Slashdot Log In
Net Worm Uses Google to Spread
Posted by
michael
on Tue Dec 21, 2004 05:15 PM
from the web-service-takes-on-new-meaning dept.
from the web-service-takes-on-new-meaning dept.
troop23 writes "A web worm that identifies potential victims by searching Google is spreading among online bulletin boards using a vulnerable version of the program phpBB, security professionals said on Tuesday. Almost 40,000 sites may have already been infected. In an odd twist if you use Microsoft's Search engine to scan for the phrase 'NeverEverNoSanity'-- part of the defacement text that the Santy worm uses to replace files on infected Web sites--returns nearly 39,000 hits." Reader pmf sent in a few more information links: F-Secure weblog and Bugtraq posting. Update: 12/22 03:34 GMT by T : ZephyrXero links to this news.com article that says Google is now squashing requests generated by the worm.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Quick! (Score:5, Funny)
Re:Quick! (Score:4, Funny)
Parent
Re:Quick! (Score:5, Funny)
The PHP guys will probably blame it on Apache 2.
Parent
Under the Google radar (Score:5, Interesting)
This site is defaced!!! NeverEverNoSanity WebWorm generation 10.
I tried to find some kind of reference and Googled [google.com] for it, but I got no results.
Still nothing on it, wonder how long it'll be before it shows up?
MSN search [msn.com] returns 3 results, that's just a bit short of 39,000, so I guess they must be using the beta [msn.com] engine for the article.
Re:Under the Google radar (Score:3, Informative)
Re:Under the Google radar (Score:5, Informative)
0, 1, 2, 3 - no hits
4 - 2335 hits
5 - 9297 hits
6 - 7218 hits
7 - 7288 hits
8 - 10746 hits
9 - 12009 hits
10 - 11752 hits
11 - 14866 hits
12 - 13267 hits
13 - 8393 hits
14 - 13317 hits
15 - 3840 hits
16 - 5004 hits
17 - 1950 hits
18 - 3344 hits
19 - 6 hits
20 - 1 hit
21 - 3 hits
22 - 1 hit
23 - 1 hit
24 - 1 hit
25, 26, 27, 28, 29, 30 - no hits
Parent
Re:Under the Google radar (Score:2, Informative)
Head line is way to misleading (Score:5, Informative)
The bug is in PHP not phpBB (Score:2)
Re:Head line is way to misleading (Score:5, Informative)
phpBB has an explanation of what the problem is, it can be found at:
http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=2
OTHER FORUMS ARE VULNERABLE
(and no, I am not a phpBB zealot, I am pointing out a misconception)
Parent
Re:Head line is way to misleading (Score:4, Informative)
That indicates to me that someone may have been doing some active development on it...
Parent
Re:Head line is way to misleading (Score:2)
Poor /. (Score:5, Funny)
Latest Version of phpBB Unaffected (Score:5, Informative)
Re:Latest Version of phpBB Unaffected (Score:2, Insightful)
> the worm, though. Time to upgrade if you haven't yet!
That's alright. All the lazy admins will blame Google and everything will be okay!
This, I suspect, is going to be a new way of infecting web-based apps. Just do a search for the vulnerable software on Google, Yahoo or whatever, pop in, do your damage and be on your way.
Of course, it will get much worse if its some sort of E-commerce software or something like that a
Re:Latest Version of phpBB Unaffected (Score:4, Insightful)
Maybe it's a theme - the worms of tomorrow will do what the script kiddies of today do.
Parent
Re:Latest Version of phpBB Unaffected (Score:3, Informative)
To install many plugins requires making changes to the source by hand. Some of the websites I host have several of these, and I'm not even sure which ones (I didn't add them).
Plus, if you use a custom theme you have to recreate it after upgrading, which is a right pain in the arse as all the paths are hardcoded... even with sed/grep it takes an hour or two to turn subSilver into CustomSilver.
Re:Latest Version of phpBB Unaffected (Score:5, Informative)
It will protect your boards from being targeted by the Google component of the worm. However, if your boards are running on a shared server, and someone else has a vulnerable version of phpBB installed on their space, you could still be vulnerable. The worm is designed to poke around once it manages to lodge itself inside a host.
Ordinarily, you could just blame those infected in this manner for not using proper permissions on their board installs, but with the amount of custom modifications many people have installed on their boards, it'd be no surprise if 90% of the people that think they're safe actually aren't. Make sure your files aren't writeable, folks.
Parent
Re:Latest Version of phpBB Unaffected (Score:3, Funny)
If the virus goes senile... (Score:4, Funny)
And in a complete upset (Score:5, Funny)
Infect Slashdot (Score:5, Funny)
Re:Infect Slashdot (Score:3, Funny)
I got hit HARD! :( (Score:5, Interesting)
What it does is search all volumes on the server for files with the
I had a backup drive with everything mirrored that was unshared and secure and it managed to overwrite my ENTIRE backup as well on that machine.
I've been spening the past 24 hours picking up the pieces and trying to get everything back online. 1/2 Done now.
If you want to see what a defaced website looks like go to: http://www.sherwoodoregon.com and check it out before i get that site back online.
-BB
Re:I got hit HARD! :( (Score:2)
Yes, it was a lame joke. I couldn't think of anything better
Re:I got hit HARD! :( (Score:2)
Re:I got hit HARD! :( (Score:2, Informative)
Backups are on cold hardware, on a shelf. At the minimum. Preferably in another building.
Ehhh.. Tape drive perhaps?? (Score:3, Insightful)
A tape drive for backups may seem like a 'thing from the past', but it's *very* effective in these instances...
Re:Ehhh.. Tape drive perhaps?? (Score:4, Informative)
Parent
snort signatures (Score:4, Informative)
This is kind of sad... (Score:3, Funny)
My Christmas gift! Noooooo! (Score:2, Funny)
A new HDTV card...
I go to download [pchdtv.com] the linux only drivers and...
NeverEverNoSanity!!!
Argh! &$@*#! Humbug.
For all of you saying it's a PHP exploit (Score:5, Informative)
I got hit (Score:3, Insightful)
Re:I got hit (Score:3, Informative)
The most secure setup I've come up with is setting up Usermode Linux (or Linux Vservers) so that I have a bunch of virtual OS's running, each with only the bare minimum libraries that are n
This one's fun to debug - perl via url (Score:5, Interesting)
This exploit is actually quite clever. It inputs values into the URL field that use the chr() function in PHP to pass text. It then writes its own perl script and executes it on the server.
Here's the first line from the logfile:
If you decode the ascii characters [asciitable.com], you get:
I didn't have enough freetime to decode the whole thing due to.. actual work having to be done, but it's quite clever.
--falz
Re:This one's fun to debug - perl via url (Score:3, Informative)
You might want to amuse yourself with the following PHP code, add to viewtopic.php right after it checks "isset($HTTP_GET_VARS['highlight']))"...
if (preg_match('/chr\(/', $HTTP_GET_VARS['highlight'])) {
$h = preg_replace('/(?:%2e)?chr\((\d+)\)/ei', 'chr(\1)',
$HTTP_GET_VARS['highlight']);
$h = preg_replace('/%2e/i', '', $h);
$h = preg_replace('/%27/', "'", $h);
error_log("viewtopic ha
Download the full source code (Score:3, Informative)
Looks like you didn't read the Bugtraq posting completely... There's an zip attachment with the fully decoded perl script.
Download link [theaimsgroup.com]
MSN actually returns 207 results (Score:3, Informative)
MSN's first page estimates are always grossly inflated. Try this link instead:
http://beta.search.msn.com/results.aspx?q=Never
Note that I the "first" param is 200 (which is the equivalent of going to page 20). It hits the end of the results and revises its estimate.
My webserver just got hit by this (Score:3, Informative)
Found this in my server logs (Score:3, Interesting)
When I first saw that page a few days ago, it had several boxes for inputs, the site URL, code, and execute button. The page is now gone, and if someone speaks Spanish, please let us all know what the site is about.
Re:Hmmmm (Score:4, Informative)
Parent
Not PHP Bugs - phpBB exploit is used (Score:5, Informative)
This is not caused by the php bugs, it uses an issue in phpBB 2.0.10 and below. 2.0.11 fixes this, and has been available for ages (over a month).
So in summary, if you use phpBB - upgrade to 2.0.11 now - not upgrading is not an option.
I feel the above needs to be clarified, as there are already numerous people posting false information. Upgrading your PHP version won't protect against this (but you need to do it anyway to protect against other issues) - upgrading to phpBB 2.0.11 will. Simple
Parent
Dshield disagrees (Score:4, Insightful)
Parent
Different Exploit (Score:2)
Re:Different Exploit (Score:2)
Re:A few things.. (Score:2, Interesting)
Re:NeverEverNoSanity (Score:3, Informative)
If google wants to stop the virus then they could disable "Powered by phpBB" as a search term. The reason "NeverEverNoSanity" doesn't come up on google is becuase googlebot is extreamly slow to index new content on most sites.
Re:Everyone sets 'chmod 666' on their files nowada (Score:3, Funny)
Re:Clarification (Score:5, Informative)
The PHP exploit was to do with the length part of a serialized string, it wasn't correctly enforced and a suitably large enough value would crash a crash and print out contents of the stack which could include any variable within the script. s:1000:"test"; the 1000 part is not correctly checked.
The phpBB exploit is regarding a remote code execution vulnerability, in this case it uses this vulnerability to fetch a perl script from a remote server and write it to the forum before executing it using the system command in PHP.
So this worm only affects phpBB 2.0.10 and below.
Parent