invoked from?

[wlesieutre]

I received no ActiveX warning with Windows 7 and IE9. What version are you running?

[blahpro]

Just to point out how ridiculous this is: you can get mouse position information from any event (fired programatically using fireEvent or otherwise). You can even get it from the "onbounce" event on <marquee> elements, for goodness’ sake.

[rossc1]

Is there any, any whatsoever, evidence to say that this exploit has ever been exploited?

It seems far fetched. And if your using a virtual keyboard for security... you'd be using IE? C'mon now.

[wahsd]

Kind of ironic considering Windows 8 visual/swipe password feature. Which, in general, is quite novel and interesting, albeit not very secure for various other reasons.

[snarfy]

The proof-of-concept should be a page that tracks the swipes and can then log in on Windows 8. I bet then Microsoft would prioritize fixing it.

[navneetpandey]

I have no problem at all, whether they track mouse movement or anything else.

You know why? because I use Chrome.

[abdophoto]

Freaking IE. I hate that damn browser

[goggles99]

This is so low risk, why even bother posting it? Zero days come out every month or two with far better attack vectors. Criminals are not going to waste their time with this rubbish.