The "Santy" Worm, any ideas how to stop?

[grom]

This is rather a question for administration.

The last 3 days my phpbb forum (though patched) is being hit by the worm's requests 15-30 times a minute. I had to put password protection on the forum, but this can't last forever because I will be losing traffic from search engines.

Right at this moment most of the requests are done by the User-Agent "LWP::xxxx" where xxxx is different variations of the Perl script used to conduct the attack (e.g. lwp-trivial, LWP::Simple).

So...

Is it possible to block all the requests done by a user-agent containing the string "LWP"?

More info on LWP is available here:

http://www.webmasterworld.com/forum11/2029.htm

[sdjl]

I'm not sure about being able to block this worm entirely, but you can quite easily redirect a hit based on it's referrer using .htaccess.

You could direct the user/person back to a different site or something using the following:

RewriteEngine  on
RewriteCond %{HTTP_USER_AGENT} ^LWP
RewriteRule ^.*$ problem.html  [L]

I'm not sure how generic this is and whether it needs to have exactly LWP as the referer rather than LWP: blahblah, but give it a go.

You'll notice problem.html, this is the file that it redirects to, which would be in the same directory as the forum.
You could maybe setup a PHP file to redirect them to themselves

David

[grom]

The problem is that I will be still losing traffic if I redirect the hit to a file in my account, that's why blocking the worm on a more global level will be more useful.

[djn]

This is some code coming straight from the phpBB community forum:

RewriteEngine On
RewriteCond %{QUERY_STRING} ^(.*)highlight=\%2527 [OR]
RewriteCond %{HTTP_COOKIE}% s.*):\%22test1\%22\%3b
RewriteRule ^.*$ - [F,L]

I don't know how much it is worth, but I've put it into the .htaccess of all my forum directories (besides upgrading, of course)

djn

[grom]

This is some code coming straight from the phpBB community forum:

RewriteEngine On
RewriteCond %{QUERY_STRING} ^(.*)highlight=\%2527 [OR]
RewriteCond %{HTTP_COOKIE}% s.*):\%22test1\%22\%3b
RewriteRule ^.*$ - [F,L]

I don't know how much it is worth, but I've put it into the .htaccess of all my forum directories (besides upgrading, of course)

djn

I've been trying that one too. It didn't work.
Try to do a query containing the "highlight=\%2527" string, it will not give you 403 (F-Forbidden) error. At least it didn't work in my case.

[Ihost]

Maybe I am missing something here, but why are you worried about losing the traffic from the referrers that use the strings that you are rewriting. Surely these are NOT the visitors that you want.

Neither do you want those URL's to be well listed in the search engines.

I would say getting the forbidden page is exactly what the .htaccess file should be generating.

Since the SE robots should not be coming into your site with that referrer they should not get the forbidden page.

Or have I totally missed the point?

[djn]

I've been trying that one too. It didn't work.
Try to do a query containing the "highlight=\%2527" string, it will not give you 403 (F-Forbidden) error. At least it didn't work in my case.

Sorry for the late reply.
Actually it does give a 403 if the string is "highlight=%2527". The slash is there to escape the percent sign in the regex, I guess.

[sdjl]

The slash is there to escape the percent sign in the regex, I guess.

Correct. % would be treated as a special character.

David