Security threats Toolkit

Hackers launch Bofra banner ad attacks

Tags:
Europe,
Sans,
Bofra,
Hacking

Dan Ilet ZDNet.co.uk

Published: 22 Nov 2004 15:05 GMT

Security experts are warning that hackers may have launched a wide-spread attack in Europe using banner ads to redirect users to Web sites that download malicious code.

After receiving several reports of rogue banner ads infecting users, researchers at the SANS Internet Storm Center have cautioned that hackers may have attacked a large number of servers hosting the adverts. This means that hackers would reach a larger number of victims on hundreds of sites by 'advertising' to click the ad that would lead to the code.

Hackers have already attacked several European Web sites using the as yet un-patched IFRAME exploit, otherwise known as Bofra, in Internet Explorer 6.0.

"The Storm Center received a report of a high profile UK Web site that contains a pointer on their main page to another URL hosting the Bofra/IFRAME exploit," wrote Marcus Sachs director of the SANS Internet Storm Center. "We have confirmed that if this site is visited using Internet Explorer the exploit will be downloaded. Please exercise caution when using Microsoft's Internet Explorer since this issue has no current patch. The Storm Center recommends using an alternative browser when visiting sites other than those you absolutely trust."

Banner ads are an ideal tool for mass distribution of malicious code because they are able to distribute code on many Web sites at the same time.

Users who have clicked on the ads have seen their computers infected by the Bofra worm, which emerged head five days after the vulnerability was announced earlier this month.

The worm combines multiple attack techniques using spamming, social engineering, virus infection and Trojans to attack its victims' computers.

Windows XP users who have loaded Service Pack 2 are thought not to be affected by the worm. Microsoft has yet to release a patch for the exploit, but earlier this month the company chastised the independent researchers who published the vulnerability for failing to inform it first.