Top Threat: Perl/Santy.AExecutive Summary
Name: Perl/Santy.A (Norman Data Defense Systems)
Affects: phpBB versions 2.0 through 2.0.10
What it does: Santy.A spreads among Web servers running the popular phpBB bulletin board software. The worm targets a vulnerability in phpBB versions 2.0 through 2.0.10, then uses the compromised software to spread.
The malicious code searches systems for all files with extensions of .ASP, HTM, JSP, PHP, PHTM, and SHTM, substituting its own file for the originals. The replacement contains the following:
This site is defaced!!!
NeverEverNoSanity WebWorm generation X
The script, written in Perl, tracks its generation. (This is the generation value mentioned above.) Each installation on a new machine increments the generation. Defacement only takes place if the generation is greater than 3an indication that the script initially spread as silently as possible to infect many systems before discovery.
The worm uses Google's Advanced Search mechanism to find strings one would expect from a phpBB server, using that information to construct a list of possibly vulnerable servers, which it attempts to attack. This scouting method should no longer work, since Google disabled the searches used by the worm.
Other reports claim that Santy also slows down or even blocks the affected server. Users should upgrade to version 2.0.11 of phpBB.