Incorrect reporting of the Bofra/The Register exploit
Hi All,
In response to several regardings the spreading of the Bofra virus, it is not
correct. It was not the work of a virus but a carefully planned hack. The
Register just happened to be the site I first noticed the activity on and
performed my analysis. I contacted Falk eSolutions AG by telephone to explain
to them what was going on. The person I spoke to who clueless about the
situation but said he would forward on a message to their support team. After
an hour the attack had not stopped so I phoned again. I explained the situation
again and he gave me an address to contact their support team on. I sent them a
report of how their site was sending Internet Explorer users to the infected
search.comedycentral.com site and also sent the same report to The Register. It
wasn't until a full day later that The Register published their first report. I
received a brief e-mail from a Falk AG support engineer based in the U.K.
letting me know he'd received my e-mail but that was it. I've hea
rd nothing from them since nor from The Register.
I've kept a thread on http://www.finlandforum.org/bb/viewtopic.php?t=7685
documenting what I've found along the way. This is an unpatched exploit and the
figures that Falk AG are quoting are incorrect. This attack has been aimed at
other sites too so I feel it's much further widespread than is thought.
Regards,
Matt