Bofra not special to UK
p2pnet.net News:- Hundreds of sites across Europe may be open to a vulnerability that was first thought to be localized in the UK.
SANS Internet Storm Center says it recently had a report of a high profile British site containing a pointer on the main page to another URL hosting the Bofra/IFrame exploit.
The UK hole has been fixed, says director Marcus Sachs but, "We have received reports of sites in Sweden and the Netherlands that were also compromised," it says.
"This may indicate a more wide-spread attack across Europe. One suggestion is that the advertising servers rather than the sites themselves contain the exploit, which of course means that perhaps hundreds of sites are affected."
Storm Center recommends using an alternative browser when visiting sites, "other than those you absolutely trust," it says, also pointing out that XP SP2 is reported as not being vulnerable, "and to this point we have nothing contrary".
"Bofra-A poses as photos from an adult webcam in an attempt to fool users into clicking on a link," says The Register. "Clicking on the link causes the targeted PC to run malicious script hosted on a previously infected computer. This exploits the discovered IFRAME vulnerability in IE in an attempt to infect the target computer."
Hackers have already attacked several European Web sites using the as yet un-patched IFRAME exploit, otherwise known as Bofra, in Internet Explorer 6.0, says ZDNet UK, going oni:
"Users who have clicked on the ads have seen their computers infected by the Bofra worm, which emerged … five days after the vulnerability was announced earlier this month.
"The worm combines multiple attack techniques using spamming, social engineering, virus infection and Trojans to attack its victims’ computers."
===================
See:-
high profile - Bofra/IFrame Exploits on More Web Sites (updated), SANS Internet Storm Center, November 21, 2004
adult webcam - Bofra worm sets trap for unwary, The Register, November 10, 2004
already attacked – Hackers launch Bofra banner ad attacks, ZDNet UK, November 22, 2004
