PERL.Santy is a worm that utilized the search engine Google in order to search for vulnerable web sites running phpBB software. phpBB 2.0.10 is affected; 2.0.11 is not. Vulnerable web sites will have this at the footer:
Powered by phpBB 2.0.10 © 2001 phpBB Group
Yet again, F-Secure's weblog did an excellent job of covering a major event:like this and I highly recommend it. Defaced sites typically display the text, in red, with varying fonts:
This site is defaced!!!
NeverEverNoSanity WebWorm generation x.
x here represents the number of infections that this worm has made before, similar to the generations in any human disease (thus not allowing us to know exactly the number of infections, since there can be multiple infections for each generation.) So far the highest generation that both Google and MSN show is 24.
Fortunately, Google has blocked the search string that Santy uses to spread, so further infections are unlikely. This was done around midnight GMT. Google sent F-Secure this reply:
While a seven hour response for something like this is not outrageous, we think we can and should do better. We will be reviewing our procedures to improve our response time in the future to similar problems.
This is a good response in my eyes and hopefully the .B variant, which has appeared, will do little.
However, all users running phpBB 2.0.10 should IMMEDIATELY upgrade to phpBB 2.0.11 as this exploit allows anyone to hack outdated sites, not just the Santy worm.
Posted
Dec 22 2004, 05:11 PM
by
trafton