IE exploit can track mouse cursor - even when you're not in IE

A vulnerability affecting Internet Explorer versions 6 through 10 could make it possible for a hacker to monitor the movements of your mouse, even if the browser window is minimized.

MORE SECURITY: With BYOD, data breaches just waiting to happen

According to UK-based web analytics firm Spider.io, this means that passwords and PINs could be captured by a canny thief if they are typed on a virtual (on-screen) keyboard. What's more, it's already being exploited by two display advertising networks, the company said, though it did not name them in its statement.

"As long as the page with the exploitative advertiser's ad stays open - even if you push the page to a background tab or, indeed, even if you minimize Internet Explorer - your mouse cursor can be tracked across your entire display," Spider.io said.

The company added that, while the problem has been acknowledged by the Microsoft Security Research Center, there are apparently no immediate plans for a patch.

Spider.io also published the technical details of the exploit, which involves the browser's global Event object, as well as a game demonstrating how it could be used to monitor user input to a virtual keyboard.

"Internet Explorer's event model populates the global Event object with some attributes relating to mouse events, even in situations where it should not. Combined with the ability to trigger events manually using the fireEvent() method, this allows JavaScript in any webpage (or in any iframe within any webpage) to poll for the position of the mouse cursor anywhere on the screen and at any time," the company said.

Email Jon Gold at jgold@nww.com and follow him on Twitter at @NWWJonGold.

Read more about wide area network in Network World's Wide Area Network section.

Tags securityMicrosoftanti-malwareInternet Explorermalware

Comments

Comments are now closed

CSO Corporate Partners
  • f5
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

ZENworks® Endpoint Security Management

Get powerful mobile security capabilities, and protect the data the various mobile devices inside your organization.

Security Awareness Tip
Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.