While this seems like something that Microsoft should fix as a matter of urgency, I don't believe the problem is as severe as is being portrayed.
In order to get any meaningful information from this attack, you would need to know what application/website the user is currently using (or send them to it), where it's positioned on the screen and the exact layout of the subject. The interface would also have to be either mouse- or meta-key driven, which isn't a common facet for sensitive inputs (passwords, bank transfers, and private messages off the top of my head).
As they mention in the article, if the user is using an onscreen keyboard, then the trace essentially amounts to a keylog. And since on screen keyboard usage would have very distinctive patterns, if you had a large enough dataset, you should be able to extract those logs relatively easily.
I guess it shouldn't be too hard to create an algorithm that maps the movements to potential numbers on a visual type pad. Once you have the numbers, you just need to match them to patterns which could be cc numbers, phone numbers, bank accounts and so on. You just need to collect enough to find some useful data.
Whether it's common or not isn't the issue, it's whether it's done at _all_ by banks and suchlike.
My bank on their online site asks for my account number, a memorable piece of data and a 6 digit passnumber that they generate (and I can't change). The passnumber is entered using pull-down menus for each digit, always ordered 0-9.
So, no, an attacker wouldn't have access to all the information they need, but they'd certainly have access to more than they should, in this case, if they're able to take advantage of this, that is.
And it's not just for general users, some sites do often additional functionality in this field for users with accessibility requirements (large on-screen number pads, etc).
So, yes, I'm sure the % of affected sites is low, but just 1 bank whose online system is comprised by this is 1 bank too many.
Even if mouse position tracking is permitted, it should clearly be limited to the current tab. Cross-tab, and certainly, cross-application is just clearly wrong.
agreed, which is why Microsoft should be held to account for not prioritising fixing this problem. However, I felt that the portrayal of this particular hole in the linked article made it out to be more than it is.
In order to get any meaningful information from this attack, you would need to know what application/website the user is currently using (or send them to it), where it's positioned on the screen and the exact layout of the subject. The interface would also have to be either mouse- or meta-key driven, which isn't a common facet for sensitive inputs (passwords, bank transfers, and private messages off the top of my head).