Euro Web sites spread Bofra worm via banner ads

Web site visitors who clicked on banner ads on a number of popular European Web sites this weekend could have infected their computers with variants of the Bofra worm, experts warned on Monday.

The attacks take advantage of an unpatched buffer overflow flaw in the way Internet Explorer 6 (IE) handles the IFrame tag, and has been confirmed on PCs running Windows XP with Service Pack 1 and Windows 2000, according to a warning posted Sunday on the SANS (SysAdmin, Audit, Network, Security) Institute Web site. Windows XP Service Pack 2 (SP2) is not vulnerable, it said.

The vulnerability allows attackers to gain complete control of a user's computer.

Also on Sunday, U.K. technology news Web site The Register reported that its third party ad serving company Falk became infected with the Bofra/IFrame exploit, forcing the Web site to suspend its ads from Falk.

"If you may have visited the Register...on Saturday, Nov. 20 using any Windows platform bar XP SP2 we strongly advise you to check your machine with up to date anti-virus software, to install SP2 if you are running Windows XP, and to strongly consider running an alternative browser, at least until Microsoft deals with the issue," The Register said on its Web site.

According to SANS, there were also reports of sites in Sweden and the Netherlands being compromised by the malicious code.

In the Netherlands, the country's biggest news site,, with over 450,000 unique visitors per month, was infected through the ad system of Falk eSolutions and served the code to its visitors. Additionally, the other sites of Ilse Media, including one of the largest Dutch sites Startpagina, distributed the Trojan horse as well.

Adserver tags and link addresses were manipulated in order to install and execute the malware. User requests were redirected from Falk's servers to the URL (uniform resource locator) "" (, from where the malicious code was delivered, Falk said in a statement.

Falk denied that its advertisement serving systems were hacked. It said that an attack on a Web-traffic, load-balancing system spread the code. The compromised load balancer redirected about every 30 requests for the Falk's advertisement distribution servers to compromised Web sites that served the malicious code, the company said in the statement.

At least one security expert disputed that claim.

"We saw HTML (Hypertext Markup Language) code that included the exploit code distributed from (Falk's) servers," said Joe Stewart, senior security researcher at LURHQ, a managed security services provider (MSSP) in Myrtle Beach, South Carolina. Either Falk's ad serving systems were compromised by the hackers, or malicious hackers found another way to have their attack code distributed by the German company, perhaps by disguising the code as a legitimate advertisement, then paying Falk to run it, he said.

Given that the attackers may have compromised Web sites like those at, there's no reason to think that they wouldn't compromise Falk's, as well, Stewart said.

Without more information from Falk or other companies involved in the attacks, including Viacom Inc. , which owns the domain, it is unlikely the public will know how the malicious code was hidden in advertisements on legitimate Web sites, said Daniel Frasnelli, manager of the technical assistance center at NetSec.

Falk's competitor Adtech released its own statement saying that its adserving system Helios was not affected by the problem.

The attacks all make use of the same vulnerability in Microsoft's Internet Explorer Web browser. A problem with the way IE processes Web pages with long strings of characters encoded with the IFRAME HTML tag allows malicious hackers to create a buffer overflow condition and run their own code on vulnerable Windows machines, Stewart said.

IFRAME attacks can be carried out behind the scenes, using IE or Microsoft's Outlook and Outlook Express e-mail programs. Windows users have no indication or warning that their systems are being compromised, he said.

"It's about as bad is you can get for IE exploits," Stewart said.

Microsoft has yet to issue a patch for the IE IFrame hole for users who have not installed SP2. However, some "unofficial" patches have been released, including one from a German security researcher at the Web site,

The attacks are more bad press for Microsoft's Web browser, which is facing competition from a new generation of browsers such as the Mozilla Foundation's Firefox and Apple Computer's Safari browser. Changing to an alternative Web browser is one way to avoid exploitation using the latest attack, according to security experts.

"Microsoft cannot be pleased with something like this," Frasnelli said.

The hit against Falk's service is very similar in style to a June attack on approximately 100 Web sites by a Russian hacking group known as the "hangUP team." The group used a recently patched buffer overflow vulnerability in Microsoft's implementation of SSL (secure sockets layer) to compromise vulnerable Windows 2000 systems running IIS Version 5 Web servers, said Johannes Ullrich, chief technology officer at the SANS Internet Storm Center.

Those attacks also used two vulnerabilities in Windows and the Internet Explorer Web browser to run the malicious code distributed from the IIS servers on machines that visited compromised sites. The code redirected users to Web sites controlled by the hackers and downloaded a Trojan horse program that captures keystrokes and personal data.

These attacks and others, including a September denial of service attacks against Lightbridge's payment processing service Authorize.Net, highlight the vulnerability of the Internet to security "choke points." Such choke points comprise low-profile but highly connected Web sites and services that serve content that is trusted by thousands or even millions of other Web sites, Ullrich said.

(Wilbert de Vries of WebWereld Netherlands contributed to this report.)

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Laura Rohde and Paul Roberts

IDG News Service
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill


I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?