If you are using a PHPBB board for your site, the forum is in danger.
I just want to warn you, before more forums are going down for a long time.
As far as I know, the www.christrain.nl forums, and the forums of msts-belgium are already down.This is an article about the danger.
source:
http://news.com.com/Net+worm+using+Google+to+spread/2100-7349_3-5499725.html?part=rss&tag=5499725&subj=news.7349.5Regards,René-----------
A Web worm that identifies potential victims by searching Google is
spreading among online bulletin boards using a vulnerable version of the
program phpBB, security professionals said on Tuesday. The Santy worm uses a flaw in the widely used community forum software
known as the PHP Bulletin Board (phpBB) to spread, according to updated
analyses. The worm searches Google for sites using a vulnerable version of
the software, antivirus firm Kaspersky said in a statement. Almost 40,000 sites may have already been infected. Using Microsoft's
Search engine to scan for the phrase "NeverEverNoSanity"--part of the
defacement text that the Santy worm uses to replace files on infected Web
sites--returns nearly 39,000 hits.
"Santy.a is spreading rapidly," antivirus firm Kaspersky stated in a new
release published Tuesday. "However, this does not directly affect users.
Although the worm infects Web sites, it does not infect computers used to
view those sites." The worm sends Google a specific search request, essentially asking for a
list of vulnerable sites. Armed with the list, the worm then attempts to
spread to those sites using a PHP request designed to exploit the phpBB
bulletin board software. The worm is the latest twist on using Google as an attack tool, a practice
known as Google hacking. It may also be the first time a program used
Google to identify victims for an attack. Around 6 million sites appear to be running the phpBB software, according
to a search of Google for the phrase "Powered by phpBB"--an acknowledgment
appended to the bottom of any site that uses the software. "There are tons of these PHP bulletin board installs around," said Johannes
Ullrich, chief technology officer of the Internet Storm Center, which
tracks online threats. Initial analyses by the ISC had concluded that the
flaw exploited by the worm occured in the software that interprets Web
pages written scripting language PHP: Hypertext Preprocessor (PHP). That
flaw was found last week. Using Google to determine vulnerable sites is not an academic exercise. The
worm does exactly that: Once Santy infects a Web site, it searches Google
for other sites running phpBB and then attempts to infect those sites as
well. After it has taken over a site, the worm deletes all HTML, PHP, active
server pages (ASP), Java server pages (JSP), and secure HTML pages, and
replaces them with the text, "This site is defaced!!! This site is
defaced!!! NeverEverNoSanity WebWorm generation X," according to
Kaspersky. For "X," the worm inserts a number representing how far the
current instance of the program is descended from the original worm
release. MSN searches have found 24th generations of the worm. Google did not immediately comment on the worm, but a spokesman did say
that the company had seen the information and had started to study the
issue. The response, or lack thereof, frustrated some members of the antivirus
community, who believed that the search giant could easily stop the worm
by filtering out its search for victims. "We know exactly which searches to stop," said Mikko Hypponen, research
director of antivirus firm F-Secure. "It would be trivial to stop this
thing." Web sites using a vulnerable version of phpBB should upgrade, the phpBB
Project site advises. -----------------------------
Don't take life to serious, You won't survive it anyway...
Printer-friendly page | Edit | Reply | Reply With Quote | Top
