Slashdot Mirror
Net Worm Uses Google to Spread
troop23 writes "A web worm that identifies potential victims by searching Google is spreading among online bulletin boards using a vulnerable version of the program phpBB, security professionals said on Tuesday. Almost 40,000 sites may have already been infected. In an odd twist if you use Microsoft's Search engine to scan for the phrase 'NeverEverNoSanity'-- part of the defacement text that the Santy worm uses to replace files on infected Web sites--returns nearly 39,000 hits." Reader pmf sent in a few more information links: F-Secure weblog and Bugtraq posting. Update: 12/22 03:34 GMT by T : ZephyrXero links to this news.com article that says Google is now squashing requests generated by the worm.
Someone figure out a way to blame this on Microsoft!
I saw this yesterday on a.... uhh... "anatomic reference" site:
This site is defaced!!! NeverEverNoSanity WebWorm generation 10.
I tried to find some kind of reference and Googled for it, but I got no results.
Still nothing on it, wonder how long it'll be before it shows up?
MSN search returns 3 results, that's just a bit short of 39,000, so I guess they must be using the beta engine for the article.
There is nothing wrong with google. only with people who have not pathced the php buletin boards
I think this virus/worm hit /., when I clicked on the link to this article, all I saw was: "Nothing for you to see here. Please move along."
You can't handle the truth.
It looks like the latest phpBB version 2.0.11 or a simple patch will thwart the worm, though. Time to upgrade if you haven't yet!
--
http://www.aikiweb.com - AikiWeb Aikido Information
it can always use Google Suggest to find victims. :)
Microsoft search beats Google at indexing pages hacked by this virus! MS Search turns up 39000 pages, google turns up zero on the same nonsense keyword!
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
When it infects sites running SlashCode, it pretends to be a legitament post (so it can get the defacement tag "NeverEverNoSanity" on the front page, then monitors for posting, and tries to get first post, too.
This worm is unbelieveably evil.
.asp .php .shtml .html .htm extentions and overwrites them with the 264 byte file that simply states "Web site defaced"
What it does is search all volumes on the server for files with the
I had a backup drive with everything mirrored that was unshared and secure and it managed to overwrite my ENTIRE backup as well on that machine.
I've been spening the past 24 hours picking up the pieces and trying to get everything back online. 1/2 Done now.
If you want to see what a defaced website looks like go to: http://www.sherwoodoregon.com and check it out before i get that site back online.
-BB
The ISC posted a couple of snort sigs and other details.
---- join dshield.org Distributed Intrusion Detec
Different Exploit, that is a seperate problem that allows people to do even more bad things such as reading your config.php to get your sql password. A workaround is available from http://www.phpbbstyles.com/viewtopic.php?t=1903 if you can't install 4.3.10
I had forgotten the MSN beta search engine, so I just googled it...
There is another kind of evil which we must fear most, and that is the indifference of good men. -- Boondock Saints
So I get my present, in the mail, a little early.
A new HDTV card...
I go to download the linux only drivers and...
NeverEverNoSanity!!!
Argh! &$@*#! Humbug.
If google wants to stop the virus then they could disable "Powered by phpBB" as a search term. The reason "NeverEverNoSanity" doesn't come up on google is becuase googlebot is extreamly slow to index new content on most sites.
TODO create witty sig.
No, as someone else already responded to other posts, it is a phpBB problem. phpBB calls the urldecode() function on form variables, after PHP already does so. It allows ' to bypass the magic quotes that php so lovingly puts on all our form data. The latest bug reports were reported after the release of the exploit for phpBB 2.0.10 and earlier. IIRC the report said that some scripts MAY be vulnerable, but didnt state for certain. As far as I know, no one has yet to release an exploit for the bugs, its just a possibility.
This is the main issue with harddisks as backup. They don't provide security against these kind of attacks as they are just as vulnerable as any other disk attached to the system.
A tape drive for backups may seem like a 'thing from the past', but it's *very* effective in these instances...
To Terminate, or not to Terminate, that's the question - SCSIROB
My poor linux box - I felt so secure and then this little worm gets out. Thank god I had some recent backups, otherwise this would have really sucked. I guess it's alright though - you have to get rooted one time before you really understand how vulnerable the internet makes all of us.
James Tiberius Kirk: "Spock, the women on your planet are logical. No other planet in the galaxy can make that claim."
Robots aren't bad, they help people find things, and get them to your site. However, if you would rather keep them away from you, consider using your robots.txt http://www.robotstxt.org/ along with meta tags on pages. You can also set certain content to be filtered out by looking at the connecting agent. Things you should consider filtering out would be admin links/pages, version numbers (often in the footer of pages), and files that aren't related to content. There's no reason for Google to know what your login pages look like, for instance.
.htaccess, proper chmod/chown... these are the things that can prevent a new bug from being a really bad new bug.
If I've said it once, I've said it 1000 times. When you secure the old tech first, you find fewer problems with the new tech. robots.txt,
Cleaning the net one sed at a time! s/sex/sermons/; s/hot/holy/; s/goats/thebible/; www.holysermonswiththebible.com
As per the parent of this post, the post modded '+5 Informative' is false and includes the wrong announcement.
:)
This is not caused by the php bugs, it uses an issue in phpBB 2.0.10 and below. 2.0.11 fixes this, and has been available for ages (over a month).
So in summary, if you use phpBB - upgrade to 2.0.11 now - not upgrading is not an option.
I feel the above needs to be clarified, as there are already numerous people posting false information. Upgrading your PHP version won't protect against this (but you need to do it anyway to protect against other issues) - upgrading to phpBB 2.0.11 will. Simple
The ADDRESS element may be used by authors to supply contact information for a document or a major part of a document such as a form. This element often appears at the beginning or end of a document.
http://www.w3.org/TR/html401/struct/global.html#ed ef-ADDRESS
I've used it for years. By the way, how often do you review the html source of webpages you visit?
This exploit is actually quite clever. It inputs values into the URL field that use the chr() function in PHP to pass text. It then writes its own perl script and executes it on the server.
Here's the first line from the logfile:
If you decode the ascii characters, you get:
I didn't have enough freetime to decode the whole thing due to.. actual work having to be done, but it's quite clever.
--falz
MSN's first page estimates are always grossly inflated. Try this link instead:
http://beta.search.msn.com/results.aspx?q=Never
Note that I the "first" param is 200 (which is the equivalent of going to page 20). It hits the end of the results and revises its estimate.
I had to explain this to a colleague earlier in layman's terms, so I'm repeating it here:
_ center/ white_papers/application_worms.html?show=appworm
For those of you who think this is solely a PHP or PHPBB bug, it's actually quite a bit more involved than that. A series of exploits for PHP were released, and subsequently, a lot of forum software, not just phpBB, is exploitable.
This worm uses a legitimate function which the phpBB developers have for functionality of their forum software. This legitimate function is exploitable in certain versions of PHP. Due to the speed in which the exploit was released, it could be that the worm developer had the engine ready and was simply looking for a PHP exploit to come out for a function that was used with a widely available web application package. They hit jackpot with phpBB and PHP together.
The developer didn't thinking to make it so that it added a random element to it's Google searches or didn't use different search engines. In fact, it almost looks like this was simply a trial run for a future worm that will be much more complex and may possibly span a multitude of web applications.
A concept was written up earlier this year here:
http://www.imperva.com/application_defense
It now appears that niddhog (the concept worm) has been made evident. Fortunately, it did not include such things as Code Red and Nimda did with using IE exploits to infect the clients that would view these websites.
It is a bleak future with the idea of Web Application Worms coupled with IE exploits. Not only do you have the method and distribution combined, but such a thing would be highly anonymous for the malware author and could spread to the highest point of infection in a matter of hours as IE users visited their favorite community websites running exploitable forum software.
Looking at all the automatic PHP error responses, it seems that as long as the web server's task does not have write access to the web sites folder you're safe.
The worm didn't touch a single file not owned by user 'www' - just the few thousand files that were.
Dewey, what part of this looks like authorities should be involved?
Looks like you didn't read the Bugtraq posting completely... There's an zip attachment with the fully decoded perl script.
Download link
There is indeed a way to get updates. On source forge, you can subscribe to get updates when new packages are released.
Don't spread FUD.. php?filemodule_id=28882
:
Sourceforge offers release trackers which the phpBB team openly point people to if they want mail updates:
http://sourceforge.net/project/filemodule_monitor
Or of course, there is the RSS feed
http://www.phpbb.com/rss.php
And, after 'popular demand' they are currently working on a special security mailing list that people can subscribe to.
The worm is related to an issue in phpBB 2.0.10 as per the parent, nothing to do with any PHP issues.
I do wish mods would be careful when modding posts that they obviously no nothing about as 'informative' - to be 'informative' you have to give correct information, not just information that looks technical enough to be correct.
Searching for "neverevernosanity webworm generation X" on MSN Beta Search yields the following number of results for each value of X:
Hmm, if these numbers are to be trusted, the infections are 10.5 generations old, on average.
Interestingly, these numbers add to 124k, much more than the reported 39k number of pages reported by merely searching for "NeverEverNoSanity". This would imply that many of the defaced pages contain messages for different generations. Weird.
It would be interesting if the defaced pages included the URL of the parent, the one that the worm used to infect the server from which it infected the current one.
http://www.hackgeneral.net/phpbb_exploit.php
When I first saw that page a few days ago, it had several boxes for inputs, the site URL, code, and execute button. The page is now gone, and if someone speaks Spanish, please let us all know what the site is about.
Pete Carr Owner Chatmag.com