Published: 2006-02-03
A two-week window separated the development of the exploit and the discovery of suspicious activity, according to an eWeek article. During these two weeks the exploit code was available on underground websites -- at a $4,000 cost.
Details regarding the first release of the exploit are still being discovered, however the eWeek article mentions an early relationship with a stock pump-and-dump scheme, where the WMF flaw was used quietly for quick financial gain.
A BugTraq posting in late December was first to show a website actively implementing the WMF flaw, and the flurry of activity that followed sent the security community into overdrive -- over one thousand malicious WMF files were detected in the days following the post.
Posted by: Peter Laborge
