Net Worm Uses Google to Spread 309
troop23 writes "A web worm that identifies potential victims by searching Google is spreading among online bulletin boards using a vulnerable version of the program phpBB, security professionals said on Tuesday. Almost 40,000 sites may have already been infected. In an odd twist if you use Microsoft's Search engine to scan for the phrase 'NeverEverNoSanity'-- part of the defacement text that the Santy worm uses to replace files on infected Web sites--returns nearly 39,000 hits." Reader pmf sent in a few more information links: F-Secure weblog and Bugtraq posting. Update: 12/22 03:34 GMT by T : ZephyrXero links to this news.com article that says Google is now squashing requests generated by the worm.
Quick! (Score:5, Funny)
Re:Quick! (Score:4, Funny)
Re:Quick! (Score:2)
Re:Quick! (Score:2, Interesting)
This is from one of the links above. So, it sounds like if a machine doesn't have Perl installed, the thing can't go to work. By sheer coincidence, most windows boxes will be immune to this particular instance of this worm (by no
Re:Quick! (Score:5, Funny)
The PHP guys will probably blame it on Apache 2.
Under the Google radar (Score:5, Interesting)
This site is defaced!!! NeverEverNoSanity WebWorm generation 10.
I tried to find some kind of reference and Googled [google.com] for it, but I got no results.
Still nothing on it, wonder how long it'll be before it shows up?
MSN search [msn.com] returns 3 results, that's just a bit short of 39,000, so I guess they must be using the beta [msn.com] engine for the article.
Re:Under the Google radar (Score:3, Informative)
Re:Under the Google radar (Score:5, Informative)
0, 1, 2, 3 - no hits
4 - 2335 hits
5 - 9297 hits
6 - 7218 hits
7 - 7288 hits
8 - 10746 hits
9 - 12009 hits
10 - 11752 hits
11 - 14866 hits
12 - 13267 hits
13 - 8393 hits
14 - 13317 hits
15 - 3840 hits
16 - 5004 hits
17 - 1950 hits
18 - 3344 hits
19 - 6 hits
20 - 1 hit
21 - 3 hits
22 - 1 hit
23 - 1 hit
24 - 1 hit
25, 26, 27, 28, 29, 30 - no hits
Re:Under the Google radar (Score:2)
That's what you get for not knowing your
Re:Under the Google radar (Score:2, Informative)
Re:Under the Google radar (Score:2)
Read: http://www.eicar.org/anti_virus_test_file.htm [eicar.org]
Re:Under the Google radar (Score:2)
Re:Under the Google radar (Score:2)
Re:Under the Google radar (Score:2, Funny)
Re:Under the Google radar (Score:2)
Head line is way to misleading (Score:5, Informative)
The bug is in PHP not phpBB (Score:2)
Re:Head line is way to misleading (Score:5, Informative)
phpBB has an explanation of what the problem is, it can be found at:
http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=2
OTHER FORUMS ARE VULNERABLE
(and no, I am not a phpBB zealot, I am pointing out a misconception)
Re:Head line is way to misleading (Score:4, Informative)
That indicates to me that someone may have been doing some active development on it...
Re:Head line is way to misleading (Score:2)
Still trying to find out what the vulnerability actually is so I can test for it.
Re:Head line is way to misleading (Score:2)
It has everything to do with a design decision made by the authors of PHPBB, and copied by others... They trust cookie data. It just so happens that the unserialize() bug affects this, but there are other ways to exploit it.
The data they're storing in a user cookie should be kept on the server. The cookie should only contain a "key" to retrieve the data from the server's storage. If the users can't change the data directly, they can't expl
Re:Head line is way to misleading (Score:2)
Re:Head line is way to misleading (Score:2, Informative)
Poor /. (Score:5, Funny)
Latest Version of phpBB Unaffected (Score:5, Informative)
Re:Latest Version of phpBB Unaffected (Score:2, Insightful)
> the worm, though. Time to upgrade if you haven't yet!
That's alright. All the lazy admins will blame Google and everything will be okay!
This, I suspect, is going to be a new way of infecting web-based apps. Just do a search for the vulnerable software on Google, Yahoo or whatever, pop in, do your damage and be on your way.
Of course, it will get much worse if its some sort of E-commerce software or something like that a
Re:Latest Version of phpBB Unaffected (Score:4, Insightful)
Maybe it's a theme - the worms of tomorrow will do what the script kiddies of today do.
Re:Latest Version of phpBB Unaffected (Score:2)
What will we do when the scripts start generating mutated offspring?
Re:Latest Version of phpBB Unaffected (Score:3, Informative)
To install many plugins requires making changes to the source by hand. Some of the websites I host have several of these, and I'm not even sure which ones (I didn't add them).
Plus, if you use a custom theme you have to recreate it after upgrading, which is a right pain in the arse as all the paths are hardcoded... even with sed/grep it takes an hour or two to turn subSilver into CustomSilver.
Re:Latest Version of phpBB Unaffected (Score:5, Informative)
It will protect your boards from being targeted by the Google component of the worm. However, if your boards are running on a shared server, and someone else has a vulnerable version of phpBB installed on their space, you could still be vulnerable. The worm is designed to poke around once it manages to lodge itself inside a host.
Ordinarily, you could just blame those infected in this manner for not using proper permissions on their board installs, but with the amount of custom modifications many people have installed on their boards, it'd be no surprise if 90% of the people that think they're safe actually aren't. Make sure your files aren't writeable, folks.
Re:Latest Version of phpBB Unaffected (Score:2)
I just went through by hand, and 8 of 9 installed copies of phpBB on my server were vulnerable.
Re:Latest Version of phpBB Unaffected (Score:3, Funny)
If the virus goes senile... (Score:4, Funny)
And in a complete upset (Score:5, Funny)
Infect Slashdot (Score:5, Funny)
Re:Infect Slashdot (Score:3, Funny)
I got hit HARD! :( (Score:5, Interesting)
What it does is search all volumes on the server for files with the
I had a backup drive with everything mirrored that was unshared and secure and it managed to overwrite my ENTIRE backup as well on that machine.
I've been spening the past 24 hours picking up the pieces and trying to get everything back online. 1/2 Done now.
If you want to see what a defaced website looks like go to: http://www.sherwoodoregon.com and check it out before i get that site back online.
-BB
Re:I got hit HARD! :( (Score:2)
Yes, it was a lame joke. I couldn't think of anything better
Re:I got hit HARD! :( (Score:2)
Re:I got hit HARD! :( (Score:2, Informative)
Backups are on cold hardware, on a shelf. At the minimum. Preferably in another building.
Cold hardware? (Score:2)
Our backups rsync and offload to an offsite server with RAID'ed drives. Yes, that server could theoretically be hosed at the same time the master goes down in flames but the chances of that are low. In fact, not much greater than if you have a tape, etc. If somebody hacks the backup server, well they could have wiped the tape too.
The main advantage of tapes, etc are staggered bac
Re:I got hit HARD! :( (Score:2)
In another city.
Inevitable conclusion... (Score:2)
In another city.
Inside a locked box, in a safe, in a bunker, which is inside another, bigger bunker, deep inside my secret volcano lair guarded by sharks with frickin' laser beams on their heads.
Re:I got hit HARD! :( (Score:2)
Re: (Score:3, Insightful)
Re:Ehhh.. Tape drive perhaps?? (Score:4, Informative)
Re:Ehhh.. Tape drive perhaps?? (Score:2)
With tape, you can put it into any compatible drive, or have multiple tapes. At any rate, both do have to be removed.
Re:Ehhh.. Tape drive perhaps?? (Score:2)
Re:Ehhh.. Tape drive perhaps?? (Score:2)
That's fine, IFF by "unmount" you mean "physically disconnect". Pretty much anything short of actual removal still leaves you vulnerable.
Re:Ehhh.. Tape drive perhaps?? (Score:2)
Re:Ehhh.. Tape drive perhaps?? (Score:2, Informative)
I see a couple easy blocks to these, though:
1) write a shell script for mounting the backup drive, both onto the SCSI chain and into the filesystem, performing the backup, and then unmount it.
2) round-robin the drives on a regular basis, so an IT monkey can physically swap out sets when needed to provide off-site storage (basically use hot-swap bays like very large, fast tape jukeboxes).
3) encrypt the pert
Re:Ehhh.. Tape drive perhaps?? (Score:2)
A tape cartrage is more portable, it holds more data in a given amount of space. Generally they are cheaper too, though due to scale this isn't so true anymore. Tapes often are of better quality, or should I say known quality. When they say use a tape 1000 times, you can be reasonably sure of 1000 uses, while who knows when that harddrive will break. When a tape breaks it is easier for a professional to repair if you need it. (generally tape failures do not involve heads scraping the media)
When y
Re:I got hit HARD! :( (Score:2)
Re:I got hit HARD! :( (Score:2)
Umm... why was your webserver writable? (If you'd had a secure webserver the virus would never have been able to install in the first place).
Why was your *backup* writable? (It was clearly *not* 'secure').
snort signatures (Score:4, Informative)
This is kind of sad... (Score:3, Funny)
My Christmas gift! Noooooo! (Score:2, Funny)
A new HDTV card...
I go to download [pchdtv.com] the linux only drivers and...
NeverEverNoSanity!!!
Argh! &$@*#! Humbug.
For all of you saying it's a PHP exploit (Score:5, Informative)
I got hit (Score:3, Insightful)
Re:I got hit (Score:2)
Not if you know what your doing you don't. You should have kept up with your patches.
Re:I got hit (Score:3, Informative)
The most secure setup I've come up with is setting up Usermode Linux (or Linux Vservers) so that I have a bunch of virtual OS's running, each with only the bare minimum libraries that are n
address tag and no robots (Score:2)
I looked at a defaced page and there were two things I noticed. The first was that the worm does not seem to create a robots.txt file to hide defaced pages from search engines. Second, the majority of the text is contained in an ADDRESS, HTML tag. It is a valid tag, but does anyone actually use it? I have not seen it before as far as I can recall.
Re:address tag and no robots (Score:2, Informative)
The ADDRESS element may be used by authors to supply contact information for a document or a major part of a document such as a form. This element often appears at the beginning or end of a document.
http://www.w3.org/TR/html401/struct/global.html#ed ef-ADDRESS [w3.org]
I've used it for years. By the way, how often do you review the html source of webpages you visit?
Re:address tag and no robots (Score:2)
By the way, how often do you review the html source of webpages you visit?
Occasionally. I have also edited quite a few different ones for one reason or another. I was not meaning to imply that it was not valid. I was just wondering if it was obscure and unused, or just something I have not run across. It still seems an odd inclusion in a page created by a worm.
Relating to this, I wonder, is there any way to get google to search based upon html tags? For example, could I find all pages with address t
The Robot Threat (Score:2, Informative)
ouch, thats a nasty one! (Score:2)
This one's fun to debug - perl via url (Score:5, Interesting)
This exploit is actually quite clever. It inputs values into the URL field that use the chr() function in PHP to pass text. It then writes its own perl script and executes it on the server.
Here's the first line from the logfile:
If you decode the ascii characters [asciitable.com], you get:
I didn't have enough freetime to decode the whole thing due to.. actual work having to be done, but it's quite clever.
--falz
Re:This one's fun to debug - perl via url (Score:3, Informative)
You might want to amuse yourself with the following PHP code, add to viewtopic.php right after it checks "isset($HTTP_GET_VARS['highlight']))"...
if (preg_match('/chr\(/', $HTTP_GET_VARS['highlight'])) {
$h = preg_replace('/(?:%2e)?chr\((\d+)\)/ei', 'chr(\1)',
$HTTP_GET_VARS['highlight']);
$h = preg_replace('/%2e/i', '', $h);
$h = preg_replace('/%27/', "'", $h);
error_log("viewtopic ha
Download the full source code (Score:3, Informative)
Looks like you didn't read the Bugtraq posting completely... There's an zip attachment with the fully decoded perl script.
Download link [theaimsgroup.com]
Re:This one's fun to debug - perl via url (Score:2)
FWIW, I tested with IE (the only other browser on this computer), and it's fine...
And so it comes full circle... (Score:2)
Black background, red lettering:
This site is defaced!!!
NeverEverNoSanity WebWorm generation 14.
MSN actually returns 207 results (Score:3, Informative)
MSN's first page estimates are always grossly inflated. Try this link instead:
http://beta.search.msn.com/results.aspx?q=Never
Note that I the "first" param is 200 (which is the equivalent of going to page 20). It hits the end of the results and revises its estimate.
Clarification (Score:2, Informative)
For those of you who think this is solely a PHP or PHPBB bug, it's actually quite a bit more involved than that. A series of exploits for PHP were released, and subsequently, a lot of forum software, not just phpBB, is exploitable.
This worm uses a legitimate function which the phpBB developers have for functionality of their forum software. This legitimate function is exploitable in certain versions of PHP. Due to the
Re:Clarification (Score:5, Informative)
The PHP exploit was to do with the length part of a serialized string, it wasn't correctly enforced and a suitably large enough value would crash a crash and print out contents of the stack which could include any variable within the script. s:1000:"test"; the 1000 part is not correctly checked.
The phpBB exploit is regarding a remote code execution vulnerability, in this case it uses this vulnerability to fetch a perl script from a remote server and write it to the forum before executing it using the system command in PHP.
So this worm only affects phpBB 2.0.10 and below.
MOD PARENT UP (Score:2, Informative)
I do wish mods would be careful when modding posts that they obviously no nothing about as 'informative' - to be 'informative' you have to give correct information, not just information that looks technical enough to be correct.
My webserver just got hit by this (Score:3, Informative)
mod_security to the rescue? (Score:2)
The main thing though that I've done that I hope to help me stay a little in front of these types of exploits is implement mod_security and add some rules which block the more 'common' exploits and sql injections.
Does
Worm's genealogy? (Score:2, Interesting)
Searching for "neverevernosanity webworm generation X" on MSN Beta Search [msn.com] yields the following number of results for each value of X:
Hmm, if these numbers are to be trusted, the infections are 10.5 generations old, on average.
Interestingly, these numbers add to 124k, much more than the reported 39k number of pages repo
Found this in my server logs (Score:3, Interesting)
When I first saw that page a few days ago, it had several boxes for inputs, the site URL, code, and execute button. The page is now gone, and if someone speaks Spanish, please let us all know what the site is about.
Re:Hmmmm (Score:4, Informative)
Not PHP Bugs - phpBB exploit is used (Score:5, Informative)
This is not caused by the php bugs, it uses an issue in phpBB 2.0.10 and below. 2.0.11 fixes this, and has been available for ages (over a month).
So in summary, if you use phpBB - upgrade to 2.0.11 now - not upgrading is not an option.
I feel the above needs to be clarified, as there are already numerous people posting false information. Upgrading your PHP version won't protect against this (but you need to do it anyway to protect against other issues) - upgrading to phpBB 2.0.11 will. Simple
Re:Not PHP Bugs - phpBB exploit is used (Score:2)
I'm still on 2.0.4. I just mentioned pulling down her sites to attempt an upgrade (I reckon 2 days because the themes she uses are *very* customised) the look I got basically said that if I tried that I'd be sleeping alone for the next week.
Re:Not PHP Bugs - phpBB exploit is used (Score:2)
Re:Not PHP Bugs - phpBB exploit is used (Score:2)
Dshield disagrees (Score:4, Insightful)
Different Exploit (Score:2)
Re:Different Exploit (Score:2)
Re:A few things.. (Score:2, Interesting)
Re:A few things.. (Score:2)
Considering that PHP is doing its best to surpass Sendmail in the "pwn my server!" category, I'd say that any application written in PHP should be considered suspect.
This is different from C, where bad programmers can use perfectly reasonable functions in an unsafe way (excluding gets(); that's just an abomi
Re:NeverEverNoSanity (Score:3, Informative)
If google wants to stop the virus then they could disable "Powered by phpBB" as a search term. The reason "NeverEverNoSanity" doesn't come up on google is becuase googlebot is extreamly slow to index new content on most sites.
Re:NeverEverNoSanity (Score:2)
Re:NeverEverNoSanity (Score:2)
Re:It works both ways. (Score:2)
besides, i doubt it wouldn't use it.. as to use it you need to have a code and they could just turn that key off(and there's some 1000 limit on one key, or at least should have).
so.. what i'm saying is that you don't really need the googleapi for doing regular google searches you could do via http.......
Re:Everyone sets 'chmod 666' on their files nowada (Score:3, Funny)
Re:phpBB2 need a security mailing list (Score:2, Informative)
Re:phpBB2 need a security mailing list (Score:2, Informative)
Sourceforge offers release trackers which the phpBB team openly point people to if they want mail updates:
http://sourceforge.net/project/filemodule_monitor. php?filemodule_id=28882 [sourceforge.net]
Or of course, there is the RSS feed
http://www.phpbb.com/rss.php [phpbb.com]
And, after 'popular demand' they are currently working on a special security mailing list that people can subscribe to.
Re:this is not happening... (Score:2)
Re:Why MSN works and Google Doesn't (Score:2)
Is that a firmer, longer lasting worm?
"Any worms lasting longer than four hours require immediate medical attention."
Re:Why MSN works and Google Doesn't (Score:2)
But, as you said, the reason MSN works and Google doesn't is simple: MSN upda
Of course Google is filtering (Score:2)