"Worm" crisis worldwide...


Page 1 of 3
Goto page 1, 2, 3  Next
 

Post "Worm" crisis worldwide...

#1  Tormie 30 Dec 2004 01:25

Hi friends, even if I have already done the necessary modifications and upgrades to the forum something strange could happen anyway, so I'm doing fresh backups of the site on a weekly basis. I suspect that all that online guest (133 yesterdays) are tries to hack the site, but they were unsucessfull till now. I hope that nothing strange will happen to the site.

These are the news:

[i:bf930d57ec]Today a lot of Webservers have been hacked by a so called "Net-Worm.Perl.Santy.a". This worm infects certain web sites by exploiting a vulnerability in phpBB. Santy.a is spreading rapidly, and has caused an epidemic. Santy.a is something of a novelty - it creates a specially formulated Google search request, which results in a list of sites running vulnerable versions of phpBB. It then sends a request containing a procedure which will trigger the vulnerability to these sites. Once the attacked server processes the request, the worm will penetrate the site, gaining control over the resource. It then repeats this routine. Once the worm has gained control over a site, it will scan all directories on the infected site. All files with the extensions .htm, .php, .asp, .shtm, .jsp and phtm will be overwritten with the text 'This site is defaced!!! This site is defaced!!! NeverEverNoSanity WebWorm generation'. Apart from defacing infected sites with this text, the worm has no pay load. It will not infect machines which are used to view infected sites. We recommend that all users of phpBB should upgrade to version 2.0.11 to prevent their sites from being defaced[/i:bf930d57ec]
-------------------------------------------------------------------------
[i:bf930d57ec]Web search engine company Google is blocking efforts by a new Internet worm to use its search engine to find vulnerable computers on the Internet, the company announced this week.

Google is blocking searches launched by Santy.A, a new Internet worm that targets servers running phpBB, a popular electronic bulletin board software package, according to a statement from the company. Without any native ability to scan for vulnerable computers, Google's action halted Santy.A's spread, according to antivirus companies.

Santy.A targets servers running phpBB. Antivirus companies first detected the worm Tuesday, though it may have been spreading silently well before that, according to Johannes Ullrich, chief technology officer at The SANS Institute's Internet Storm Center.

The worm used a vulnerability in phpBB, an open source software product that is managed by the phpBB Group, to spread across the Internet, infecting computer servers that host online bulletin boards and defacing those sites with the words "This site is defaced!!! NeverEverNoSanity WebWorm."

A phpBB component called viewtopic.php allows malicious commands to be passed to and executed on servers that run a vulnerable version of the phpBB software. Secunia, a Copenhagen-based security company, first reported the vulnerability on November 19. An updated version of phpBB software that fixes the flaw was released on November 18.


Impact Uncertain

Estimates of the impact of the Santy worm vary widely. Searches on a beta version of Microsoft's MSN Search feature for the text used to deface sites returned over 30,000 hits. However, identical searches on other engines, including the official MSN Search engine, Yahoo, and Google search engines returned far fewer hits, ranging from 785 (MSN) to 2030 (Yahoo).

However, using searches for telltale signs of infection, such as defacement text, is an inexact way to determine the actual number of Santy infections, says Ullrich.

"Santy will only deface sites if it can overwrite files, and it may not always be able to do that based on the configuration of the Web server [running phpBB]," he says.

Also, an analysis of the Santy code revealed that the worm spread quietly for a while, infecting phpBB servers but not overwriting files and defacing the bulletin boards, Ullrich says.

The Santy worm marked some firsts, including the use of a popular search engine as part of a worm's spreading mechanism. However, the lessons to be learned from Santy's spread are already well established: keep on top of software patches and "harden" the configuration of public-facing servers by preventing users from being able to take unnecessary actions, such as overwriting files, he says.[/i:bf930d57ec]
 




____________
 
avatar
it.png Tormie Gender: Male
Posette enthusiast
Posette enthusiast
Life + 1
Life + 1
Renderosity Ban
Renderosity Ban
 
Joined: March 2003
Posts: 8280
Tomatoes 72512
Lemons 50450
hearts 5031

  • Back to top Page bottom
 

Post 

#2  tda42 30 Dec 2004 18:32

         There goes the neighborhood.
 



 
avatar
blank.gif tda42 Gender: Male
...Pink Paws...
...Pink Paws...
Posette enthusiast
Posette enthusiast
Life + 1
Life + 1
Old Timer
Old Timer
 
Joined: November 2003
Location: Tennessee, The Great Polecat State
Posts: 2551
Tomatoes 22450
Lemons 12546
hearts 3910

  • Back to top Page bottom
 

Post 

#3  Tormie 30 Dec 2004 20:08

Posy   succeded to stop the evil bots       ...
 




____________
 
avatar
it.png Tormie Gender: Male
Posette enthusiast
Posette enthusiast
Life + 1
Life + 1
Renderosity Ban
Renderosity Ban
 
Joined: March 2003
Posts: 8280
Tomatoes 72512
Lemons 50450
hearts 5031

  • Back to top Page bottom
 

Post 

#4  Landman 30 Dec 2004 21:41

Interesting...
It is true. There is also a santy.b as well...
it looks like you would know it if the site was infected with the santy.a virus. santy.b looks like it would be a little harder to detect. However, it looks as if a current up to date phpBB is all you need for protection...

santy.a
http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?ID=41176

santy.b
http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?ID=41262
 




____________
I'd rather have a bottle in front of me then a frontal lobotomy.......

My grey matter is turning white, my proof is my grey hair....
 
avatar
 Landman Gender: Male
Posette enthusiast
Posette enthusiast
Life + 1
Life + 1
 
Joined: June 2003
Location: Grants Pass, Oregon (but http://www.iam.ca)
Posts: 930
Tomatoes 9180
Lemons 5100
hearts 0

  • Back to top Page bottom
 

Post 

#5  Tormie 30 Dec 2004 22:30

I know it Landy, but upgrading from 2.06 which is the version of the site's forum to 2.11, the last and bulletproof version means tons of files to edit, and you know how I'm lazy... Actually the phpBB version I'm using here is an already modded version called "Minerva" and I made myself a lot of adds and updating, so I can't simply take the last phpBB version and upgrade the site to it because we would loose a lot of features. I applied the most critical updates and it seems we are able to resist the attacks   ... Yesterday we had a massive attack, 133 bots online at the same time   ...

What I can do is to upgrade little by little to the last phpBB version...
 




____________
 
avatar
it.png Tormie Gender: Male
Posette enthusiast
Posette enthusiast
Life + 1
Life + 1
Renderosity Ban
Renderosity Ban
 
Joined: March 2003
Posts: 8280
Tomatoes 72512
Lemons 50450
hearts 5031

  • Back to top Page bottom
 

Post 

#6  Poserkatz 30 Dec 2004 23:00

Mhm, i hope, it will all goes right and no harm will get this site.
I hate those fu**ing guys, who make viruses and software to destroy. Those guys are bloody dumb men...   - they don't have creativity and therefore they must destroy the h ard work of others...  

Good luck to ya Tormie.
 



 
avatar
 Poserkatz Gender: Male
Forums Veteran
Forums Veteran
Life + 1
Life + 1
 
Joined: October 2004
Location: Germany
Posts: 274
Tomatoes 2580
Lemons 1762
hearts 0

  • Back to top Page bottom
 

Post 

#7  Tormie 30 Dec 2004 23:07

Don't worry PK   ! I'm backing up the most valuable part of our site, the database, on a daily basis now... I can rebuild the rest but not the database...
 




____________
 
avatar
it.png Tormie Gender: Male
Posette enthusiast
Posette enthusiast
Life + 1
Life + 1
Renderosity Ban
Renderosity Ban
 
Joined: March 2003
Posts: 8280
Tomatoes 72512
Lemons 50450
hearts 5031

  • Back to top Page bottom
 

Post 

#8  ahjah 31 Dec 2004 22:18


 




____________
Image
 
avatar
blank.gif ahjah Gender: Male
Posette enthusiast
Posette enthusiast
Life + 1
Life + 1
Chief
Chief
Old Timer
Old Timer
 
Joined: April 2003
Location: detmold/germany
Posts: 2801
Tomatoes 4160
Lemons 519
hearts 2130

  • Back to top Page bottom
 

Post 

#9  tda42 31 Dec 2004 22:31

            
 



 
avatar
blank.gif tda42 Gender: Male
...Pink Paws...
...Pink Paws...
Posette enthusiast
Posette enthusiast
Life + 1
Life + 1
Old Timer
Old Timer
 
Joined: November 2003
Location: Tennessee, The Great Polecat State
Posts: 2551
Tomatoes 22450
Lemons 12546
hearts 3910

  • Back to top Page bottom
 

Post 

#10  Tormie 31 Dec 2004 22:35

  
 




____________
 
avatar
it.png Tormie Gender: Male
Posette enthusiast
Posette enthusiast
Life + 1
Life + 1
Renderosity Ban
Renderosity Ban
 
Joined: March 2003
Posts: 8280
Tomatoes 72512
Lemons 50450
hearts 5031

  • Back to top Page bottom
 

Post 

#11  Deviant_Viking 01 Jan 2005 18:01

I updated my forum the other day to prevent the worm from getting it. Of course it disabled all my custom installs    
 




____________
Every night will have a day.
Even forever must come to an end. I think...
 
avatar
 Deviant_Viking Gender: Male
Power User
Power User
Life + 1
Life + 1
 
Joined: June 2003
Location: Somewhere in Nowhere
Posts: 694
Tomatoes 6440
Lemons 5480
hearts 0

  • Back to top Page bottom
 

Post 

#12  guiltypleasures 01 Jan 2005 18:24

It's a scary place on the net, people who have nothing better to do than cause problems for all of us who just want to enjoy it.  
Thank you very much Davide for letting us know about this problem
DV, I'm sorry about your forum, I hope you can get it straigtened out soon.
 




____________
I long to accomplish a great and noble task, but it is my chief duty to just try and keep control over this group of bozo's at the Nut house errr...Clubhouse! --Guilty Pleasures Chief of Bozo's
 
avatar
blank.gif guiltypleasures Gender: Female
Posette enthusiast
Posette enthusiast
Life + 1
Life + 1
Old Timer
Old Timer
 
Joined: June 2003
Location: Southern Oregon Coast
Posts: 1991
Tomatoes 18231
Lemons 14731
hearts 187

  • Back to top Page bottom
 

Post 

#13  Tormie 01 Jan 2005 19:57

   ... (Tormie is preparing a little box with stuff for DV's forum...)
 




____________
 
avatar
it.png Tormie Gender: Male
Posette enthusiast
Posette enthusiast
Life + 1
Life + 1
Renderosity Ban
Renderosity Ban
 
Joined: March 2003
Posts: 8280
Tomatoes 72512
Lemons 50450
hearts 5031

  • Back to top Page bottom
 

Post 

#14  guiltypleasures 01 Jan 2005 20:53

If you have some room in that box Tormie, I've got a few things to add (In case of an emergency that is)
1 rubber shicken
12 cases of Tuna Pop Tarts
5 Gallon's of my War Head Mixer
2 Freshly squeezed Tuna
13 dirty socks (Landmans)
Oh and a couple of dozen books (I need to clear some space in my living room)
 
 




____________
I long to accomplish a great and noble task, but it is my chief duty to just try and keep control over this group of bozo's at the Nut house errr...Clubhouse! --Guilty Pleasures Chief of Bozo's
 
avatar
blank.gif guiltypleasures Gender: Female
Posette enthusiast
Posette enthusiast
Life + 1
Life + 1
Old Timer
Old Timer
 
Joined: June 2003
Location: Southern Oregon Coast
Posts: 1991
Tomatoes 18231
Lemons 14731
hearts 187

  • Back to top Page bottom
 

Post 

#15  Landman 03 Jan 2005 16:15

ahhhh my 13 dirty socks....
I have the fourteenth one down my pants here, do you want it?  
 




____________
I'd rather have a bottle in front of me then a frontal lobotomy.......

My grey matter is turning white, my proof is my grey hair....
 
avatar
 Landman Gender: Male
Posette enthusiast
Posette enthusiast
Life + 1
Life + 1
 
Joined: June 2003
Location: Grants Pass, Oregon (but http://www.iam.ca)
Posts: 930
Tomatoes 9180
Lemons 5100
hearts 0

  • Back to top Page bottom
 


HideWas this topic useful?
Link this topic
URL
BBCode
HTML

Page 1 of 3
Goto page 1, 2, 3  Next



Users browsing this topic: 0 Registered, 0 Hidden and 0 Visitors
Registered Users: None