Anti-Santy Worm Patches phpBB Flaw

sebFlyte writes "Interesting Santy worm story -- there's now an anti-Santy worm proliferating, which spreads the same way as a normal worm, but rather than killing machines or taking control of them, it gives them security updates..." We mentioned the Santy worm about ten days ago.

Comments

Not very benificial

[lightdarkness]

Is reporting that they don't know if the worm actually patches it sucessfully. For all we know, it could be infecting the System. When searching, only 3 results came up.

Re:Not very benificial

[smartdreamer]

If you are waiting for a Anti-Virus company to say "this virus is good and effective" you will wait a long time.

What I see is a company saying we are first to report but we wont say anything that can be good for our "enemy". There is nothing difficult about testing its efficiency but it is not in their interest.

I am not saying this worm is good, but that if they wanted to verify it would be easy.

Aren't...

[Anonymous Coward]

worms that remove/kill the MS OS is the same as a security patch?

Re:Aren't...

[adlaiff6]

Only if they install linux...otherwise, it's just a blessing.

hohoho

[Anonymous Coward]

Ho-ho-holes

I can imagine explaining this...

[Chemisor]

"You see Mom, there are Good worms and there are Bad worms"

Re:I can imagine explaining this...

[krautcanman]

Ralph: "And when the doctor told me I didn't have any more worms was the best day of my life."

White Worms

[ErichTheWebGuy]

I feel that white worms, when done correctly, are a good thing. This is a case where the ends justify the means, even if it does mean comprimising vulnerable systems.

Re:White Worms

[savagedome]

White worms? Ha! I prefer to call them Earthworms since they belong to both sides!

Re:White Worms

[Texodore]

I have a white worm the updates my system. It pops with the name "Automatic Updates."

Re:White Worms

[antifoidulus]

Till the worm installs a security patch that causes a bug that it takes someone hours upon hours of debugging to locate. People should be allowed to patch when they want. Patches aren't always 100% correct, and some can cause some major havoc. Let each person decide if/when the patch is needed...

Re:White Worms

[aborchers]

In principle they seem good, but what about when a white worm installs a patch that interferes with legitimate operation of the system? It is perfectly possible a vulnerability was left alone by the operator because the patch would have rendered the system unusable and that security measures external to the vulnerable system render the vulnerability moot.

Of course, such machines aren't the ones likely to intersect common worm spread vectors...

Re:White Worms

[GoofyBoy]

From the article;

"If a site is infected, the worm causes a huge amount of traffic and slows down the site. I don't think it's possible to write a beneficial worm."

Re:White Worms

[SwimsWithTheFishes]

The ends justify the means? I don't think so! When the white worm author determines what the ends are, and what correctly is, it is still just a worm. Anything installed behind my back on my computer is bad, evil, no-good-nick!

Re:White Worms

[grumbel]

### Patches aren't always 100% correct, and some can cause some major havoc.

If I have the choice between havoc caused by a patch and havoc caused by a hostile breakin into the system, I'll pick the havoc caused by the patch, that at least doesn't leave any hidden backdoors behind.

Re:White Worms

[Anonymous Coward]

Also purple worms, when handled correctly, are a good thing. If you're wearing a ring of slow digestion you can try to get swallowed on purpose for a respite. Even better, charm one for a pet; they're very tough, superior to Archons even in the endgame. (A pet purple worm can clear out the Castle easily) Or you could always polymorph to one, assuming you have some sort of polymorph control.

If, somehow, you get infected by a worm, or maybe Juiblex, remember to use a unicorn horn immediately, or eat some eucalyptus leaves if you have them handy. (Tip: you can generate lots by shattering boulders, stone-to-fleshing the resultant rocks and polymorphing the resulting meatballs. It may take several tries.) Or, you could cast or zap cure disease.

Good luck fighting these worms. They are surely a menace.

Sincerely,
@

Re:White Worms

[jnguy]

What about for worms like blaster. If an antiworm was released, it could have prevented the mass chaos that broke out on the internet, slowing everything down... I think.

Re:White Worms

[capilot]

If it comes into your system, your system was insecure. By running an insecure system, you harm us all by helping worms & viruses to spread.

I think worms that go around closing the security holes that let them in are a Good Thing and it's about time they started appearing.

Re:White Worms

[Niet3sche]

I feel that white worms, when done correctly, are a good thing. This is a case where the ends justify the means, even if it does mean comprimising vulnerable systems.

I disagree.

I very nearly wrote an anti-code-blue worm a few years back, and got to the point of payload (patch) deployment when the glaring flaw came to me: any time that you or a program that you made does something unexpected, or makes a connection to another machine, YOU are liable for what happens. Given that heterogeneous computers and networks exist, can you test for 100% of all possible cases? Likely not.

It's not so much that I disagree with the sentiment, you see, but I find it impossible to ever run into the case that a white worm is done correctly and can be certified as such.

In the example above, for instance, all that an attacker would have to do would be to infect a netblock with Code Blue, point them at my anti-blue worm launcher, and then watch the fun as I "cause" a DDOS with all the network traffic that will go spewing back and forth between the two sites. The attacker has now been able to effect the Availability of two sites in one go. Not exactly something that I'd like my name attached to, hence the reason that no anti-code-blue-worms have been released into the wild from me.

Re:White Worms

[Proud like a god]

But if they are in charge and haven't patched against a malicious worm, they have no cause to complain when a white worm gets in first and possibly causes problems from patching the exploit, rather than definately causing harm when the black worm comes by.

Re:White Worms

[Bam359]

Let each person decide if/when the patch is needed

What kind of sewed vision of the world do you have that would allow you to make such a comment?

If a person is intelligent enough to patch their system, then they need not worry about the worm, as they will have patched their systems against it! Those not intelligent enough to patch their systems will get infected, and then have their system patched, its win-win.

It is a similar concept to those bar code scanners we have at work: The letters of the alphabet are arranged in alphabetical order (used to input username and password), ostensibly so that those who are not familiar with QWERTY keyboards can find the letters easier, which is the stupidest idea I have ever heard of, and seen implemented, because _EVERYONE_ now has to hunt and peck on those dammed things, even those who are familiar with QWERTY keyboards. I know the alphabet, but try to find a single letter on those scanners is maddening.

Re:White Worms

[spectre_240sx]

You raise an interesting point. Maybe these white knight worms should be looked at in the perspective of systems being patched to slow down the worms progress and protect the rest of the internet rather than systems being patched to protect the administrator of that specific system. If an administrator becomes lazy and that causes grief to other admins, maybe this is deserved. It seems a lot like an ISP disconnecting a user for having a virus on there system, however a little more invasive.

Re:White Worms

[aborchers]

You miss the point. If I have a system with a vulnerability on the network that is protected by an external layer of security (e.g. a firewall or gateway that blocks access to the vulnerable service) then the machine is effectively as invulnerable as if it had been patched (with respect to traffic from outside that gateway). Example: my httpd may have a security flaw, but if I have blocked port 80 at the firewall, then no request will ever be able to exploit that it.

It is routine security practice to test patches to ensure they do not have unintended consequences. A worm bypasses the system operator, and is therefore unacceptable.

As I closed in the original post, the situation is highly hypothetical and it is unlikely a system under such close management would be unlikely to be in the spread vector of a worm (i.e. it's probably not running an unsafe email client or unnecessary/unmonitored services). Nonetheless, responsibility for the security of a node rests with the operator of the node. A white worm has no more right or authority to enter uninvited than any other worm or virus.

Re:White Worms

[aborchers]

It's not a question of building around the flaw, but of not knowing whether and testing whether the patch for the flaw will harm other, more critical services. I elaborated in a different reply:

http://slashdot.org/comments.pl?sid=134480&cid=1 12 31983

Re:White Worms

[aborchers]

Aren't you making an awful lot of assumptions about the nature of the machines fixed? Is it worth it to patch 1000 spam zombies but bring down one air traffic control system?

Concealed ends?

[mOoZik]

Is it possible the "benevolent" worm actually does damage covertly? Has this been investigated thoroughly?

Re:Concealed ends?

[Tony Hoyle]

Heh. If it patched non-GPL code the worm victim could also be sued by the FSF!

Even better, if it managed to infect MS source then Windows would become GPL!!

Re:Concealed ends?

[nazarijo]

yes, this has been thoroughly investigated. i've done several writeups and linked to papers and analysis on wormblog.

i am wholeheartedly against "benevolent worms".

Satisfaction Guarantee?

[someonewhois]

Is there a satisfaction guarantee with the virus?

Wasn't there a Welcha worm that cleaned up Blaster, and once the path was clear, it just gave you another virus? :p

A bit uneasy...

[BlueThunderArmy]

this does sound a bit sneaky and intrusive, but if it's breaking into computers and doing good deeds perhaps we should just let it. After all, people sure as hell aren't doing security updates on their own, might as well let somebody do them.

Re:A bit uneasy...

[Tired_Blood]

If everyone were using the same indentical machines and configuration, then perhaps. But that's just not going to be the case.

Here's my take on these types of worms:

I have evidence which leads me to strongly believe that your kitchen faucet is leaking, badly. This will no doubt cause flooding and damage. Instead of warning you about it, I (a random citizen) will now fix this problem for you.

Of course, since I don't know your home, I may break something unrelated to your current problem. But don't worry, because I'll be back to fix THAT problem later, in the same fashion (at which time I might break something else, etc etc).

Still illegal

[Anonymous Coward]

The author of this worm still doesn't have permission to modify the source code running on people's servers. Yes, they may be idiots, but idiots still have rights (for the moment).

Re:Still illegal

[fyngyrz]

In the real world, however, vigilante justice is often flawed and often destroys the lives of innocents. It's not hard to find examples from the lowest level-- the accidental killing of people living next door to a bail-jumper-- to the highest-- the unilateral invasion of a sovreign nation on false pretense.

Note: My reply is entirely US-centric.

Although both your examples in the quoted passage are examples of the system screwing up, not vigilantes screwing up, I think I do recognize the tone you're trying to take -- that vigilantes can make errors. I interpret your message as carrying an underlying tone that this is a reason to avoid citizen level responses. You weren't explicit about this, so feel free to correct me if I got it wrong. Proceeding on that assumption, though:

That, and more, can be said for the formal justice system as well. The only difference is that the mistakes are made by someone who represents "duly constituted authority and power", rather than someone who took authority and power for themselves.

Look at the facts. Judges and juries put innocents behind bars on a regular basis. (Witness the recent DNA exoneration of those folks on death row and the subsequent removal of all prisoners from death row by the governor, a man who I frankly consider a hero for this action.) Citizen's supposedly inviolate rights are trampled, and hard, by the courts. Every day. Guantanimo. Registration. Double jeopardy. Freedom of speech. Freedom from unreasonable search. Restrictions on travel. Government support of religion. Etc., ad nauseum. Reparations for errors in prosecution and punishment are minimal or non-existant, and of course for capital punishment, impossible. "Mommy" laws that should never become law are inflicted on us left and right, and at times with terrible social and personal consequences (drug laws are the poster child for this one, though they are hardly isolated in either "mommyness" or inherently being agents of harm.)

The fact is, you should not trust the system to "do right." It hasn't, doesn't, and will not. The evidence is right there before your face each and every day. So the issue of citizen response naturally arises because of pressure from the system.

Turning to our network experience, consider spam. I don't know about you, but spam has cost me a lot of hours. Not just on my desk, but interfering with my business (asswipes using our domain names as return addresses for spam is one way, there are others.) What has the government done about it? Not a #$%^#$%^ thing in practical terms. In fact, with the CAN-SPAM act, they basically climbed right in bed with the spammers. Should I sit there like a turnip and not respond when the spammers screw with my life? The government isn't addressing the problem, so what is the correct course of action? Bending over?

Consider software piracy and shrink wrap licensing and software patents. At the legislative level, these issues have been well and truly fumbled, though that surely under-describes the problem. Should I sit there like a turnip and not respond when the pirates steal my software? The government isn't addressing this problem either, so again, what is the correct course of action? Still bending over?

Viruses and worms -- again, we're supposed to bend over and take it without lube or even a reach-around, right? Because... well, why? Why should we? Why? Most people have been doing just that, and what do we have to show for it? I'll tell you -- we have a bumper crop of viruses and worms, that's what we have.

It all comes down to one thing: If you trust and wait for the duly-constituted authorities to "do what is right" then you are simply naive. They're almost certainly not going to. They rarely do.

It turns out that the correct course of action becomes very clear when you think about the important things in your life, and what is actually best for society.

For instance, i

If the anti-Santy worm...

[shigelojoe]

...and the Santy worm come in contact, would it cause the server to asplode in a brilliant flash of light?

Nice, but at what cost?

[Novous]

The problem with a "good" virus, is that because of an oversight, it may cause more damage. It could open up a new expliot, or subtly damage a part of the server.

Security update?

[jacobcaz]

Is this really a "security update" as much as it's fiddling a bit with some PHP code? And this "beneficial" worm still defaces the site too:

• Sites that have been attacked by the anti-Santy worm are defaced with the words: "viewtopic.php secured by Anti-Santy-Worm V4. Your site is a bit safer, but upgrade to >= 2.0.11."

If I break into your house and clean your bathroom you could call me beneficial, but you might get a little upset if I used spray-paint to write "This house is a bit cleaner, but buy some Lysol" on your front door.

Re:Security update?

[imsabbel]

No, its more like , after finding your car unlocked and doors open, closing the door and put a piece of paper on the dashboard to lock it the next time...

Good Worms, Bad Worms

[mohrt]

Using a worm as a way to help instead of wreak havoc, this is an interesting idea. Why don't they carry this idea over to Spam and use it to send me things I'm actually interested in?

Re:White Knight Viruses/Worms?

[lachlan76]

No, there was another one, the Nachi virus.

IIRC, this caused as much damage as a normal worm. It crashed systems, destroyed windows installations, etc. etc.

Anti-IE worm...

[Vague but True]

How long before someone makes an "Anti-IE" worm that automaticaly installs FF on everyone's computers.

No such thing as a white worm

[genessy]

Even if the worm patched the site without defacing it yet again, it's still going to bog down networks by replicating. Perhaps a better alternative would be to send a simple e-mail to vulnerable sites and allow them to make the decision to patch or upgrade to the newest version.

Re:No such thing as a white worm

[DeVilla]

Perhaps a better alternative would be to send a simple e-mail to vulnerable sites and allow them to make the decision to patch or upgrade to the newest version.

This sounds really great in theory. Unfortunately, I know too many people who politely explained to someone that that had a security problem, just to have an embarressed admin turn around and claim that the person pointing it out must a hacker breaking into the system.

I even know a case where a person explained that the password on windows 95 was not meant for security purposes and that you could bypass it by clicking cancel, just to be reprimanded for breaking into computers he was authorized to use.

These day's, I would think real hard before telling somebody you don't know that they have a security problem. People don't turn down the opporunity to punish good deeds often enough.

BTW. I'm not saying the worm is a good idea. Even if the intentions are all good, if it fails in some unexpected way, it is still the author's fault. He/she has no right to be tampering with other people's system without their permission.

Re:Well, in that case...

[ErichTheWebGuy]

...give me your IP and I will login and make sure everything is in order.

Sure, and thanks! I appreciate it. My ip is 127.0.0.1. Let me know if you find anything worth patching!

Conundrum

[jabber01]

White worms are a nice theory, but I think they should be fought just as vehemently by anti-virus software as malicious ones.

Holes they use should never be left unpatched, even if the worm's patches are not applied.

Consider: If there was a benign strain of HIV out there that immunized you to Herpes upon infection, would you give up condoms?

What? That doesn't exist!

[Epistax]

Driftwood: "It's alright, that's in every contract! That's what they call the 'Sanity Clause.'"
Fiorello: "Ha-ha-ha-ha-ha. You can't fool me...there ain't no Sanity Clause."

Re:Well, in that case...

[Anonymous Coward]

Oh my God! I've never seen so much child and bestiality porn! You sicken me.

Survival of the fittest

[melvo]

The "success" of viruses and worms so far have been characterised by their ability to reproduce. This bears some resemblance to their genetic counterparts.

Perhaps the next phase will be a virus or worm that follows genetic theory. The genetic features that would have to be modelled would be:

1) it is considered beneficial
2) it can reproduce
3) it can mutate

The successful entities would then survive, and the unsucessful mutations would die out. Survival of the fittest?

which brings up another question...

[zogger]

... well, to me anyway because I just don't know. There are a lot of distros out there, including all the various "live" versions, and various ways to install. I am wondering, is there such a beast as a no brainer, one click to install Linux distro that works over the internet and would seamlessly replace a users windows install with a working and safe while downloading and installing linux distro? I mean, a windows user (or another linux user, whatever) clicks on a webpage link and off she goes? With broadband now, it's common to downloand an ISO and burn it, I was just wondering if there was a distro that was designed from the ground up to eliminate that intermediary step. Say someone had finally just had it with windows problems, just said to heck with it, just replace this whole mess with something else, etc. Click, download, install, as easy as a normal app? I know there are "network" installs, but those are usually targeted at corporations where a lot of PCs are on the LAN, etc, I mean one for joe raw beginner newbie home user surfer.

Re:which brings up another question...

[mobby_6kl]

You can just download the BeOS setup file (about 45-50mb) and run it as any other program. The rather normal installation process follows, it creates some files on a (preferably) FAT partition, all you then need to do is double-click the BeOS icon and the computer will reboot into BeOS. Download is availible here.

Nice thought but...

[Tajas]

This was a nice thought of sorts on the writers hands and is a good wake-up call to make people upgrade their outdated sites. I did a simple google search and found 2 sites that were hit by this anti-santy worm. I wonder what the admins of these sites are going to tell the people they work for?

Below are 2 sites that as of this posting have:
viewtopic.php secured by Anti-Santy-Worm V4

Your site is a bit safer, but upgrade to >= 2.0.11 !!
Upgrsrv:201.255.84.219/

http://www.ifotografi.it/secure.php/

http://www.forum.moto-portal.pl/secure.php/

Creeper and Reaper

[tepples]

In the 1970s, Creeper was the first Internet worm, which spread among computers running the Tenex OS. Reaper, the second Internet worm, was sent to destroy copies of Creeper.

The Code

[RobertTaylor]

Full code of asw.txt here....

This is the code of the worm extracted from a vulnerable box.

# asw: anti santy worm
# this worm will try to fix any viewtopic.php on local box
# will use this box for 1 day to search other buggy phpBB forums, and end.
etc...

Patching not posible... or not always...

[nereid666]

If the administrator is not absolutely dumb, the .php file must be not owned by the same user that runs the webserver. Then teh worm can not patch the file with the vulnerability.
I wish to know more details about how the Anti-Santy patch is done. Any URL?
A self-spreading worm it is always dangerous, another aproach, doubthly legal byut more polite is the strike back philosophy. If someone attacks you then strike back and patch them (and install other strike back worm). With this technic the infection could be reduced without increase the bandwith for all the internet.

Good Worms Bad Worms. When can we QOS these things

[human bean]

If you cannot stop people from doing dumb things and running systems that are open to this sort of abuse, then at least they could be nice enough to not bother the rest of us.

I need a router/switch/filter that recognises worm/virus traffic for what it is and sets QOS down (or out) on such traffic. Better yet, I want my internet provider to have one. So the neighbor next door's got twelve sessions of Butt Trumpet running on his PC and more broadband in Mbps than he has brain cells to rub together, doesn't mean the pipes I use outta here need to be effected.

Niceties would be an ability to recognise interactive traffic and flag it for regular service. Not an original idea, by the by, was first mentioned in sf by John Brunner some years back.

Another project I will never get round to.

This is the end of the rant. We now return you to your regularly scheduled /. programming. Had this been of actual importance, you would have been instructed where to browse for further news and information. This is only a rant.

Reasonable force

[PurpleWizard]

Be interesting to see if you could use the "reasonable force" defence for actions such as writing a palladin worm.

"I was just taking reasonable steps to protect my property from the attacks of others"

Call Me Crazy...

[General_Tso]

But I like installing my OWN updates. I don't care if it's not malware; if it takes the choice out of my hands it's bad news. Keep your paws of my machine, thank you.

--Tso