Worm Exploit Distributed by Advertising Network

Zocalo writes "Given that a lot of Slashdot readers also check The Register, it's important to note that their Internet advertising provider, Falk AG, was compromised by the BOFRA exploit yesterday. The Falk AG service has been suspended by The Register and a statement from Falk AG is due on Monday. The upshot is that if you visited the Register yesterday morning and use IE as your browser, then you probably need to run a full virus scan with up to date data files. Of course, those of us running other browsers and something like AdBlock have nothing to worry about. Again." You're OK for now if you're running SP2. There's also a good security writeup about the problem.

Comments

Fortunately..

[The Mgt]

.. falkag.net are the second entry in my ad filter, right after doubleclick

Re:Wow

[rishistar]

Hopefully the Register, being an excellent IT news service, will provide an answer to that question.

No one is safe...

[jarich]

I once stumbled across a spyware installation program (about a year ago) that was launched by a site counter! Some poor person had put the counter into their web site because they wanted a free counter. Everyone who visited got spyware installed... everyone using IE with default security settings, that is.

Sad thing was the company was based in the Netherlands so it wasn't even worth pursuing legally... but if you are on the net, you aren't safe. MS products are more insecure, but you should always take steps to protect yourself, like keep the OS and applications up to date, etc etc

Re:No one is safe...

[linguae]

I would love to switch every Windows user that I know to Linux, *BSD, or (if they're in the market for a new computer) Mac OS X. However, there are a few reasons why many people are still using Windows, and will stick with it for about another two years or so:

1. I don't want to learn (insert new OS here)
2. But I need (insert some proprietary app here)
3. But would (this exotic piece of hardware) work on (this new OS)
4. What's an OS? Why's security important? (insert typical questions asked by computer illiterates)

Even so, things are getting brighter for these alternate OSes every day. The graphical environments for *nix are getting easier to use with every new release of KDE and GNOME. In fact, if I switched my parents and siblings to *nix tomorrow, they might feel comfortable (provided that I set everything up, that is). Many Windows users are now starting to see the benefits of Open Source software (through OSS projects such as Mozilla Firefox and OpenOffice), and they will feel more comfortable once they make the switch. Hardware support for *nix is getting improved by the day, and more manufacturers are starting to take a look at *nix compatibility. On the Mac side of things, more people are getting exposed to Apple products (through the iPod) and are learning about the virtues of having a Mac.

Finally, security is starting to become much more important to comptuer users, even the Joe Average type, these days. It used to be that the Internet was a reasonably nice place to go to to find information and to communicate. Now, it is infested with commerical advertising, popups, insecure "portals" to the Internet (*cough Internet Exploiter* cough), and malware. Stuff that we never would have guessed that would happen about a decade (or even five years) ago, such as phishing and worms activated by just browsing a web page, are happening now. More people are becoming aware about the dangers of viruses, worms, spyware, adware, and the other crap that happens on the Windows platform daily. More people are starting to learn about alternate browsers such as Firefox and Opera. Some people are now finally setting up firewalls and anti-malware applications so that way they would be safer from the dangers of the Internet. Some are even planning the switch to a Mac, *nix, or another alternative.

I believe with the current landscape of computing, the Windows hegemony will last another two to three years. I feel with all of the improvements that *nix and OS X are making each and every day, the computing environment will be pretty interesting in the years to come....

Re:AdBlock is unethical

[Anonymous Coward]

I guess I should stop using Lynx then! It's unethical since I don't see images.

Re:Text-Ads

[NoMercy]

Strange comment now google now does picture adverts, admitidly there not very common to spot but they are out there, quite a few google image adverts pop up on a forum I frequent.

Something said on http://www.theregister.co.uk/

[Antony-Kyre]

If you may have visited The Register between 6am and 12.30pm GMT on Saturday, Nov 20 using any Windows platform bar XP SP2 we strongly advise you to check your machine with up to date anti-virus software, to install SP2 if you are running Windows XP, and to strongly consider running an alternative browser, at least until Microsoft deals with the issue.

I just wanted to make this comment. One of the SP2 versions trashed my computer so bad when I ran it. And I'm still suffering from the effects. Such effects include freezing on websites for minutes at a time. Installing it also took my computer like 10 minutes to boot if I remember correctly.

If you can get an anti-virus program, do it. It's better than nothing.

I hate third party ads. www.tvtome.com serves one malicious ad, unless they took care of it already. If I remember correctly, the "ad" kept asking me to do something, in which I had to end up killing the IE6 process to stop it. But I run an ad blocking program most of the time. I really hope websites switch to text ads, like Google does.

Re:AdBlock is unethical

[oexeo]

AdBlock is unethical [...] Extensions and programs like AdBlock are tantamount to theft

It's kinda ironic that a lot of the ads on tech sites are advertising anti-spyware/pop-ups/ads/adware/spam tools, isn't it?

Maybe if these companies agree with you that the use of these tools constitute fraud/theft, then they should stop advertising them.

It's not the first time..

[Dynamoo]

It's not the first time this has happened either, see this article relating to an incident that happened back in September with Falk AG.

Re:AdBlock is unethical

[BenjyD]

It's not quite so clear cut as that, though. As I see it:

For adverts:
- Running a web site costs money. The guys running it might even want to make a living
- hiring good writers is expensive
- Advertising money is a proven revenue source for media outlets
- subscription sites don't seem to be a popular option

but, against that:
- The adverts many sites run are overly intrusive and bandwidth-intensive
- people who block adverts probably aren't the kind of people who are going to take notice of them anyway
- just cramming more and more adverts down the throats of consumers is not a sustainable policy: evevntually, everybody will block them because it's impossible to read anything on the web otherwise.

But, sites have to be paid for somehow. Do you have any suggestions of alternative profit models for web sites?

Penny-arcade seems to get by well enough on its merchandise, advertising, freelance art work etc revenue, for example. I'm not sure how well that scales to smaller sites, though.

Re:Hosts File

[HazE_nMe]

I have found a nifty IPTABLES Bash Script generator that you can use any plaintext blocklist with. Check it out here: http://www.bluetack.co.uk/converter/index.php You can use the blocklist manager from their site and build a blocklist using multiple sources and generate a bash script to import the deny rules to IPTABLES. And of course for the Windows users there is Protowall (Buggy) which is a driver level packet filtering firewall which you can enter a custom blocklist into also.

Buffer overlow protections?

[Deorus]

Last time I read about the Microsoft's buffer overflow protection implementation in Windows PX Service Pack 2, they were talking about the NX bit present in page entries when the PAE mode was active in AMD x86-64 processors. Even though that protection exists in the new AMD x86-64 processors' MMUs, Intel P4 as well as older AMD processors do not yet support that bit, which means that processes running over them do not get any page-based protection against code execution, even while running SP2.

However I see many people trusting their lives on SP2's protection even without processor support, and I don't see Microsoft willing to clarify this issue either, so I'm starting to believe that probably there is something else that I am not aware of in SP2 which simulates the same kind of protection on processors without hardware support.

Is SP2 really protecting against stack smashing (for example) on processors without hardware support for non-executable pages? Or is it just general ignorance that Microsoft exploits for their own profit?

Lol yeah right, a virus from a web page!

[t_allardyce]

The upshot is that if you visited the Register yesterday morning and use IE as your browser.

A few years ago I would have laughed at anyone who said something like that and just ignored it as paranoia by someone who didnt really know much about computers and security or who had been watching too many hacker films. Of course you can't get a virus from visiting a web page thats just stupid, who would allow such insane breaches of security? But Microsoft saw a market: they realised that since most people believed you could get a virus that way, why not match their products with peoples expectations? Next slashdot poll should be who uses IE and why...

Re:LOL

[glsunder]

If they're still using an older OS, that's tough shit for them.

There's going to be a lot of corporate computers running win2k. There's going to be some running WinNT. Times have been pretty tight, upgrading computers for some businesses isn't going to be the top priority. A lot of them dont need to upgrade. If you're using an as/400 session (or similiar telnet type app) and email, a P2 with 128MB and winNT is fine, and that covers a lot of people out there.

Re:Wow

[Anonymous Coward]

A chap on the dlsreports site said it best with regards to spyware and adware.

MS should have thought more deeply about Java and the sandbox concept. Whomever was over there that thought it would be cool to let IE do things to your computer at the command of a remote web site, and whomever signed off on that idea, was either nuts, or totally inexperienced. They shipped (and evidently still ship) a trojan writers dream toolbox and guarded it with kittens.

I fix company's computers for a living. You would not believe the sheer number of spyware shit these people inadvertantly and apparently on purpose install!

I've found in my daily rounds throughout this country that the amount of work people actually do is inversely proportional to the amount of spyware they have on their machines.

You can preach and teach to these people but they don't get it. IE BAD! Chrissakes people. How many 3 and 4 hour bills am I going to have to send you for each machine before you finally get it?

Re:"You're OK for now if you're running SP2."

[Mnemia]

Ok, I can give you specifics.
I think the problem is caused by some incompatibility between SP2 and my wireless LAN card's drivers. It doesn't happen if I don't have the card in there. I need to use the card, so there isn't anything I can do to work around this problem. Unfortunately for me the manufacturer hasn't released any patches to the (buggy I'm sure) drivers. From what I've gathered online they rely on an undocumented interface in Windows that was broken by SP2.
BTW, uninstalling and reinstalling SP2 didn't help. Microsoft's site actually acknowledges the problem with the blue screens and the specific DLL updated by SP2 that causes them, but they don't have any patch available yet.

Re:Frames considered harmful

[Cederic]

Unfortunately frames are also extremely useful.

I can do things with frames (and especially with iframes) that I can't do otherwise in HTML.

Admittedly this is because my personal HTML skills suck - I learned HTML in 1993 and haven't really caught up since..

However, the websites my company does its selling on are written by very proficient HTML developers and they still use iframes. They do so because it's the best tool for achieving their aims.

So feel free to stop using frames, even iframes, and block sites that require them. Just don't expect many sites to work afterwards.

Of course, that wont stop you getting hit by malicious banner ads. You'll need to block those or switch browser whether you accept frames or not..

~Cederic

Not surprisingly...

[thrill12]

If you visit the Falk AG website, there is nothing on the exploit. The management clearly doesn't know what to do with the problem - otherwise they would have posted a full explanation by now. Ah well, I guess they need some time to wiggle themselves out of this one.

Re:Sorry but ...

[timmyf2371]

Perhaps some of us use locked down PCs in our workplace and have no choice but to use IE as a browser.

I don't know what is more amazing

[tezza]

I don't know what is more amazing:

The fact that this attack happened

or,

The Register editors sacrificed their sacrosanct weekends to post the warning story.

Any regular reader would see that most of the stories abruptly stop at Beer O'Clock on Friday [4 p.m. roughly, depending on British Sunshine].

Due to the regular lack of stories over the weekend, I think the number of readers exposed would have been much less. If it had happened about this time [Monday morning London time] a lot more people would've been exposed.

Troll Mods on Slashdot.

[JNighthawk]

There's not a single thing flamebait about this. Because MaelstromX said something you didn't like, you modded him down. Censorship at it's finest. Re:AdBlock is unethical (Score:-1, Flamebait) by MaelstromX (739241) on Sunday November 21, @08:02PM (#10884143) Well you can keep attacking that straw man argument if you want but it has nothing to do with AdBlock. If a commmercial web site operator knew that a user had AdBlock installed, they would NOT agree to the terms of that user accessing the website, not only wasting bandwidth but acquiring the content contained on the website (which costs money to produce). Their website, their rules. Nobody is forcing you to go, you can leave at any time -- or you can stay and use unethical methods to make your visit slightly more convenient. And all of you bitching about it being within your rights to view content how you want, blah blah blah, shut up already. I am addressing the ethical wrongness of AdBlock -- you are stealing bandwidth and content without also viewing the means for which the web site creates enough revenue for the web site to sustain itself. -- As a side note, observe what happens when you go against slashbot groupthink: Due to excessive bad posting from this IP or Subnet, comment posting has temporarily been disabled. If it's you, consider this a chance to sit in the timeout corner .