Slashdot Mirror

← Back to Stories (view on slashdot.org)

Worm Exploit Distributed by Advertising Network

Posted by michael on from the you-thought-you-were-safe dept.

Zocalo writes "Given that a lot of Slashdot readers also check The Register, it's important to note that their Internet advertising provider, Falk AG, was compromised by the BOFRA exploit yesterday. The Falk AG service has been suspended by The Register and a statement from Falk AG is due on Monday. The upshot is that if you visited the Register yesterday morning and use IE as your browser, then you probably need to run a full virus scan with up to date data files. Of course, those of us running other browsers and something like AdBlock have nothing to worry about. Again." You're OK for now if you're running SP2. There's also a good security writeup about the problem.

14 of 478 comments (clear)

  1. Wow by metlin · · Score: 4, Insightful

    This is a really big problem. Okay, so its Register and they realized this and stopped it. But we visit so many other websites - how are we to know which one of those ad providers are infected and which are not?

    Sheesh, where is accountability? Blame the sysadmins, blame the software, pity the customer. Lather, rinse repeat.

    1. Re:Wow by skids · · Score: 5, Insightful

      "Blame the sysadmins, blame the software, pity the customer."

      You left someone out: web developers as a whole, who have insisted on more and more complicated HTML extensions instead of just working with the rather powerful stuff they had at their disposal in the first place. These are the folks that make the "core functionality set" of any competitive browser so large that the software to support it is incredibly complex. That guarantees us a steady flow of bugs and exploits.

      --
      Someone had to do it.
    2. Re:Wow by mrseth · · Score: 5, Insightful

      "Oh, and the same blocking could be done with a Windows web-proxy server. You don't need Linux, unless you aren't smart enough to figure out how to work Windows."

      I do believe you have this precisely backwards. By the way, please note that if people used Linux or OS-X, we would not *need* to block all this shit in the first place.

      "They don't need to. You click a button, and it keeps you up to date. Someone with automatic update wouldn't even need to know what SP2 is, but they would be up to date.

      Can you point me to the patch for Win2k then? Thanks.

      And they wouldn't have to spend hours trying to figure out how to upgrade their OS like they do with Linux."

      Never heard of apt, yum, urpmi, or up2date? And as a bonus for Linux users, we do not have to reboot either, save for a kernel update.

      Windows is for those with more money than sense.

  2. Text-Ads by fembots · · Score: 5, Insightful

    Maybe site owners will start moving or demanding text-based ads (like Google's)?

    --
    Rock that crushes, Paper & Scissors that don't matter.
  3. Interesting. by xanadu-xtroot.com · · Score: 4, Insightful

    You're OK for now if you're running SP2.

    Ummm... My Win machine is running SP4. Oh, you mean XP SP2. Not on my machines, man... The highest I'll go on my personal machines is 2k.

    Aside, you left out another browser of very worthy note. Oh, well, make that two.

    --
    I'm not a prophet or a stone-age man,
    I'm just a mortal with potential of a super man.
  4. Re:AdBlock is unethical by flossie · · Score: 5, Insightful
    Even if AdBlock were responsible for preventing a user from getting a virus this time, that's hardly enough to make up for the theft of services and fraud that people who use it commit every day.

    Utter drivel. I suppose you think that it is "theft" to change the channel on the TV when adverts come on, as well. Is it also "theft" to turn the page of a magazine without looking at the adverts on it? As far as I am concerned, advertising is a form of pollution. It reduces the visual beauty of the environment and I don't want to see it.

    --
    flossie

    Write now. Defend liberty

  5. Re:AdBlock is unethical by Famatra · · Score: 5, Insightful

    "Extensions and programs like AdBlock are tantamount to theft; you are acquiring the content but not "paying" for it by loading the advertisements."

    Um, it is clearly *your* problem if your website's cash flow relies on wasting my bandwidth with advertisements.

    Your supposed 'right' to profit does not extend to the point where I have to bend my life around your profit model. Thanks.

  6. Re:No one is safe... by arminw · · Score: 5, Insightful

    ... but if you are on the net, you aren't safe...

    Unless you are a Mac user that is. Every time there is anything in the news or /. about another piece of malware, there is always the refrain: "Does not affect Mac users". Unless you are running some proprietary vertical app, why still suffer Windows? What computing JOB can be done in Windows that can't be done as well or better by a Mac or Linux?

    --
    All theory is gray
  7. Re:Hosts File by petecarlson · · Score: 4, Insightful

    Hmm, Seing as we can have "laws" which make it illegal to fast forward through a commercial on your device, it seems it would be a trivial matter to make it illegal for you to do this on your DNS server or with your hosts file...

  8. Re:AdBlock is unethical by PalmerEldritch42 · · Score: 4, Insightful
    No, No, and No. I fail to see your argument. It is not unethical to block or otherwise not look at ads on a free site. The site is free. There is no EULA stating that in order to view the free content, my eyeballs have to focus on an ad. The ads do pay, and quite possibly, without that income, the site might go down. That si the problem of the admins. Here on Slashdot, we her quite a lot of noise about how failing business models need to be updated. If a site can not sustain itself from ad revenue, then perhaps it needs a different model.

    There was never any agreement between me and the website admins that I had a limited license to view the content predicated by my looking at ads. Websites that are on the internet are free to the consumer, unless explicitly stated otherwise.

    --
    Ceci n'est pas une sig.

    :wq!

  9. Re:AdBlock is unethical by Realistic_Dragon · · Score: 4, Insightful

    I still see the adds on penny arcade because they are small enough it's not worth my effort to block them, and occasionally something interesting comes up.

    I see no adds here because they are huge flash obscenities for Microsoft FUD campaigns.

    You want clickthroughs? Rethink your ad placement policies. (If I could select as a pref nothing but text adds for Linux/Unix/Hardware with _informational_ content - I might well see adds on Slashdot. And you might get paid more that the 0 you get for me at present.)

    The thing that pisses me off most of course is that the ultra lightweight version still has the heavy and blotated flash/animated adverts :\

    --
    Beep beep.
  10. Sorry but ... by Evil+Pete · · Score: 4, Insightful

    ... who in the IT industry is dumb enough to surf using IE? Not being nasty but really we of all people should know better. Others yeah I can sympathise but Register readers ?

    --
    Bitter and proud of it.
  11. Re:LOL by roca · · Score: 4, Insightful

    Put it this way: Firefox offers pre-WinXP users a *free* path to being secure. Microsoft forces them to spend a significant amount of money.

  12. Re:LOL by toddestan · · Score: 4, Insightful

    No, the latest version for EVERYONE is IE6 SP2. If they're still using an older OS, that's tough shit for them. You can't say "Well the latest version of Windows is XP, but some people decided not to upgrade so the latest version for them is 2000." It just makes no sense.

    Yet another disadvantage of tying the web browser to the OS. Atleast the latest versions of Opera and Firefox run on Windows 95 just fine.

    Besides, I don't think IE6SP2 runs on Windows 2003 Server. What do you have to say to users of that OS?