Microsoft responds to IE mouse tracking vulnerability | Hacker News Reader

Microsoft responds to IE mouse tracking vulnerability

blogs.msdn.com

32 pointsalt_47 comments

Getting all the pieces to line up in order to take advantage of this behavior – serving an ad to a site that asks for a logon, the user using an on screen (or virtual) keyboard, knowing how that onscreen keyboard works – is hard to imagine.

ORLY? The imagination of a Microsoft engineer quite clearly is no equal to the imagination of a creative exploiter. After all, nobody could imagine the Morris Worm, or Word Macro viruses, or even SQL Slammer.

Attacks come through exploitable vectors. Lining up those exploitable vectors may seem tricky, but that hasn't stopped this from happening. And frankly, this particular attack vector seems to be one of the more exploitable ones.

They seem to have never seen terminal PCs. I know a couple of places in my city where you have IE-based kiosk terminals with touch-on-screen keyboards that emulate a cursor. It should be even much easier to map mouse movement to actual inputs as the emulated cursor "jumps" from key to key during input.

My recollection is that those PCs don't allow background windows. And this attack works in all browsers for the foreground window.

I don't think it does work in all other browsers.

At least in Firefox on Linux, the mousemoves are only triggered when the mouse is directly over the page itself, not even when over the tab-bar etc, nor when over the Gnome 3 on-screen keyboard (which overlaps the page).

I don't agree at all.

It's an x, y position, what possible use is it? Two integers.

MS are right about this, this is just spider.io being alarmist for free publicity.

So you're saying if you were given a mouse movement trace on top of a virtual keyboard, you couldn't possibly deduce what was typed?

Someone should just make a program that does that, and this will all be settled. Maybe even make it guess what kind of virtual keyboard was used.

A better question is what degree of danger this information actually poses. It is possible to reverse a password hash created by bcrypt regardless of what settings you used. The question is HOW LONG would it take, and whether the cost makes the value of any potential exploit less than zero. If the value is less than zero, the risk is effectively minimal - at least for now.

Panic and tarring and feathering of Microsoft's security team is only justified if the risk is severe.

A security issue is a security issue, regardless of how severe it is.

If MS had come out and said "We're working on fixing it, but we don't think it's a critical vulnerability" - that would be understandable. What needs to be called out is if they come and say "This isn't an issue at all".

If some website was leaking password hashes, would "well the hashes are so strong that this isn't really an issue" be an acceptable response?

Well, the underlying software uses just this information (x, y position) to translate the movements of the mouse to individua l key events. Since the OS does it, it is not in the same ballpark as stuffing a dictionary down bcrypt's throat.

While the risk may not be severe, and not of the scale of tarring let alone feathering, it is a risk that must be addressed. As the article says, We take these risks very seriously.

Yeah, but you still wouldn't want sites making their bcrypt hashes publicly available...

If password is sufficiently long, x and y coordinates are all what is needed to deduce keyboard coordinates, button size and then, password.

Just use Dvorak and they'll have no idea what you typed :)

That is admittedly a weak part of their response, but to their credit in the previous sentence they say We take these risks very seriously.

Saying is not doing.

The entire buleting stands for:

"We take these risks very seriously. We analised it, and concluded that we shouldn't take this risk seriously."

They did what with it?

Nothing to see here; move along...

Interesting wording of the message. Microsoft tries to lead the attention from the real problem to an analytics company that can't stand the heat of competition.

We learn something new every day.

Those pesky spokespeople. Microsoft should fire them all, they're damaging the already damaged Microsoft image. Just take a look at this statement:

"There are similar capabilities available in other browsers. Analytics firms can expect to do viewpoint detection in IE similarly to how they do this in other browsers."

Aren't they just throwing their hands up in defense and telling us "We're not the only ones! Everyone else is doing it too!" That's slimy.

> damaged Microsoft image

I think you are stuck in the past. Microsoft has dramatically improved the security of their system. I've been using Windows as my primary OS since 3.11 days, and I hated Microsoft guts for cutting corners and shipping crap. Not anymore. They really pulled their act together in last couple of years. From Windows Updates, to mitigation tools like EMET, to much improved MSDN documentation - I really can't be believe that I'm saying this - they did a great job. So please if you feel like bashing M$, there's a dedicated website for that... it's called Slashdot :)

> dramatically improved the security of their system

yes they did, but their perceived image is still badly damaged

I'm sure most spokespeople are fine. This one is not. The same information could have been much better presented. A skilled spokesperson could have performed just as much arse-covering and justification, and just as little apology, without coming across like such a petulant whinger ;)

Really, it sounds more like something one might write on an internal mailing list than a message intended for general consumption. Rolling your eyes about seemingly overblown theoretical worries is fine, but one should be a bit more contrite in public.

To highlight the ridiculousness of this vulnerability: you don't even need to use `fireEvent("onmousemove")` to gain access to this information. You can use events that have absolutely nothing to do with the mouse, such as onbounce* on a hidden <marquee> element (seriously).

* "Fires when the behavior property of the marquee object is set to "alternate" and the contents of the marquee reach one side of the window." -- http://msdn.microsoft.com/en-us/library/ie/ms536910(v=vs.85)...

Whoever Gillian is, she just rocked my world with that comment.

Why the hell they issue statements instead of patches? Is it hard to fix? If yes, let us know. If no, just fix it.

My guess is that Microsoft might get profit from this "feature". They don't think it's a bug or a vulnerability, it's just a "tool" they may provide to thirdparties. They must be annoyed by all those crying nerds.

Microsoft cannot issue patches instantly. They have to go through testing.

The issue was reported in October.

"Whilst the Microsoft Security Research Center has acknowledged the vulnerability in Internet Explorer, they have also stated that there are no immediate plans to patch this vulnerability in existing versions of the browser."

http://spider.io/blog/2012/12/internet-explorer-data-leakage...

So, instead of fixing it:

- receive vulnerability report

- don't fix it and wait until there's PR disaster

- issue statement that now "we're working actively to fix it"

- [future] fix the issue

My question, again -- why the hell they didn't fix it in the first place? Why go though this? Do you have to be a psychic to figure out that any Microsoft's non-response to vulnerability (even if its effect is overblown) is a PR disaster?

If Microsoft does not consider it to be a critical vulnerability, their behavior is entirely consistent with the issue being a task on a task list somewhere - possibly already fixed on the development branch for the next release (or service pack) of Internet Explorer 10. It is simply not possible to declare at this point that Microsoft decided not to fix it. Internet Explorer is a tremendously large piece of software used by millions of customers; do you think this is the only bug with potential security consequences in their bug database?

More concretely: If, hypothetically, on October 1 2012, two security issues were reported, and this is one of them, which one do you think they should have fixed first and rushed an out-of-band patch for? Do you think it should have been this one specifically because it's a PR disaster?

I agree that faster action is always better, and that better communication is always better. But you have to understand that teams working on products this large do not move quickly. In the time since this issue was reported to Microsoft, we have only passed through roughly one release cycle of Firefox and Chrome. So, assuming an identical issue was found and reported in Firefox or Chrome on the same date, would the fix even be in customers' hands? Most likely only if it were considered important enough to rush a fix.

Your reply makes a lot of sense, much more sense than the linked post. Thank you.

Heh, happy to note that "There are similar capabilities available in other browsers" - but then nicely ignores the fact that the crux of this issue is mouse position can be read even when mouse is out of browser window focus.

It has yet to be conclusively proven that this information presents a real risk to anyone's privacy. It would certainly be nice to fix (and you can observe from the post that MS is not opposed to fixing it) but it is hardly a crisis.

I'm hoping it won't be conclusively proven, because by definition the proof will be an exploit in the wild.

I find Microsoft's explanation of the facts to be quite logical. How many users are actually going to interact with an onscreen keyboard using the mouse cursor? It's already been stated that the supposed exploit doesn't affect the touch keyboard on Win8.

As has been pointed out, at least one bank has a mouse controlled pin keyboard.

The layout of the PIN keyboard at my last bank was randomized for each logon. I always thought this paranoid, but it's now looking prescient...

Slightly tangential to the overall discussion, but I always wondered ... wouldn't even randomisation have to make sure that the key labels are readable with assistive technologies (e.g. not use images without alt attribute or even an image map for the complete keypad) and in that case be accessible to any input logger that bothers to log what controls are clicked? Or are they actually allowed to shut out users with disabilities altogether?

As I recall, the buttons looked like just ordinary text links in a coloured table, presumably with javascript callbacks for the clicks. So I suppose they'd have been screen reader-friendly enough for use by the blind and so on, while still being random enough by default to defeat mouseloggers, and keyboardless enough by default to defeat keyloggers.

ING Direct in the UK randomise the position of the keys on the keyboard for each login attempt.

Someone needs to fire their UI guys

Are you seriously suggesting that given nothing other than a small window into mouse position and modifier keys (the latter would be useless for a mouse controlled pin keyboard), an attacker would be able to not only identify when the user clicks, but when they're visiting the bank and the alignment of the pin keyboard? And then somehow leverage this information by itself to attack someone without having any of their other personal information?

It is certainly information that COULD be useful as part of an attack, but it seems utterly ridiculous that just mouse information would somehow enable you to compromise the security of someone's bank account.

Private information should certainly remain private, and I don't doubt that this leakage will be fixed one way or another, but this really seems more like paranoia than anything else unless there's at least a concrete description of how the data provided is enough to actually inflict harm. Lots of potentially useful data is exposed by browsers (and browser plugins) every day; this isn't the only bit.

As previously stated.

This could be used to potentially track entropy of encryption key generation(such as trucrypt or, the new MEGA sites implementation, any site or program that employs mouse-movement/key binding for entropy.)

Mega Screenshot: http://cdn.thenextweb.com/wp-content/blogs.dir/1/files/2012/...

Security Thread on Bank Login virtual keyboard: http://security.stackexchange.com/questions/22774/my-bank-ma...

Just something an idiot can think of so, any black-hat is just having fun @ this point.

Thank you for a more concrete justification. I think I agree that the two links you provided are examples of use cases that could actually be exploited just using the position of the mouse.

All internet malfeasance isn't Nigerian banker spam. The vulnerability could be exploited in a whale phishing expedition. One cannot assume that the attacker does not know the specific hardware and software configuration. Nor can one assume that the attacker does not know which website is being accessed.

In addition, the ubiquity of IE makes the collection of analyzable data from which patterns may be extracted practical, e.g. one could probably learn to identify specific virtual keyboard layouts.

Finally, given the degree to which persons are identifiable while browsing, and the persistence of tracking data, finding whales is perhaps more likely than many people might imagine.

What's a whale phishing expedition?

In ordinary phishing attacks, malware is sent to the largest possible group with the goal of getting the largest number of backdoors / account credentials / whatever.

In "spear" or "whale" phishing, the attack is targeted at specific individuals; whales are high-value targets such as corporate executives. In such cases, the attacker might e-mail a personally-addressed fake subpoena, invoice, or memo using another exec's name.

I have the feeling Windows 8 will become a better attack target than Windows 7 was, because of all the new (and exploitable) stuff Microsoft introduced through the Metro stuff and through the Windows store, that are still very much untested.

'Redmond is (still) evil' it seems :-)

Reply on news.ycombinator.com