VoyForums
[ Show ]
Support VoyForums
[ Shrink ]
VoyForums Announcement: Programming and providing support for this service has been a labor of love since 1997. We are one of the few services online who values our users' privacy, and have never sold your information. We have even fought hard to defend your privacy in legal cases; however, we've done it with almost no financial support -- paying out of pocket to continue providing the service. Due to the issues imposed on us by advertisers, we also stopped hosting most ads on the forums many years ago. We hope you appreciate our efforts.

Show your support by donating any amount. (Note: We are still technically a for-profit company, so your contribution is not tax-deductible.) PayPal Acct: Feedback:

Donate to VoyForums (PayPal):

[ Login ] [ Contact Forum Admin ] [ Main index ] [ Search | Check update time | Archives: 1, 2, 3, [4], 5, 6 ]

[ Next Thread | Previous Thread | Next Message | Previous Message ]

Date Posted: 08:02:00 12/28/04 Tue
Author: IDG News Service
Subject: Bofra Worm Spreads by Banner Ads
In reply to: PC World 's message, "Zombie PCs: Silent, Growing Threat" on 07:56:45 12/28/04 Tue

Bofra Worm Spreads by Banner Ads
 
Attacks exploit IE flaw, and allow attacker to gain complete control of your PC.

Laura Rohde, IDG News Service
Monday, November 22, 2004


Web site visitors who clicked on banner ads on a number of popular European Web sites this weekend could have infected their computers with variants of the Bofra worm, experts warn.
Advertisement

The attacks take advantage of an unpatched buffer overflow flaw in the way Internet Explorer 6 handles the IFrame tag, and has been confirmed on PCs running Windows XP with Service Pack 1 and Windows 2000, according to a warning posted Sunday on the SANS (SysAdmin, Audit, Network, Security) Institute Web site. Windows XP Service Pack 2 (SP2) is not vulnerable, it said.

The vulnerability allows attackers to gain complete control of a user's computer.

Also on Sunday, U.K. technology news Web site The Register reported that its third party ad serving company Falk became infected with the Bofra/IFrame exploit, forcing the Web site to suspend its ads from Falk.

"If you may have visited the Register between 6 a.m. and 12.30 p.m. GMT on Saturday, November 20 using any Windows platform bar XP SP2 we strongly advise you to check your machine with up to date antivirus software, to install SP2 if you are running Windows XP, and to strongly consider running an alternative browser, at least until Microsoft deals with the issue," The Register said on its Web site.


Additional Reports

According to SANS, there were also reports of sites in Sweden and the Netherlands being compromised by the malicious code.

In the Netherlands, the country's biggest news site, NU.nl, with over 450,000 unique visitors per month, was infected through the ad system of Falk and served the code to its visitors. Additionally, the other sites of Ilse Media, including one of the largest Dutch sites Startpagina, distributed the Trojan horse as well.

Adserver tags and link addresses were manipulated in order to install and execute the malware. User requests were redirected from Falk's servers to the URL "search.comedycentral.com" (199.107.184.146), from where the malicious code was delivered, Falk says in a statement.

Falk's competitor Adtech released its own statement saying that its adserving system Helios was not affected by the problem.

Microsoft has yet to issue a patch for the IE IFrame hole for users who have not installed SP2. However, some "unofficial" patches have been released, including one from a German security researcher at the Web site, cherryware.de.

Wilbert de Vries of WebWereld Netherlands contributed to this report.

[ Next Thread | Previous Thread | Next Message | Previous Message ]
[ Contact Forum Admin ]

Forum timezone: GMT-8
VF Version: 3.00b, ConfDB:
Before posting please read our privacy policy.
VoyForums(tm) is a Free Service from Voyager Info-Systems.
Copyright © 1998-2019 Voyager Info-Systems. All Rights Reserved.