what you don't know can hurt you

Microsoft Internet Explorer Mouse Tracking

Microsoft Internet Explorer Mouse Tracking
Posted Dec 11, 2012
Authored by Nick Johnson

A security vulnerability in Internet Explorer, versions 6 through 10, allows your mouse cursor to be tracked anywhere on the screen, even if the Internet Explorer window is inactive, unfocused or minimized. The vulnerability is notable because it compromises the security of virtual keyboards and virtual keypads.

tags | exploit
MD5 | 8845f7a0e6f2f434bed1d4af37fb9430

Microsoft Internet Explorer Mouse Tracking

Change Mirror Download
Summary: Unprivileged attackers can track your system-wide mouse
movements from any IE page, even when the page is unfocused or
minimised.
Package: Microsoft Internet Explorer
Affected: Tested on versions 6–10


Introduction
-----------------
A security vulnerability in Internet Explorer, versions 6–10, allows
your mouse cursor to be tracked anywhere on the screen, even if the
Internet Explorer window is inactive, unfocused or minimised. The
vulnerability is notable because it compromises the security of
virtual keyboards and virtual keypads.

As a user of Internet Explorer, your mouse movements can be recorded
by an attacker even if you are security conscious and you never
install any untoward software. An attacker can get access to your
mouse movements simply by buying a display ad slot on any webpage you
visit. This is not restricted to lowbrow porn and file-sharing sites.
Through today’s ad exchanges, any site from YouTube to the New York
Times is a possible attack vector. Indeed, the vulnerability is
already being exploited by at least two display ad analytics companies
across billions of webpage impressions each month. As long as the page
with the exploitative advertiser’s ad stays open—even if you push the
page to a background tab or, indeed, even if you minimise Internet
Explorer—your mouse cursor can be tracked across your entire display.


Details of the vulnerability
-----------------
Internet Explorer’s event model populates the global Event object with
some attributes relating to mouse events, even in situations where it
should not. Combined with the ability to trigger events manually using
the fireEvent() method, this allows JavaScript in any webpage (or in
any iframe within any webpage) to poll for the position of the mouse
cursor anywhere on the screen and at any time—even when the tab
containing the page is not active, or when the Internet Explorer
window is unfocused or minimized. The fireEvent() method also exposes
the status of the control, shift and alt keys.

Affected properties of the Event object are altKey, altLeft, clientX,
clientY, ctrlKey, ctrlLeft, offsetX, offsetY, screenX, screenY,
shiftKey, shiftLeft, x and y.


Exploit
-----------------
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8" />
<title>Exploit Demo</title>
<script type="text/javascript">
window.attachEvent("onload", function() {
var detector = document.getElementById("detector");
detector.attachEvent("onmousemove", function (e) {
detector.innerHTML = e.screenX + ", " + e.screenY;
});
setInterval(function () {
detector.fireEvent("onmousemove");
}, 100);
});
</script>
</head>
<body>
<div id="detector"></div>
</body>
</html>


Demonstration
-----------------
A demonstration of the security vulnerability may be seen here:
http://iedataleak.spider.io/demo


The implications for virtual keyboards and virtual keypads
-----------------
We have created a game to illustrate how easily this security
vulnerability in Internet Explorer may be exploited to compromise the
security of virtual keyboards and virtual keypads. The game may be
found at http://iedataleak.spider.io/

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

October 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    24 Files
  • 2
    Oct 2nd
    15 Files
  • 3
    Oct 3rd
    7 Files
  • 4
    Oct 4th
    4 Files
  • 5
    Oct 5th
    10 Files
  • 6
    Oct 6th
    1 Files
  • 7
    Oct 7th
    21 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    5 Files
  • 10
    Oct 10th
    20 Files
  • 11
    Oct 11th
    17 Files
  • 12
    Oct 12th
    4 Files
  • 13
    Oct 13th
    4 Files
  • 14
    Oct 14th
    15 Files
  • 15
    Oct 15th
    19 Files
  • 16
    Oct 16th
    25 Files
  • 17
    Oct 17th
    17 Files
  • 18
    Oct 18th
    7 Files
  • 19
    Oct 19th
    1 Files
  • 20
    Oct 20th
    3 Files
  • 21
    Oct 21st
    12 Files
  • 22
    Oct 22nd
    11 Files
  • 23
    Oct 23rd
    18 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close