Worm hidden in UK site's banner ads

Windows users who clicked on a banner ad on UK technology news website the Register on Saturday morning could have infected their...

Windows users who clicked on a banner ad on UK technology news website the Register on Saturday morning could have infected their computer with a variant of the Bofra worm.

The Register said that its third-party ad serving company Falk had become infected with the Bofra/IFrame exploit, forcing the site to suspend ads from Falk.

"If you may have visited the Register between 6am and 12.30pm on Saturday 20 November using any Windows platform bar XP SP2, we strongly advise you to check your machine with up-to-date antivirus software, to install SP2 if you are running Windows XP, and to strongly consider running an alternative browser, at least until Microsoft deals with the issue," the Register said.

The attack takes advantage of an unpatched buffer overflow flaw in the way Internet Explorer 6 handles the IFrame tag, and has been confirmed on PCs running Windows XP with Service Pack 1 and Windows 2000, according to a warning from the Sans Institute. Sans said Windows XP Service Pack 2 was not vulnerable.

The vulnerability allows attackers to gain complete control of a user's computer.

According to Sans, sites in Sweden and the Netherlands were also compromised by the malicious code.

Germany company Falk said that user requests were redirected from its servers to the URL "search.comedycentral.com" (, from where the malicious code was delivered.

Falk denied that its advertisement serving systems had been hacked and said an attack on a web-traffic, load-balancing system had spread the code. The compromised load balancer redirected about every 30 requests for Falk's advertisement distribution servers to compromised websites that served the malicious code.

At least one security expert disputed Falk's claim.

"We saw HTML code that included the exploit code distributed from Falk's servers," said Joe Stewart, senior security researcher at managed security services provider LURHQ. Stewart said either Falk's ad serving systems had been compromised by the hackers, or malicious hackers had found another way to have their attack code distributed by the company, perhaps by disguising the code as a legitimate advertisement, then paying Falk to run it.

Given that the attackers may have compromised websites like those at comedycentral.com, there was no reason to think that they wouldn't compromise Falk's as well, he added.

Daniel Frasnelli, manager of the technical assistance centre at NetSec, said that without more information from Falk or other companies involved in the attacks, it was unlikely that the public would know how the malicious code had been hidden in advertisements on legitimate websites.

The attacks all make use of the same vulnerability in Microsoft's Internet Explorer. A problem with the way Internet Explorer processes web pages with long strings of characters encoded with the IFrame HTML tag allows hackers to create a buffer overflow condition and run their own code on vulnerable Windows machines.

IFrame attacks can be carried out behind the scenes, using Internet Explorer, Outlook or Outlook Express. Windows users have no indication or warning that their systems are being compromised.

"It's about as bad is you can get for Internet Explorer exploits," Stewart said.

Microsoft has yet to issue a patch for the Internet Explorer IFrame hole for users who have not installed SP2. However, "unofficial" patches have been released, including one from a German security researcher at the website cherryware.de.

The attacks are more bad press for Microsoft's web browser, which is facing competition from a new generation of browsers such as Firefox and Safari. Changing to an alternative browser is one way to avoid exploitation using the latest attack, according to security experts.

"Microsoft cannot be pleased with something like this," Frasnelli said.

The hit against Falk's service is very similar in style to an attack in June on around 100 websites by Russian hacking group the HangUp team. Johannes Ullrich, chief technology officer at Sans, said HangUp had used a recently patched buffer overflow vulnerability in Microsoft's implementation of SSL to compromise vulnerable Windows 2000 systems running IIS version 5 web servers.

Those attacks also used two vulnerabilities in Windows and Internet Explorer to run the malicious code distributed from the IIS servers on machines that visited compromised sites. The code redirected users to sites controlled by the hackers, downloading a trojan to capture keystrokes and personal data.

These attacks and others, including a September denial of service against Lightbridge's payment processing service Authorize.Net, highlight the vulnerability of the internet to security "choke points." Such choke points consist of low-profile but highly connected websites and services that serve content trusted by thousands, even millions of other sites.

Laura Rohde and Paul Roberts write for IDG News Service

Read more on IT risk management