Worm Exploit Distributed by Advertising Network

Zocalo writes "Given that a lot of Slashdot readers also check The Register, it's important to note that their Internet advertising provider, Falk AG, was compromised by the BOFRA exploit yesterday. The Falk AG service has been suspended by The Register and a statement from Falk AG is due on Monday. The upshot is that if you visited the Register yesterday morning and use IE as your browser, then you probably need to run a full virus scan with up to date data files. Of course, those of us running other browsers and something like AdBlock have nothing to worry about. Again." You're OK for now if you're running SP2. There's also a good security writeup about the problem.

Comments

Re:Hosts File

[squidinkcalligraphy]

But why would you want to run an advertising network on your computer?

Article's Shameless attack at IE

[clinko]

So if your XP machine is up to date you're ok?

That's kool, because all I do is download new browsers for security and never run windows update. That would make too much sense...

Re:AdBlock is unethical

[flossie]

If there were a beggar on your way to work, and you surrounded him with some walls so no one would see him, that would be unethical.

Are you saying that it is wrong to house the homeless?!

Viral Marketing

[Valen0]

This worm gives new meaning to the term "viral marketing"...

Re:No one is safe...

[Izago909]

What computing JOB can be done in Windows that can't be done as well or better by a Mac or Linux?

I've got a couple ideas: Professioal gamer or spyware/virus tester.

Re:AdBlock is unethical

[Anonymous Coward]

For the last friggin time, Adblock set to 'hide' downloads the content, so it's no more unethical than taking a pee during commercials.

Re:Hosts File

[oexeo]

> If your computer is waiting for itself to respond to itself, some pages will never be displayed

Not in XP! in XP the chances are you already have a trojan-server running on 127.0.0.1:80 so it should respond instantly!

Re:Wow

[Frymaster]

Hopefully the Register, being an excellent IT news service, will provide an answer to that question

yes. but will they be able to implement when they have these guys running their servers?

Re:Hosts File

[TheLink]

Erm. Did that for April 1st this year where I worked.

I set things up so that *.doubleclick.net etc resolved to a webserver in the company, and the webserver served up "localized content".

So tons of ads were replaced by the company logo :).

Surprising how few noticed! No I didn't get fired.

Maybe I should have served up announcements instead of just the company logo. e.g. "The Company Is Your Friend". "Staff Meeting at 2PM". "You There! Stop Surfing!". "Exploit e-Business Initiatives". "Da Boss is In The Building!" ;).

Anyway this would save bandwidth and be possibly useful - you could also extend it and customize content on a per user/IP basis.

Frames considered harmful

[wikinerd]

The security vulnerability involves inline frames (IFRAME). I always knew that HTML frames are evil, but now I feel like wanting to email every webmaster who uses frames! :)

I propose to stop using frames and always click the "no frames" option in every website which provides it. If you believe that frames are evil, please read my relevant blog entry and say all over the world that you hate frames. Perhaps we can make a difference and teach webdevelopers that frames are annoying.

Re:LOL

[BlackHawk-666]

Yeh right, and I'm the king of Persia and I ride a magic dragon to work every day. I have proof too, photos and stuff but I'm too lazy to post the links. I guess you'll just have to believe me.