The Cat and the Mouse

A month ago, we learned that spider.io (http://spider.io/blog/2012/12/internet-explorer-data-leakage/) had informed Microsoft, back in early October 2012, of a flaw that makes it possible to track mouse movements from Internet Explorer, versions 6 to 10.

So far, apart from releasing a seemingly incomplete "fixIt", Microsoft still hasn't done anything to fix the situation.

The "exploit" code, if you can even call it that given how trivial it is, has therefore been published on a ton of sites. Here is the original exploit code published during the month of December:

When this code runs, as shown in the next figure, the "detector" div displays the actual position of the mouse on the victim's screen.

Some will say "NO BIG DEAL"... But what about the impact of this vulnerability on users with touch screens or using the Windows on-screen keyboard? Keep in mind that the vulnerability really does let you track the mouse position, even when Internet Explorer doesn't have focus and is minimized.

So, to give you an idea of "how" an attacker could use this issue, we modified the original exploit code so that it displays not just a single position but the complete list of mouse coordinates used by the victim. In our case, for practical reasons, this list is displayed on screen. However, it would be easy to adapt the code so the list is sent to a web service controlled by the attacker, with the exploit code embedded in a vulnerable page. Here is our version of the exploit:

As you can see, the changes are minor. Now imagine a victim falls into the trap and this page runs in the background on their machine while they use an on-screen keyboard. The malicious page will collect a list of the victim's mouse positions, as shown in the next figure.

Once in the attacker's hands, this list could then be fed into a tool to rebuild a graph of the mouse movements. We built such a tool (simplified, of course) that could be used in this kind of scenario. Here is the code; you'll see in it a list of positions collected by the page exploiting the vulnerability.

So when the attacker runs this page, they end up, as shown in the next figure, with a graph showing the victim's mouse movements.

This graph can then be overlaid on a screenshot to visualize the movements in question, as shown in the next figure.

So it's fairly easy to spy on users based on their mouse movements. Of course, some of you might point out that analyzing the results to pull off a complete attack can be pretty tedious, since every single mouse movement gets recorded. That's true. However, don't forget that when someone uses a touch screen, there is normally no mouse movement except when the user "clicks" with a finger, which moves the pointer. A user with such a screen, which is more and more common, therefore becomes a perfect victim for this kind of attack scenario.

Until the bug gets fixed, for those of you who aren't already using it, happy Firefox downloading!