Incorrect reporting of the Bofra/The Register exploit

[<matt () welho com>]

Hi All,

In response to several regardings the spreading of the Bofra virus, it is not correct. It was not the work of a virus 
but a carefully planned hack. The Register just happened to be the site I first noticed the activity on and performed 
my analysis. I contacted Falk eSolutions AG by telephone to explain to them what was going on. The person I spoke to 
who clueless about the situation but said he would forward on a message to their support team. After an hour the attack 
had not stopped so I phoned again. I explained the situation again and he gave me an address to contact their support 
team on. I sent them a report of how their site was sending Internet Explorer users to the infected 
search.comedycentral.com site and also sent the same report to The Register. It wasn't until a full day later that The 
Register published their first report. I received a brief e-mail from a Falk AG support engineer based in the U.K. 
letting me know he'd received my e-mail but that was it. I've hea
 rd nothing from them since nor from The Register.

I've kept a thread on http://www.finlandforum.org/bb/viewtopic.php?t=7685 documenting what I've found along the way. 
This is an unpatched exploit and the figures that Falk AG are quoting are incorrect. This attack has been aimed at 
other sites too so I feel it's much further widespread than is thought.

Regards,

Matt