bugtraq - Incorrect reporting of the Bofra/The Register exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20041122210228.11355.qmail@www.securityfocus.com>
Date: 22 Nov 2004 21:02:28 -0000
From: <matt@...ho.com>
To: bugtraq@...urityfocus.com
Subject: Incorrect reporting of the Bofra/The Register exploit

Hi All,

In response to several regardings the spreading of the Bofra virus, it is not correct. It was not the work of a virus but a carefully planned hack. The Register just happened to be the site I first noticed the activity on and performed my analysis. I contacted Falk eSolutions AG by telephone to explain to them what was going on. The person I spoke to who clueless about the situation but said he would forward on a message to their support team. After an hour the attack had not stopped so I phoned again. I explained the situation again and he gave me an address to contact their support team on. I sent them a report of how their site was sending Internet Explorer users to the infected search.comedycentral.com site and also sent the same report to The Register. It wasn't until a full day later that The Register published their first report. I received a brief e-mail from a Falk AG support engineer based in the U.K. letting me know he'd received my e-mail but that was it. I've heard nothing from them since nor from The Register.

I've kept a thread on http://www.finlandforum.org/bb/viewtopic.php?t=7685 documenting what I've found along the way. This is an unpatched exploit and the figures that Falk AG are quoting are incorrect. This attack has been aimed at other sites too so I feel it's much further widespread than is thought.

Regards,

Matt