TELECOM Digest OnLine - Sorted: Re: Bofra Exploit Hits The Register ad Serving Supplier

Re: Bofra Exploit Hits The Register ad Serving Supplier

Monty Solomon (monty@roscom.com)
Wed, 24 Nov 2004 16:03:30 -0500

http://www.theregister.co.uk/2004/11/23/register_restores_adserver/

Register restores ad service
By Team Register

Site Notice On Saturday, The Register suspended service by third party
ad serving supplier, Falk, following security issues detailed
here. http://www.falkag.com/news.php?Id=26

Today we have restored the service, after satisfying ourselves that
this problem is fixed. Falk's statement on what went wrong is here.

Our thanks for all your emails. We appreciate the kind words and note
the performance issues that many of you raise. We will be seeking to
address this in coming weeks.

At a rough guess, the number of Reg readers exposed to the Bofra
/IFrame exploit was in the low hundreds. We have no means of
estimating how many of these were protected by firewalls or anti-virus
software protection.

During the period Falk's service was compromised -- between 6.10am and
12.30pm on Saturday, 11660 unique individuals using Windows and IE6
visited The Register. We haven't drilled down the different flavours
of Windows, but we assume that the majority were not on Windows XP SP2
boxes. Reader with Windows XP SP2 are protected from the Bofra /IFrame
exploit, along with the rest of the non-Windows world. On average
readers looked at three pages a pop. So that's around 35,000 pages in
which the rogue ad could have been served. According to Falk, one in
30 requests for a banner ad were redirects to the site containing the
bofra worm. If this is correct around 1,170 rogue ads were served on
our site.

We apologise again for exposing readers to this. We also urge readers
using IE on Windows to switch browsers, at least until the iFrame
exploit is patched properly.

Here is advice from McAfee on removing the Bofra worm.
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=129629

Post Followup Article Use your browser's quoting feature to quote article into reply
Go to Next message: Andrew Bell: "Re: How Do I Learn an Unknown Number?"
Go to Previous message: Joseph: "Re: How to Pronounce "Skype""
TELECOM Digest: Home Page