Microsoft: We're working to 'adjust' IE's mouse tracking
U.K. analytics firm returns fire Friday, alleges Microsoft downplays the security, privacy threat
Computerworld - A U.K. analytics firm that warned earlier this week of an information leak in Internet Explorer (IE) today rebuked Microsoft for downplaying the bug.
Microsoft, however, has announced it is working on a fix, although the nature of the anticipated patch was unclear.
Criminals could use the technique, Spider.io alleged, to monitor mouse movements used to log into sensitive websites with "virtual keyboards," on-screen keyboards similar to those on smartphones. Some websites, notably a few banking sites, rely on virtual keyboards as a way to stymie the far-more-common malware that captures keystrokes from a physical keyboard.
Yesterday, Microsoft downplayed the threat, noting -- as Spider.io had also charged -- that only a pair of advertising analytics companies have taken advantage of the bug. Those firms, said Spider.io, monitor cursor movement to track whether an ad is visible to the user, or whether it is hidden because the web page is larger than the viewing area of the browser.
Spider.io relies on its own technology to determine what proportion of the ad is visible. The technique, which Spider.io CEO Douglas de Jager labeled "browser optimization" in an October interview, watches how a browser allocates resources to render an ad.
The U.K. firm posted a message on Bugtraq, one of the most popular security mailing lists, on Tuesday, then followed that with a blog post Wednesday, recounting how it reported the bug to Microsoft on Oct. 1, but was later told by Microsoft that the Redmond, Wash. developer had no plans to fix the flaw.
Microsoft's top executive for IE, Dean Hachamovitch, took to a company blog Thursday to counter Spider.io's claims.
Hachamovitch downplayed the threat to Windows users, and said that Spider.io's report was motivated more by spite than by concerns over security. "From what we know now, the underlying issue has more to do with competition between analytics companies than consumer safety or privacy," said Hachamovitch. "The only reported active use of this behavior involves competitors to Spider.io providing analytics."
However, Hachamovitch did promise that Microsoft was on the case. "We are actively working to adjust this behavior in IE," he said.
The "adjustment," he said, would bring IE into line with other browsers' behavior. "Analytics firms can expect to do viewpoint detection in IE similarly to how they do this in other browsers."
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts