A Web worm that identifies potential victims by searching Google is spreading among online bulletin boards using a vulnerable version of the program phpBB, security professionals said on Tuesday.

When Perl.Santy is executed it does the following:

  1. Searches for "viewtopic.php" using the Google search to generate a list of possible infection targets.

  2. Attempts to exploit the PHPBB Remote URLDecode Input Validation Vulnerability (BID 11672) to obtain access to the remote web server.

  3. If successful, it copies itself as the file m1h020f.

  4. Overwrites files with the following extensions:
          * .asp
          * .htm
          * .jsp
          * .php
          * .phtm
          * .shtm

            with the following text:

            This site is defaced!!!
            NeverEverNoSanity WebWorm generation X

            Note: X is a variable number which increments with each infection

http://beta.search.msn.com/results.aspx?q=...verEverNoSanity


"1-10 of 37,111 containing "This site is defaced!!!" NeverEverNoSanity"

http://www.google.com/search?hl=en&q=inurl...url%3Aviewtopic

"Results 1 - 10 of about 1,130,000 for inurl:phpbb inurl:viewtopic"

Summary

Santy is a worm was found at December 21st, 2004. It uses a vulnerability in popular phpBB discussion forum software to spread and it uses Google search engine to find vulnerable servers. It does not infect end user computers.

Google has started filtering requests made by the worm at December 22nd, 2004, in order to stop the worm.

Detailed Description

The worm is written in Perl scripting language. When executed, the worm uses the Google search engine to look for hosts that have phpBB software in use. It does this by searching URLs that contain string "viewtopic.php". In order to get different results with different searches, the worm uses a random string in the search as well.

After the search has been performed, the worm parses the resulting page and attempts to exploit a vulnerability in phpBB software. This vulnerability, known as Highlight Vulnerability, can be used to execute arbitary code on the server running vulnerable version of phpBB. Further information about the vulnarbility is available from phpBB web site at:

http://www.phpbb.com/phpBB/viewtopic.php?t=240513

If the worm is able to exploit the vulnerablity, it will attempt to transfer itself to the victim host in 20-byte chunks. If any of the chunks is lost during the transfer, it will cause the worm to get corrupted, which can render the worm disfunctional on the victim.

The worm is written to a file "m1ho2of" on the victim. After the transfer is complete, the worm will use the exploit once again to execute the code using the system default Perl interpreter.

Santy contains also a generation counter that is increased every time the worm is executed, i.e. once per infected host. If the number of generations is higher than three (3), it will execute its payload. The payload attempts to replace all files with the following extensions ".htm", ".php", ".asp", ".shtm", ".jsp" and ".phtm". The result is the these files are replaced with a HTML page that contains the following text:

This site is defaced!!!
NeverEverNoSanity WebWorm generation X

...where X keeps growing from one infection to another.

This case is now over. The Santy worm is not spreading any more, thanks to Google.

Google started filtering the queries made by the worm around midnight GMT, effectively stopping the spread of the worm. Apparently they are doing this based on a combination of the search terms and the User-Agent header field.

This is from an email we got from the Google Security Team:

  While a seven hour response for something like this is not outrageous,
  we think we can and should do better. We will be reviewing our
  procedures to improve our response time in the future to similar problems.

Google has also started showing the defaced websites in it's index. MSN Search already had them visible over 12 hours ago, so apparently the indexing process takes longer at Google.

Like we reported earlier, MSN Search reports huge numbers of websites to be affected. However, if you keep viewing the search index pages, you get different results. MSN Search reports 29,000 hits, but runs out of the hits already on search index page 15 - with 153 actual hits shown. Google finds 202 defaced sites right now. It's hard to estimate how many actual sites got hit.

This particular worm made use of Google search to identify potential targets.  The number of queries generated by this worm was small enough to be down in the noise relative to the normal activity.  We were finally notified early Tuesday and by late afternoon we had begun blocking the worm's search queries.  The worm should have started dying off almost immediately.

Stephen
--
#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#
Name Removed  -  Information Security Officer  -  Removed@google.com
  Google, Inc.  1600 Amphitheatre Parkway, Mountain View, CA 94043
  Phone: +1.650.XXX.XXXX  Fax: +1.650.XXX.XXXX

  The church is near, but the road is icy.
  The bar is far away, but I will walk carefully.  -- Russian Proverb


-+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+#+--+