Microsoft: We're working to 'adjust' IE's mouse tracking
Ad visibility can be monitored in other browsers, such as Chrome and Safari, with different techniques, but those work only when the tracking code has been placed on the same page as the ad, and when the ad originates from the same domain as the Web page's content.
In other words, ad analytics companies would not be able to "game" IE to get more information than they would get from a competing browser.
In a Friday rebuttal of Hachamovitch, de Jager added more to the debate. He did not address Hachamovitch's allegation that competition drove the bug's disclosure, however, or respond to Computerworld's questions on the topic.
Instead, de Jager took Microsoft to task for refusing to address the problem, even though that had been made moot by Hachamovitch's statement that Microsoft is working on a fix of some kind.
"It isn't for Microsoft and the various companies currently exploiting the vulnerability to decree unilaterally that this vulnerability is not important enough to fix," said de Jager. "According to existing privacy standards, it is not OK for a browser to leak your mouse coordinates outside of the particular browser window." De Jager suggested that the decision should be put in the hands of privacy experts.
He also blasted Hachamovitch for minimizing the threat with language such as "theoretical" and "very little risk to consumers."
"Ads do not need to be served to sites requiring login details," said de Jager. "Ads need only to be served to some page which is open in Internet Explorer."
Hachamovitch had pointed out that there was no reliable way for an attacker to know what was beneath the mouse cursor at any given point, and so criminals would be unlikely to figure out which mouse movements were, for instance, related to a virtual keyboard. At one point, Hachamovitch said it was "hard to imagine" how attackers could put all the necessary pieces together to pull off the theft of virtual keyboard entries.
De Jager did not address that aspect of Hachamovitch's rebuttal, or reply to questions about how the IE bug might be exploited in real-world attacks.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed . His email address is email@example.com.
Read more about Malware and Vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.
- Comprehensive Advanced Threat Defense The hot topic in the information security industry these days is "Advanced Threat Defense" (ATD). This paper describes a comprehensive, network-based approach to...
- Advanced Threat Defense: A Comprehensive Approach In this interview, Peter George, president, General Dynamics Fidelis Cybersecurity Solutions, explains why we need more than anti-malware, and what constitutes a comprehensive...
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- IDC ROI Infographic Trends such as evolving communication patterns, connection types, applications and bandwidth can have an impact on enterprise organizations. Learn how IT organizations can...
- NSS Labs & Cisco Present: Evaluating Leading Breach Detection Systems Today's constantly evolving advanced malware and APTs can evade point-in-time defenses to penetrate networks. Security professionals must evolve their strategy in lockstep to...
- Will the Real Endpoint Threat Detection and Response Please Stand Up? This webinar explores new technologies & process for protecting endpoints from advanced attackers as well as the innovations that are pushing the envelope... All Malware and Vulnerabilities White Papers | Webcasts