Slashdot Mirror
Worm Exploit Distributed by Advertising Network
Zocalo writes "Given that a lot of Slashdot readers also check The Register, it's important to note that their Internet advertising provider, Falk AG, was compromised by the BOFRA exploit yesterday. The Falk AG service has been suspended by The Register and a statement from Falk AG is due on Monday. The upshot is that if you visited the Register yesterday morning and use IE as your browser, then you probably need to run a full virus scan with up to date data files. Of course, those of us running other browsers and something like AdBlock have nothing to worry about. Again." You're OK for now if you're running SP2. There's also a good security writeup about the problem.
This is a really big problem. Okay, so its Register and they realized this and stopped it. But we visit so many other websites - how are we to know which one of those ad providers are infected and which are not?
Sheesh, where is accountability? Blame the sysadmins, blame the software, pity the customer. Lather, rinse repeat.
Maybe site owners will start moving or demanding text-based ads (like Google's)?
Rock that crushes, Paper & Scissors that don't matter.
.. falkag.net are the second entry in my ad filter, right after doubleclick
how many ie users have switched to sp2 ,yet ?
Trolling using another account since 2005.
You're OK for now if you're running SP2.
Ummm... My Win machine is running SP4. Oh, you mean XP SP2. Not on my machines, man... The highest I'll go on my personal machines is 2k.
Aside, you left out another browser of very worthy note. Oh, well, make that two.
I'm not a prophet or a stone-age man,
I'm just a mortal with potential of a super man.
Sad thing was the company was based in the Netherlands so it wasn't even worth pursuing legally... but if you are on the net, you aren't safe. MS products are more insecure, but you should always take steps to protect yourself, like keep the OS and applications up to date, etc etc
Agile Artisans
I guess I should stop using Lynx then! It's unethical since I don't see images.
So if your XP machine is up to date you're ok?
That's kool, because all I do is download new browsers for security and never run windows update. That would make too much sense...
Utter drivel. I suppose you think that it is "theft" to change the channel on the TV when adverts come on, as well. Is it also "theft" to turn the page of a magazine without looking at the adverts on it? As far as I am concerned, advertising is a form of pollution. It reduces the visual beauty of the environment and I don't want to see it.
flossie
Write now. Defend liberty
"Extensions and programs like AdBlock are tantamount to theft; you are acquiring the content but not "paying" for it by loading the advertisements."
Um, it is clearly *your* problem if your website's cash flow relies on wasting my bandwidth with advertisements.
Your supposed 'right' to profit does not extend to the point where I have to bend my life around your profit model. Thanks.
Are you saying that it is wrong to house the homeless?!
flossie
Write now. Defend liberty
AdBlock is unethical [...] Extensions and programs like AdBlock are tantamount to theft
It's kinda ironic that a lot of the ads on tech sites are advertising anti-spyware/pop-ups/ads/adware/spam tools, isn't it?
Maybe if these companies agree with you that the use of these tools constitute fraud/theft, then they should stop advertising them.
You're a troll, but I'm biting even so.
We are under no obligation to play by whatever crooked-up business model a company cooks up. Unless I sign/click an agreement to view the ads, they don't have a legal leg, nor a moral one for that matter, to stand on.
They offer a web-page because they have something to say. I select how to view it. What more is there to it?
I guess you're ok with printer cartridge prices too? After all, its 'their business model' and not following it would be 'theft of service and fraud'?
"" How about taking the safety labels off everything, and let the stupidity-problem solve itself? """
This worm gives new meaning to the term "viral marketing"...
-Valen
It's not the first time this has happened either, see this article relating to an incident that happened back in September with Falk AG.
Never email donotemail@WeAreSpammers.com
"Would it kill you to put down the toilet seat?" -- Maya Angelou
In that case, feel free to use this version that uses "0.0.0.0" instead.
It's not quite so clear cut as that, though. As I see it:
For adverts:
- Running a web site costs money. The guys running it might even want to make a living
- hiring good writers is expensive
- Advertising money is a proven revenue source for media outlets
- subscription sites don't seem to be a popular option
but, against that:
- The adverts many sites run are overly intrusive and bandwidth-intensive
- people who block adverts probably aren't the kind of people who are going to take notice of them anyway
- just cramming more and more adverts down the throats of consumers is not a sustainable policy: evevntually, everybody will block them because it's impossible to read anything on the web otherwise.
But, sites have to be paid for somehow. Do you have any suggestions of alternative profit models for web sites?
Penny-arcade seems to get by well enough on its merchandise, advertising, freelance art work etc revenue, for example. I'm not sure how well that scales to smaller sites, though.
The ISC has more details here and here.
The latest version for many users is IE 6 SP1, which is vulnerable. Not everybody has XP, and even a lot of XP users still don't have SP2 (you try downloading it over a dialup line sometime).
There was never any agreement between me and the website admins that I had a limited license to view the content predicated by my looking at ads. Websites that are on the internet are free to the consumer, unless explicitly stated otherwise.
Ceci n'est pas une sig.
:wq!
The write up for the attack is incorrect. The correct sequence of events is at http://www.finlandforum.org/bb/viewtopic.php?t=768 5. I know because I noticed it at The Register first and contacted Falk AG. Thanks for the aknowledgement too Slashdot, NOT.
I still see the adds on penny arcade because they are small enough it's not worth my effort to block them, and occasionally something interesting comes up.
:\
I see no adds here because they are huge flash obscenities for Microsoft FUD campaigns.
You want clickthroughs? Rethink your ad placement policies. (If I could select as a pref nothing but text adds for Linux/Unix/Hardware with _informational_ content - I might well see adds on Slashdot. And you might get paid more that the 0 you get for me at present.)
The thing that pisses me off most of course is that the ultra lightweight version still has the heavy and blotated flash/animated adverts
Beep beep.
Last time I read about the Microsoft's buffer overflow protection implementation in Windows PX Service Pack 2, they were talking about the NX bit present in page entries when the PAE mode was active in AMD x86-64 processors. Even though that protection exists in the new AMD x86-64 processors' MMUs, Intel P4 as well as older AMD processors do not yet support that bit, which means that processes running over them do not get any page-based protection against code execution, even while running SP2.
However I see many people trusting their lives on SP2's protection even without processor support, and I don't see Microsoft willing to clarify this issue either, so I'm starting to believe that probably there is something else that I am not aware of in SP2 which simulates the same kind of protection on processors without hardware support.
Is SP2 really protecting against stack smashing (for example) on processors without hardware support for non-executable pages? Or is it just general ignorance that Microsoft exploits for their own profit?
Yes it's a lie. They haven't suspended the service. When I first contacted the Falk AG support team in Germany they were clueless. It took them several hours before I received a response after I'd sent them an e-mail documenting the attack and where the exploit was on their site. I forwarded the same e-mail to several people at The Register too. Later today the article appeared on their site. I don't think The Register had any idea what was going on until much later. The original infection was in http://f.as-eu.falkag.net/server/asldata.js?rdm=01 684246 which was ad based just below the banner. What's there now is I think just data mining.
Bitter and proud of it.
For one, to those people commenting about how some people say that they don't want to use SP2... It isn't their fault that they don't want to. When I installed SP2 on my computer, that was using a legal copy of Windows XP, my computer BSODed and the boot sector was screwed over. This was a mistake on the count of Microsoft that deleted a number of documents that I thought were in a stable, safe place. I now make a backup of all my data to an external hard drive every other day to make sure this doesn't happen. Another comment I would like to make is for the people that are saying that ads are the only sources of revenue that websites have and we should be forced to read them and not block them. Yes, I agree that some websites need ads for money to run the site, but some ads are downright obnoxious. There are, however, sites that live off of things such as Google text only ads. www.neowin.net is an example, where you see at the top of the page only a simple text ad, or once in a while a picture ad. They are a fairly large website, and yet they support themselves by only a text ad. Interesting, isn't it? People rave about how websites absolutely have to have tons of ads to live, and yet Neowin has been living for a good 5 years now on text ads...
Put it this way: Firefox offers pre-WinXP users a *free* path to being secure. Microsoft forces them to spend a significant amount of money.
No, the latest version for EVERYONE is IE6 SP2. If they're still using an older OS, that's tough shit for them. You can't say "Well the latest version of Windows is XP, but some people decided not to upgrade so the latest version for them is 2000." It just makes no sense.
Yet another disadvantage of tying the web browser to the OS. Atleast the latest versions of Opera and Firefox run on Windows 95 just fine.
Besides, I don't think IE6SP2 runs on Windows 2003 Server. What do you have to say to users of that OS?
Perhaps I would say stop surfing the net from the server, O Master of Secure Computing.