Windows users who clicked on a banner ad on UK
technology news website the Register on Saturday morning could have
infected their computer with a variant of the Bofra
worm.
The Register said that its third-party ad serving company Falk
had become infected with the Bofra/IFrame exploit, forcing the site
to suspend ads from Falk.
"If you may have visited the Register between 6am and 12.30pm on
Saturday 20 November using any Windows platform bar XP SP2, we
strongly advise you to check your machine with up-to-date antivirus
software, to install SP2 if you are running Windows XP, and to
strongly consider running an alternative browser, at least until
Microsoft deals with the issue," the Register said.
The attack takes advantage of an unpatched buffer overflow flaw
in the way Internet Explorer 6 handles the IFrame tag, and has been
confirmed on PCs running Windows XP with Service Pack 1 and Windows
2000, according to a warning from the Sans Institute. Sans said
Windows XP Service Pack 2 was not vulnerable.
The vulnerability allows attackers to gain complete control of a
user's computer.
According to Sans, sites in Sweden and the Netherlands were also
compromised by the malicious code.
Germany company Falk said that user requests were redirected
from its servers to the URL "search.comedycentral.com"
(199.107.184.146), from where the malicious code was delivered.
Falk denied that its advertisement serving systems had been
hacked and said an attack on a web-traffic, load-balancing system
had spread the code. The compromised load balancer redirected about
every 30 requests for Falk's advertisement distribution servers to
compromised websites that served the malicious code.
At least one security expert disputed Falk's claim.
"We saw HTML code that included the exploit code distributed
from Falk's servers," said Joe Stewart, senior security researcher
at managed security services provider LURHQ. Stewart said either
Falk's ad serving systems had been compromised by the hackers, or
malicious hackers had found another way to have their attack code
distributed by the company, perhaps by disguising the code as a
legitimate advertisement, then paying Falk to run it.
Given that the attackers may have compromised websites like
those at comedycentral.com, there was no reason to think that they
wouldn't compromise Falk's as well, he added.
Daniel Frasnelli, manager of the technical assistance centre at
NetSec, said that without more information from Falk or other
companies involved in the attacks, it was unlikely that the public
would know how the malicious code had been hidden in advertisements
on legitimate websites.
The attacks all make use of the same vulnerability in
Microsoft's Internet Explorer. A problem with the way Internet
Explorer processes web pages with long strings of characters
encoded with the IFrame HTML tag allows hackers to create a buffer
overflow condition and run their own code on vulnerable Windows
machines.
IFrame attacks can be carried out behind the scenes, using
Internet Explorer, Outlook or Outlook Express. Windows users have
no indication or warning that their systems are being
compromised.
"It's about as bad is you can get for Internet Explorer
exploits," Stewart said.
Microsoft has yet to issue a patch for the Internet Explorer
IFrame hole for users who have not installed SP2. However,
"unofficial" patches have been released, including one from a
German security researcher at the website cherryware.de.
The attacks are more bad press for Microsoft's web browser,
which is facing competition from a new generation of browsers such
as Firefox and Safari. Changing to an alternative browser is one
way to avoid exploitation using the latest attack, according to
security experts.
"Microsoft cannot be pleased with something like this,"
Frasnelli said.
The hit against Falk's service is very similar in style to an
attack in June on around 100 websites by Russian hacking group the
HangUp team. Johannes Ullrich, chief technology officer at Sans,
said HangUp had used a recently patched buffer overflow
vulnerability in Microsoft's implementation of SSL to compromise
vulnerable Windows 2000 systems running IIS version 5 web
servers.
Those attacks also used two vulnerabilities in Windows and
Internet Explorer to run the malicious code distributed from the
IIS servers on machines that visited compromised sites. The code
redirected users to sites controlled by the hackers, downloading a
trojan to capture keystrokes and personal data.
These attacks and others, including a September denial of
service against Lightbridge's payment processing service
Authorize.Net, highlight the vulnerability of the internet to
security "choke points." Such choke points consist of low-profile
but highly connected websites and services that serve content
trusted by thousands, even millions of other sites.
Laura Rohde and Paul Roberts write for IDG News
Service